kick/tabbed-wlroots.c

/* tabbed-wlroots.c -- nested tabbed compositor built on wlroots 0.19.
 *
 * Renders a headless wlroots output (via wlr_scene) inside a host Wayland
 * window (the "host" connection, e.g. labwc).  Input from the host is
 * forwarded into a wlr_seat, so wlroots handles all sub-surface hit-testing,
 * enter/leave, input regions and coordinate translation.  Clients are always
 * maximized to the host content area; a client's fullscreen request is
 * honored and mirrors onto the host window, and vice versa.
 */

#define _GNU_SOURCE

#include <errno.h>
#include <execinfo.h>
#include <fcntl.h>
#include <linux/memfd.h>
#include <poll.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/poll.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <drm_fourcc.h>

#include <wayland-client.h>
#include <wayland-egl.h>
#include <wayland-server.h>

#include "xdg-decoration-client.h"
#include "xdg-shell-client.h"
#include "wlr-data-control-client.h"

#include <EGL/egl.h>
#include <EGL/eglext.h>
#include <GLES2/gl2.h>
#include <GLES2/gl2ext.h>

#include <xkbcommon/xkbcommon.h>

/* xkbcommon 1.6 renamed/removed the Mod4 macro: >= 1.7 defines only the
   legacy XKB_MOD_NAME_LOGO (kept for compat), < 1.7 defines the modern
   XKB_MOD_NAME_MOD4.  Prefer the modern name where it exists. */
#ifdef XKB_MOD_NAME_MOD4
#define XKB_PREFIX_MOD4_NAME XKB_MOD_NAME_MOD4
#else
#define XKB_PREFIX_MOD4_NAME XKB_MOD_NAME_LOGO
#endif

#include <ft2build.h>
#include FT_FREETYPE_H

#include <cairo.h>
#include <librsvg/rsvg.h>
#include <png.h>

#include <wlr/backend.h>
#include <wlr/backend/headless.h>
#include <wlr/backend/session.h>
#include <wlr/interfaces/wlr_keyboard.h>
#include <wlr/render/allocator.h>
#include <wlr/render/drm_format_set.h>
#include <wlr/render/egl.h>
#include <wlr/render/gles2.h>
#include <wlr/render/pass.h>
#include <wlr/render/swapchain.h>
#include <wlr/render/wlr_renderer.h>
#include <wlr/render/wlr_texture.h>
#include <wlr/types/wlr_buffer.h>
#include <wlr/types/wlr_compositor.h>
#include <wlr/types/wlr_cursor.h>
#include <wlr/types/wlr_data_control_v1.h>
#include <wlr/types/wlr_data_device.h>
#include <wlr/types/wlr_input_device.h>
#include <wlr/types/wlr_keyboard.h>
#include <wlr/types/wlr_linux_dmabuf_v1.h>
#include <wlr/types/wlr_output.h>
#include <wlr/types/wlr_output_layout.h>
#include <wlr/types/wlr_pointer.h>
#include <wlr/types/wlr_scene.h>
#include <wlr/types/wlr_seat.h>
#include <wlr/types/wlr_shm.h>
#include <wlr/types/wlr_subcompositor.h>
#include <wlr/types/wlr_xcursor_manager.h>
#include <wlr/types/wlr_xdg_shell.h>
#include <wlr/util/log.h>

/* server.apps grows as needed; there is no tab limit. */

/* ===================== Server-side (wlroots) state ===================== */

struct tabbed_app {
    char *cmd;
    pid_t pid;
    /* Process group the *connected* client lives in.  Command-line commands
       are forked all at once at startup (see launch_all_cli), so a CLI tab's
       slot is claimed by whichever command's client connects -- matched by
       process group at claim time, not by order; sub-windows and external
       clients claim later.  A close must signal the group recorded at claim
       time rather than the launcher's pid. */
    pid_t pgid;
    /* PID of the *connected* client (from claim-time credentials).  Used as
       the kill target when the client belongs to a process group we do not
       own (e.g. one started from the compositor's own shell/terminal), where
       signaling the whole group would kill the launcher's session too. */
    pid_t client_pid;
    struct wlr_xdg_toplevel *toplevel;
    struct wlr_scene_tree *tree;
    struct wl_listener destroy;
    struct wl_listener map;
    struct wl_listener commit;
    struct wl_listener request_maximize;
    struct wl_listener request_fullscreen;
    struct wl_listener request_minimize;
    struct wl_listener request_move;
    struct wl_listener request_resize;

    /* Resolved overlay icon (a GL texture in host pixel space). */
    GLuint icon_tex;
    int icon_w, icon_h;

    /* Resolved overlay icon for standalone mode (a wlroots texture). */
    struct wlr_texture *icon_wlr;
    bool icon_resolved;   /* true once a load attempt has been made */

    /* Slot awaiting its toplevel.  True from creation until a client claims
       the slot in handle_new_toplevel (matched by launch process group), so
       a CLI tab or a fresh Alt+Shift+T terminal is live-but-black while its
       command starts: it shows in the overlay with its command line as the
       title, and cycling can land on it (backdrop + title).  Cleared on
       claim, and again when a black tab is closed.  A slot without a
       toplevel and without pending_claim would only exist transiently, so
       closed tabs leave no holes: remove_app() drops them outright. */
    bool pending_claim;

    /* Where a tab's slot came from.  ORIGIN_CLI slots hold the command-line
       commands and are forked all at once at startup (see launch_all_cli),
       so the tab order mirrors the command line.  ORIGIN_ADD_TAB is an
       Alt+Shift+T terminal.  ORIGIN_SUB is a second toplevel from an
       already-connected client and is glued right of its parent tab.
       ORIGIN_EXTERNAL is a client we did not launch (e.g. started from our
       own shell). */
    enum { ORIGIN_CLI, ORIGIN_ADD_TAB, ORIGIN_SUB, ORIGIN_EXTERNAL } origin;
    /* For ORIGIN_SUB: the tab owning the connected client this window
       belongs to (the "parent" tab its slot is glued right of). */
    struct tabbed_app *parent_app;

    /* The user closed this tab (Alt+Delete).  While set, cycle_tab skips the
       slot and the SIGKILL escalation timer (close_timer) may still be armed;
       cleared once the toplevel is destroyed or the slot is reused. */
    bool closing;
    struct wl_event_source *close_timer;
};

struct tabbed_server {
    struct wl_display *wl_display;
    struct wl_event_loop *loop;
    struct wlr_backend *backend;
    struct wlr_renderer *renderer;
    struct wlr_allocator *allocator;
    struct wlr_scene *scene;
    struct wlr_output *output;
    struct wlr_scene_output *scene_output;
    struct wlr_scene_rect *bg_rect;
    /* Transparent full-output sentinel used to force whole-output damage on
       overlay transitions; see standalone_overlay_damage(). */
    struct wlr_scene_rect *overlay_damage_rect;
    /* Standalone-only cursor: a real wlr_cursor so the pointer is visible
       (hardware cursor plane on DRM, scene-composited on headless). */
    struct wlr_cursor *cursor;
    struct wlr_xcursor_manager *xcursor_mgr;
    struct wlr_output_layout *output_layout;
    struct wlr_seat *seat;
    struct wlr_xdg_shell *xdg_shell;
    struct wlr_keyboard keyboard;
    struct wlr_swapchain *swapchain;

    struct wl_listener new_output;
    struct wl_listener new_toplevel;
    struct wl_listener new_popup;
    struct wl_listener frame;
    struct wl_listener output_destroy;
    struct wl_event_source *ctl_source;

    /* The active tab, by slot.  Set to the last command-line command's slot
       at startup, so that tab is active -- black, with its command line as
       the overlay title -- from the very first frame and the user only waits
       for it.  A slot that is active while still pending (no toplevel yet)
       shows the black backdrop and clear seat focus until it maps. */
    struct tabbed_app *active_app;
    struct tabbed_app **apps;
    int num_apps;
    int apps_cap;

    struct xkb_context *xkb_ctx;
    struct xkb_keymap *xkb_keymap;
    struct xkb_state *xkb_state;
    /* Modifier index of the tab-management prefix (Alt or Super/Mod4,
       per --modifier). */
    xkb_mod_index_t xkb_prefix_mod;

    /* A client's fullscreen request is honored and mirrored onto the host
       window, and vice versa. */
    bool clients_fullscreen;

    /* Standalone (real output) mode: the output is driven directly by a
       native backend (DRM/headless) instead of being blitted into a host
       window.  Set from TABBED_MODE=standalone or a forced WLR_BACKENDS. */
    bool standalone;
    bool standalone_headless;
    struct wlr_session *session;
    struct wl_listener new_input;
    struct wlr_texture *overlay_atlas_wlr; /* standalone: overlaid atlas */

    /* Standalone native keyboard devices (one entry per libinput keyboard;
       see standalone_kbdev below). */
    struct wl_list kbdevs;
    /* Standalone native pointer devices (one entry per libinput pointer;
       see standalone_ptrdev below). */
    struct wl_list ptrdevs;
};

/* Requested output resolution from --screen-mode WxH[@Hz]; 0/0/0 means "let
   the output pick its preferred mode".  Refresh is stored in mHz. */
static int mode_req_w, mode_req_h;
static int mode_req_refresh;

/* The command-line command to start focused (--start-cmd-index), 0-based as
   soon as the (1-based) user value is parsed.  -1 (unset) means the last
   command, keeping the startup contract. */
static int start_cmd_index = -1;

/* ===================== Host-side (nested) state ===================== */

/* One cached ASCII glyph in the overlay's font atlas texture. */
struct overlay_glyph {
    int ax, ay;   /* atlas pixel origin */
    int pw, ph;   /* glyph bitmap size */
    int adv;      /* advance width, pixels */
    int top;      /* y offset of the glyph top from the row top */
};

struct tabbed_host {
    struct wl_display *display;
    struct wl_registry *registry;
    struct wl_compositor *compositor;
    struct wl_surface *surface;
    struct xdg_wm_base *wm_base;
    struct xdg_surface *xdg_surface;
    struct xdg_toplevel *toplevel;
    struct zxdg_decoration_manager_v1 *decoration;
    struct zxdg_toplevel_decoration_v1 *decoration_obj;
    struct wl_seat *seat;
    struct wl_keyboard *keyboard;
    struct wl_pointer *pointer;
    uint32_t seat_name;          /* registry name of the bound wl_seat global */
    bool registry_synced;        /* initial registry scan completed */
    bool configured;
    bool fullscreen;
    int width, height;
    /* EGL */
    bool egl_ok;
    EGLDisplay egl_display;
    EGLConfig egl_config;
    EGLContext egl_context;
    EGLSurface egl_surface;
    struct wl_egl_window *egl_window;
    /* host modifiers (for tab-switch detection) */
    uint32_t host_mods_depressed;
    uint32_t axis_source;
    int32_t axis_discrete[2];
    /* GL program */
    GLuint gl_program;
    GLint gl_pos_loc, gl_uv_loc, gl_tex_loc, gl_color_loc;
    GLuint import_tex;
    /* Alt-held tab-title overlay */
    bool overlay_visible;
    GLuint overlay_atlas_tex;
    GLuint overlay_white_tex;
    int overlay_atlas_w, overlay_atlas_h;
    struct overlay_glyph overlay_glyphs[95]; /* chars 32..126 */
    int overlay_font_h;                     /* ascent + descent, pixels */
    /* Present gating: at most one buffer aimed at the host compositor at a
       time, paced by the host surface's wl_callback. */
    struct wl_callback *frame_cb;
    bool present_pending;
    bool back_dirty;
    /* Keybind repeat for the captured tab-switch binding.  The host
       compositor only sends one physical press, so we drive the repeat
       ourselves with a timer (fixed delay/rate), like labwc does for its
       own keybinds. */
    struct wl_event_source *repeat_timer;
    uint32_t repeat_key;
    int repeat_dir;
    /* What each repeat tick should do: REPEAT_CYCLE switches tabs,
       REPEAT_REORDER moves the active tab within the list. */
    enum { REPEAT_CYCLE, REPEAT_REORDER } repeat_kind;
};

static struct tabbed_server server;
static struct tabbed_host host;
static char tabbed_socket[64];
static char socket_path[256];
static volatile sig_atomic_t needs_redraw;
static bool frame_pending;
static bool shutting_down;

/* Terminal launched for the Alt+Shift+T "new tab" binding.  Defaults to
   alacritty (sane no-config font size, unlike foot's 8pt); overridable via
   the $TERMINAL environment variable.  The value is used verbatim by sh -c,
   so it may carry arguments. */
static const char *term_cmd = "alacritty";
static bool term_key_held;   /* Alt+Shift+T currently down (repeat latch) */
static bool delete_key_held; /* prefix+Delete currently down (repeat latch) */

/* The modifier prefix for the tab-management chords: hold = show overlay,
   Up/Down = cycle, Shift+Up/Down = reorder, Delete = close.  Defaults to
   Alt; --modifier super selects Super (Mod4), which is a good fit for
   standalone/DRM and labwc-style hosts that do not reserve it the way
   GNOME does. */
enum tabbed_prefix { PREFIX_ALT, PREFIX_SUPER };
static enum tabbed_prefix tab_prefix = PREFIX_ALT;

/* ===================== Clipboard bridge ===================== */

enum bridge_backend {
    BRIDGE_BACKEND_NONE = 0,
    BRIDGE_BACKEND_DATA_CONTROL,
    BRIDGE_BACKEND_WL_DATA_DEVICE,
};

/* Bridges the nested seat's clipboard with the host compositor's.  Two host
   backends share one inner (nested-seat) implementation:
     - data-control: zwlr_data_control_v1 (labwc/sway/etc.), full duplex,
       independent of keyboard focus.
     - wl_data_device: plain stable protocol (Mutter/GNOME fallback).  Writing
       the host selection always works (needs a captured keyboard serial);
       reading the host selection only works while our window is focused.
   Data flows by passing file descriptors straight through in both directions
   (host offer -> nested source, nested source -> host source), so no
   intermediate copy is needed. */
struct clipboard_bridge {
    enum bridge_backend backend;

    /* nested (wlroots) seat */
    struct wl_listener request_set_selection;
    struct wl_listener set_selection;

    /* the nested selection source currently mirrored to the host; serves
       host paste requests until it is destroyed */
    struct wlr_data_source *inner_src;
    struct wl_listener inner_src_destroy;
    bool inner_clear_requested; /* nested client asked to clear the selection */
    bool ignore_next_inner;     /* one-shot echo guard for host->nested clears */

    /* host: standard wl_data_device (always bound; the fallback backend) */
    struct wl_data_device_manager *ddm;
    struct wl_data_device *dd;
    struct wl_data_source *dd_source;    /* our host-side source (nested copy) */
    struct wl_data_offer *dd_offer;      /* current host selection offer */
    struct wl_data_offer *dd_echo_offer; /* offer describing our own set */
    uint32_t kbd_serial;                 /* last host keyboard/enter serial */

    /* host: wlr-data-control backend (if the host exposes it) */
    struct zwlr_data_control_manager_v1 *dc_manager;
    struct zwlr_data_control_device_v1 *dc_device;
    struct zwlr_data_control_source_v1 *dc_source;
    struct zwlr_data_control_offer_v1 *dc_offer;
    struct zwlr_data_control_offer_v1 *dc_echo_offer;

    /* MIME list currently being collected from a host offer */
    char **mimes;
    size_t mimes_len, mimes_cap;
    bool dc_pending_echo; /* our own set via data-control: echo not yet consumed */
    bool dd_pending_echo; /* our own set via wl_data_device: echo not yet consumed */
    bool host_set_pending; /* nested selection not yet on the host; retry on focus */

    /* Eager text prefetch: when a real host selection is mirrored, its primary
       text MIME is pulled into this buffer at copy time so pastes are served
       instantly instead of asking the host for each one. */
    int prefetch_fd;                 /* pipe read end, -1 when idle */
    struct wl_event_source *prefetch_src;
    char *prefetch_buf;
    size_t prefetch_len, prefetch_cap;
    char prefetch_mime[64];          /* canonical text MIME, "" if none */
    bool prefetch_ready;             /* buffer complete (EOF received) */
};

static struct clipboard_bridge bridge = { .prefetch_fd = -1 };

static void bridge_cleanup(void);
static void bridge_init(void);
static void bridge_attach_seat(void);

/* Frame dumps: SIGUSR1 (or TABBED_AUTODUMP) requests a scene-buffer save
   (client content as wlroots drew it) and a host back-buffer save (what we
   composited for the host) on the next frame. */
static volatile sig_atomic_t dump_scene_req, dump_host_req;
static int dump_seq;
static bool client_dumped = false;

/* Set by sigchld_handler whenever a child exits; the main loop clears it and
   runs sweep_dead_startup_groups() to drop black tabs whose command exited
   without ever connecting.  A plain flag (set + cleared in the loop) keeps
   the reaping work out of the signal handler. */
static volatile sig_atomic_t sigchld_seen = 0;

/* A tab is "live" when it can own the show: it has a mapped toplevel, or
   it is pending (black) -- an unclaimed CLI tab at startup or a fresh
   Alt+Shift+T terminal.  Slots are otherwise removed outright, so a live
   check is all that's needed to know whether a slot should be shown,
   cycled to, or handed the active crown. */
static bool app_live(struct tabbed_app *app);
/* The currently focused toplevel (NULL while the active slot is black). */
static struct wlr_xdg_toplevel *active_toplevel(void);
static void set_active_app(struct tabbed_app *app);
static void set_active_surface(struct wlr_xdg_toplevel *toplevel);
static void render_and_present(void);
static struct tabbed_app *app_for_toplevel(struct wlr_xdg_toplevel *toplevel);
static int app_index(struct tabbed_app *app);
static struct tabbed_app *pick_successor(struct tabbed_app *app,
                                         int prefer_right);
static void remove_app(int idx);
static int add_tab(const char *cmd);
static int cmd_in_path(const char *cmd);
static void insert_app_after(struct tabbed_app *app, struct tabbed_app *anchor);
static void launch_client(struct tabbed_app *app);
static void launch_all_cli(void);

/* Logging levels: quiet by default so a plain launch writes nothing to the
   launching terminal except fatal errors.  TABBED_LOG=1 shows status lines,
   TABBED_LOG=2 adds the per-frame [diag] trace.  SIGUSR1 and TABBED_AUTODUMP
   dumps always write their .ppm files regardless of level. */
enum { TABBED_LOG_QUIET = 0, TABBED_LOG_INFO = 1, TABBED_LOG_DEBUG = 2 };

static int tabbed_log_level(void) {
    static volatile sig_atomic_t level = -1;
    if (level < 0) {
        const char *v = getenv("TABBED_LOG");
        int l = v ? atoi(v) : 0;
        if (l < TABBED_LOG_QUIET) l = TABBED_LOG_QUIET;
        if (l > TABBED_LOG_DEBUG) l = TABBED_LOG_DEBUG;
        level = l;
    }
    return level;
}

static void tabbed_vlog(int level, const char *fmt, va_list args) {
    if (level > tabbed_log_level())
        return;
    vfprintf(stderr, fmt, args);
}

static void tabbed_log(int level, const char *fmt, ...) {
    va_list args;
    va_start(args, fmt);
    tabbed_vlog(level, fmt, args);
    va_end(args);
}

/* Route libxkbcommon's own log output (which otherwise writes
   "xkbcommon: ERROR: ..." straight to stderr, bypassing TABBED_LOG) through
   our level system.  Errors surface at info level; warnings and below are
   debug-only, so a quiet launch no longer leaks parse failures to the
   launching terminal. */
static void tabbed_xkb_log(struct xkb_context *ctx, enum xkb_log_level level,
                           const char *fmt, va_list args)
{
    (void)ctx;
    int l = (level <= XKB_LOG_LEVEL_ERROR) ? TABBED_LOG_INFO : TABBED_LOG_DEBUG;
    if (l > tabbed_log_level())
        return;
    fputs("tabbed-wlroots: xkbcommon: ", stderr);
    vfprintf(stderr, fmt, args);
}

static void tabbed_log_level_init(void) {
    (void)tabbed_log_level();
}

/* The process group to signal for an app: the group its claimed client lives
   in (set at claim time), falling back to the launcher pid for slots with no
   client yet. */
static pid_t app_signal_group(struct tabbed_app *app) {
    return (app && app->pgid > 0) ? app->pgid : (app ? app->pid : -1);
}

/* Whether an app has a killable target: either a process group we own, or a
   connected client pid (external clients sharing our own group). */
static bool app_killable(struct tabbed_app *app) {
    return app && (app_signal_group(app) > 0 || app->client_pid > 0);
}

/* Signal an app's process target.  A group we created (launch_client runs the
   child in its own setpgid'd group) is signaled as a group so the whole client
   tree dies.  A client we did NOT create, or one sharing our own process group
   (e.g. started from the same terminal as the compositor), is signaled by pid
   alone: group-signaling it would kill the launcher's session, ourselves
   included. */
static void kill_app(struct tabbed_app *app, int sig) {
    pid_t g = app_signal_group(app);
    if (g > 0 && g != getpgid(0))
        kill(-g, sig);
    else if (app && app->client_pid > 0)
        kill(app->client_pid, sig);
}

/* Terminate every launched client: SIGTERM first for a graceful shutdown,
   then SIGKILL any stragglers after a short grace period. */
static void terminate_clients(void) {
    for (int i = 0; i < server.num_apps; i++)
        kill_app(server.apps[i], SIGTERM);
    struct timespec wait = { .tv_sec = 0, .tv_nsec = 150000000 };
    nanosleep(&wait, NULL);
    for (int i = 0; i < server.num_apps; i++)
        kill_app(server.apps[i], SIGKILL);
}

/* Remove the session's Wayland socket file (and its companion .lock file,
   both created by wl_display_add_socket), if present.  The full path is
   precomputed at startup so this only ever calls unlink()/snprintf(), which
   are async-signal-safe and therefore safe from the signal/crash handlers
   too.  A missing file is fine: ENOENT is ignored, i.e. nothing to clean. */
static void remove_socket_file(void) {
    unlink(socket_path);
    char lock_path[sizeof(socket_path) + 6];
    snprintf(lock_path, sizeof(lock_path), "%s.lock", socket_path);
    unlink(lock_path);
}

static void overlay_font_fini(void);
static void standalone_overlay_damage(void);

/* Standalone native keyboard: one struct per libinput keyboard device, so
   modifier state is always read from the device that emitted the event (the
   legacy single-slot approach broke Shift/Caps when a host exposed several
   keyboards, e.g. a consumer-control node alongside the real one). */
struct standalone_kbdev {
    struct wlr_keyboard *keyboard;
    struct wl_listener key;
    struct wl_listener modifiers;
    struct wl_listener destroy;
    struct wl_list link;
};

/* Standalone native pointer: one struct per libinput pointer device.  Each
   device owns its listeners so a device going away (libinput suspends every
   device when the session loses its VT) can detach them before wlroots
   asserts the event lists are empty, and so all pointers -- not just the
   last-attached one -- reach the seat. */
struct standalone_ptrdev {
    struct wlr_pointer *pointer;
    struct wl_listener motion;
    struct wl_listener motion_absolute;
    struct wl_listener button;
    struct wl_listener axis;
    struct wl_listener frame;
    struct wl_listener destroy;
    struct wl_list link;
};

/* Grow server.apps to hold at least n entries.  Returns 0 on success, -1 on
   allocation failure.  The buffer is freed in shutdown_cleanup(). */
static int apps_ensure_cap(int n) {
    if (n <= server.apps_cap) return 0;
    struct tabbed_app **grown =
        realloc(server.apps, (size_t)n * sizeof(*grown));
    if (!grown) return -1;
    server.apps = grown;
    server.apps_cap = n;
    return 0;
}

static bool app_live(struct tabbed_app *app) {
    return app && (app->toplevel || app->pending_claim);
}

static struct wlr_xdg_toplevel *active_toplevel(void) {
    return server.active_app ? server.active_app->toplevel : NULL;
}

/* Full shutdown of the nested session: take down the clients first, then
   free our own allocations and exit. Guarded so the various close paths
   (host window close, last tab closed) only run once. */
static void shutdown_cleanup(void) {
    if (shutting_down) return;
    shutting_down = true;
    terminate_clients();
    for (int i = 0; i < server.num_apps; i++) {
        if (host.egl_ok && server.apps[i]->icon_tex) {
            glDeleteTextures(1, &server.apps[i]->icon_tex);
            server.apps[i]->icon_tex = 0;
        }
        if (server.apps[i]->icon_wlr) {
            wlr_texture_destroy(server.apps[i]->icon_wlr);
            server.apps[i]->icon_wlr = NULL;
        }
        free(server.apps[i]->cmd);
        free(server.apps[i]);
    }
    free(server.apps);
    server.apps = NULL;

    /* Detach + free the standalone native keyboard devices. */
    struct standalone_kbdev *kd, *kd_tmp;
    wl_list_for_each_safe(kd, kd_tmp, &server.kbdevs, link) {
        wl_list_remove(&kd->link);
        wl_list_remove(&kd->key.link);
        wl_list_remove(&kd->modifiers.link);
        wl_list_remove(&kd->destroy.link);
        free(kd);
    }
    wl_list_init(&server.kbdevs);

    /* Detach + free the standalone native pointer devices. */
    struct standalone_ptrdev *pd, *pd_tmp;
    wl_list_for_each_safe(pd, pd_tmp, &server.ptrdevs, link) {
        wl_list_remove(&pd->link);
        wl_list_remove(&pd->motion.link);
        wl_list_remove(&pd->motion_absolute.link);
        wl_list_remove(&pd->button.link);
        wl_list_remove(&pd->axis.link);
        wl_list_remove(&pd->frame.link);
        wl_list_remove(&pd->destroy.link);
        free(pd);
    }
    wl_list_init(&server.ptrdevs);

    if (server.overlay_atlas_wlr) {
        wlr_texture_destroy(server.overlay_atlas_wlr);
        server.overlay_atlas_wlr = NULL;
    }
    if (server.xkb_state) xkb_state_unref(server.xkb_state);
    if (server.xkb_keymap) xkb_keymap_unref(server.xkb_keymap);
    if (server.xkb_ctx) xkb_context_unref(server.xkb_ctx);
    overlay_font_fini();
    bridge_cleanup();
    remove_socket_file();
}

/* ===================== EGL helpers ===================== */

static PFNEGLCREATEIMAGEKHRPROC pfn_eglCreateImageKHR;
static PFNEGLDESTROYIMAGEKHRPROC pfn_eglDestroyImageKHR;
static PFNEGLGETPLATFORMDISPLAYEXTPROC pfn_eglGetPlatformDisplayEXT;
static PFNGLEGLIMAGETARGETTEXTURE2DOESPROC pfn_glEGLImageTargetTexture2DOES;

static void *egl_proc(const char *name) {
    void *p = (void *)eglGetProcAddress(name);
    if (!p)
        fprintf(stderr, "tabbed-wlroots: EGL proc %s unavailable\n", name);
    return p;
}

static GLuint compile_shader(GLenum type, const char *src) {
    GLuint sh = glCreateShader(type);
    glShaderSource(sh, 1, &src, NULL);
    glCompileShader(sh);
    GLint ok;
    glGetShaderiv(sh, GL_COMPILE_STATUS, &ok);
    if (!ok) {
        char log[512];
        glGetShaderInfoLog(sh, sizeof(log), NULL, log);
        fprintf(stderr, "tabbed-wlroots: shader error: %s\n", log);
        glDeleteShader(sh);
        return 0;
    }
    return sh;
}

static bool gl_setup(void) {
    const char *vs =
        "attribute vec2 a_pos;\n"
        "attribute vec2 a_uv;\n"
        "varying vec2 v_uv;\n"
        "void main() {\n"
        "  v_uv = a_uv;\n"
        "  gl_Position = vec4(a_pos, 0.0, 1.0);\n"
        "}\n";
    const char *fs =
        "precision mediump float;\n"
        "varying vec2 v_uv;\n"
        "uniform sampler2D u_tex;\n"
        "uniform vec4 u_color;\n"
        "void main() {\n"
        "  gl_FragColor = texture2D(u_tex, v_uv) * u_color;\n"
        "}\n";
    GLuint vsh = compile_shader(GL_VERTEX_SHADER, vs);
    GLuint fsh = compile_shader(GL_FRAGMENT_SHADER, fs);
    if (!vsh || !fsh) return false;
    host.gl_program = glCreateProgram();
    glAttachShader(host.gl_program, vsh);
    glAttachShader(host.gl_program, fsh);
    glBindAttribLocation(host.gl_program, 0, "a_pos");
    glBindAttribLocation(host.gl_program, 1, "a_uv");
    glLinkProgram(host.gl_program);
    GLint ok;
    glGetProgramiv(host.gl_program, GL_LINK_STATUS, &ok);
    glDeleteShader(vsh);
    glDeleteShader(fsh);
    if (!ok) {
        char log[512];
        glGetProgramInfoLog(host.gl_program, sizeof(log), NULL, log);
        fprintf(stderr, "tabbed-wlroots: link error: %s\n", log);
        return false;
    }
    host.gl_pos_loc = glGetAttribLocation(host.gl_program, "a_pos");
    host.gl_uv_loc = glGetAttribLocation(host.gl_program, "a_uv");
    host.gl_tex_loc = glGetUniformLocation(host.gl_program, "u_tex");
    host.gl_color_loc = glGetUniformLocation(host.gl_program, "u_color");

    glGenTextures(1, &host.import_tex);
    glBindTexture(GL_TEXTURE_2D, host.import_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glBindTexture(GL_TEXTURE_2D, 0);

    glGenTextures(1, &host.overlay_white_tex);
    glBindTexture(GL_TEXTURE_2D, host.overlay_white_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
    const GLubyte white_px[4] = { 255, 255, 255, 255 };
    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 1, 1, 0, GL_RGBA,
                 GL_UNSIGNED_BYTE, white_px);
    glBindTexture(GL_TEXTURE_2D, 0);
    return true;
}

/* Blit a source rect of a texture into the window at the given destination
   rect (dst_x, dst_y, dst_w, dst_h, window coords), clipped to the window.
   The source is stretched uniformly to the destination (1:1 when the rects
   match).  The draw is tinted by `color` (RGBA), so solid rects are drawn
   from a 1x1 white texture and text glyphs from the font atlas. */
static void draw_texture_rect(GLuint tex, int tex_w, int tex_h,
                              int src_x, int src_y, int src_w, int src_h,
                              int dst_x, int dst_y, int dst_w, int dst_h,
                              int win_w, int win_h, const GLfloat color[4])
{
    if (win_w <= 0 || win_h <= 0) return;
    if (src_w <= 0 || src_h <= 0 || dst_w <= 0 || dst_h <= 0) return;
    if (src_x >= tex_w || src_y >= tex_h) return;
    if (src_w > tex_w - src_x) src_w = tex_w - src_x;
    if (src_h > tex_h - src_y) src_h = tex_h - src_y;
    int cx = dst_x < 0 ? -dst_x : 0;
    int cy = dst_y < 0 ? -dst_y : 0;
    if (cx >= dst_w || cy >= dst_h) return;
    int wx0 = dst_x + cx;
    int wy0 = dst_y + cy;
    int cw = dst_w - cx;
    int ch = dst_h - cy;
    int maxw = win_w - wx0;
    int maxh = win_h - wy0;
    if (cw > maxw) cw = maxw;
    if (ch > maxh) ch = maxh;
    if (cw <= 0 || ch <= 0) return;

    float u0 = ((float)src_x + (float)src_w * cx / dst_w) / (float)tex_w;
    float u1 = ((float)src_x + (float)src_w * (cx + cw) / dst_w) / (float)tex_w;
    float v0 = ((float)src_y + (float)src_h * cy / dst_h) / (float)tex_h;
    float v1 = ((float)src_y + (float)src_h * (cy + ch) / dst_h) / (float)tex_h;

    float nx0 = -1.0f + 2.0f * (float)wx0 / (float)win_w;
    float ny0 = 1.0f - 2.0f * (float)wy0 / (float)win_h;
    float nx1 = -1.0f + 2.0f * (float)(wx0 + cw) / (float)win_w;
    float ny1 = 1.0f - 2.0f * (float)(wy0 + ch) / (float)win_h;

    GLfloat verts[8] = {
        nx0, ny0,
        nx1, ny0,
        nx1, ny1,
        nx0, ny1,
    };
    GLfloat uvs[8] = {
        u0, v0,
        u1, v0,
        u1, v1,
        u0, v1,
    };
    GLushort idx[6] = { 0, 1, 2, 0, 2, 3 };

    glUseProgram(host.gl_program);
    glActiveTexture(GL_TEXTURE0);
    glBindTexture(GL_TEXTURE_2D, tex);
    glUniform1i(host.gl_tex_loc, 0);
    glUniform4fv(host.gl_color_loc, 1, color);

    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, verts);
    glEnableVertexAttribArray(0);
    glVertexAttribPointer(1, 2, GL_FLOAT, GL_FALSE, 0, uvs);
    glEnableVertexAttribArray(1);

    glDrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT, idx);

    glDisableVertexAttribArray(0);
    glDisableVertexAttribArray(1);
}

/* ============ Alt-held tab-title overlay ============
   While the host Alt modifier is held, a passive list of tab titles is
   drawn into the top-left of the host window with the active tab
   highlighted.  Up/Down already cycle tabs while Alt is held, so the
   highlight follows server.active_app automatically.  Titles are read from
   the wlr_xdg_toplevel at draw time (terminals retitle themselves); a
   still-black tab shows its command line instead.  No per-client listeners
   are needed. */

static FT_Library overlay_ft_lib;
static FT_Face overlay_ft_face;
static bool overlay_font_ok;

/* Fixed rasterized font size; 30px is twice the original 15px constant. */
#define OVERLAY_FONT_PX 30

static const char *overlay_pick_font(void) {
    static const char *const paths[] = {
        "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
        "/usr/share/fonts/dejavu/DejaVuSans.ttf",
        "/usr/share/fonts/TTF/DejaVuSans.ttf",
        "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
        "/usr/share/fonts/truetype/liberation2/LiberationSans-Regular.ttf",
        "/usr/share/fonts/liberation/LiberationSans-Regular.ttf",
        "/usr/share/fonts/noto/NotoSans-Regular.ttf",
    };
    const char *env = getenv("TABBED_FONT");
    if (env && access(env, R_OK) == 0)
        return env;
    for (size_t i = 0; i < sizeof(paths) / sizeof(paths[0]); i++)
        if (access(paths[i], R_OK) == 0)
            return paths[i];
    return NULL;
}

/* Build the ASCII glyph atlas (chars 32..126) from the chosen system font.
   Must be called with the host EGL context current.  Non-fatal: on failure
   the overlay still renders its boxes, just without text. */
static void overlay_font_init(void) {
    static bool overlay_font_done;
    if (overlay_font_done) return;
    overlay_font_done = true;

    int px = OVERLAY_FONT_PX;
    static const char *overlay_font_path = NULL;
    if (!overlay_ft_lib) {
        const char *path = overlay_pick_font();
        if (!path) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] no font found; "
                    "set TABBED_FONT to enable overlay text\n");
            return;
        }
        overlay_font_path = path;
        if (FT_Init_FreeType(&overlay_ft_lib) != 0) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] FreeType init failed\n");
            return;
        }
        if (FT_New_Face(overlay_ft_lib, path, 0, &overlay_ft_face) != 0) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] cannot load font %s\n", path);
            FT_Done_FreeType(overlay_ft_lib);
            overlay_ft_lib = NULL;
            return;
        }
    }
    if (FT_Set_Pixel_Sizes(overlay_ft_face, 0, px) != 0) {
        tabbed_log(TABBED_LOG_INFO, "[overlay] cannot set pixel size %d\n", px);
        return;
    }

    int height = (int)(overlay_ft_face->size->metrics.height / 64.0f) + 1;
    int asc = (int)(overlay_ft_face->size->metrics.ascender / 64.0f);
    int adv_max = 0;
    for (int c = 32; c <= 126; c++) {
        if (FT_Load_Char(overlay_ft_face, c, FT_LOAD_DEFAULT) == 0) {
            int adv = (int)(overlay_ft_face->glyph->advance.x / 64.0f);
            if (adv > adv_max) adv_max = adv;
        }
    }
    if (adv_max <= 0) adv_max = 8;
    int cell_w = adv_max + 3;
    int cell_h = height + 3;
    int cols = 16;
    int rows = (95 + cols - 1) / cols;
    int atlas_w = cols * cell_w;
    int atlas_h = rows * cell_h;

    unsigned char *atlas = calloc((size_t)atlas_w * atlas_h * 2, 1);
    if (!atlas) {
        tabbed_log(TABBED_LOG_INFO, "[overlay] atlas alloc failed\n");
        return;
    }
    int n_glyphs = 0;
    for (int c = 32; c <= 126; c++) {
        struct overlay_glyph *g = &host.overlay_glyphs[c - 32];
        if (FT_Load_Char(overlay_ft_face, c, FT_LOAD_RENDER) != 0)
            continue;
        FT_Bitmap *bmp = &overlay_ft_face->glyph->bitmap;
        /* A bitmap wider/taller than its cell would corrupt the glyphs it
           spills into; skip such glyphs rather than damage the atlas. */
        if ((int)bmp->width > cell_w - 2 || (int)bmp->rows > cell_h - 2)
            continue;
        int cell = c - 32;
        int cx = (cell % cols) * cell_w;
        int cy = (cell / cols) * cell_h;
        g->ax = cx + 1;
        g->ay = cy + 1;
        g->pw = bmp->width;
        g->ph = bmp->rows;
        g->adv = (int)(overlay_ft_face->glyph->advance.x / 64.0f);
        g->top = asc - overlay_ft_face->glyph->bitmap_top;
        /* Cells are GL_LUMINANCE_ALPHA, so each 8-bit alpha is duplicated. */
        for (int r = 0; r < (int)bmp->rows; r++) {
            const unsigned char *src = bmp->buffer + (size_t)r * bmp->pitch;
            unsigned char *dst = atlas
                + ((size_t)(g->ay + r) * atlas_w + g->ax) * 2;
            for (int x = 0; x < (int)bmp->width; x++) {
                dst[x * 2 + 0] = src[x];
                dst[x * 2 + 1] = src[x];
            }
        }
        n_glyphs++;
    }
    if (n_glyphs == 0) {
        free(atlas);
        return;
    }

    if (server.standalone) {
        /* Standalone has no host GL context: hand the glyph bitmap to the
           wlroots renderer as a premultiplied-white texture (r=g=b=a) so the
           single quad shader can tint it via the pass alpha. */
        unsigned char *rgba = malloc((size_t)atlas_w * atlas_h * 4);
        if (rgba) {
            for (size_t i = 0; i < (size_t)atlas_w * atlas_h; i++) {
                unsigned char v = atlas[i * 2];
                rgba[i * 4 + 0] = v;
                rgba[i * 4 + 1] = v;
                rgba[i * 4 + 2] = v;
                rgba[i * 4 + 3] = v;
            }
            server.overlay_atlas_wlr = wlr_texture_from_pixels(
                server.renderer, DRM_FORMAT_ARGB8888,
                (uint32_t)atlas_w * 4, (uint32_t)atlas_w, (uint32_t)atlas_h,
                rgba);
        }
        free(rgba);
        free(atlas);
        host.overlay_font_h = height;
        overlay_font_ok = server.overlay_atlas_wlr != NULL;
        tabbed_log(TABBED_LOG_INFO, "[overlay] font %s glyphs=%d atlas=%dx%d\n",
                overlay_font_path, n_glyphs, atlas_w, atlas_h);
        return;
    }

    if (!host.overlay_atlas_tex)
        glGenTextures(1, &host.overlay_atlas_tex);
    glBindTexture(GL_TEXTURE_2D, host.overlay_atlas_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glTexImage2D(GL_TEXTURE_2D, 0, GL_LUMINANCE_ALPHA, atlas_w, atlas_h, 0,
                 GL_LUMINANCE_ALPHA, GL_UNSIGNED_BYTE, atlas);
    glBindTexture(GL_TEXTURE_2D, 0);
    free(atlas);
    host.overlay_atlas_w = atlas_w;
    host.overlay_atlas_h = atlas_h;
    host.overlay_font_h = height;
    overlay_font_ok = true;
    tabbed_log(TABBED_LOG_INFO, "[overlay] font %s glyphs=%d atlas=%dx%d\n",
            overlay_font_path, n_glyphs, atlas_w, atlas_h);
}

static void overlay_font_fini(void) {
    if (overlay_ft_face) {
        FT_Done_Face(overlay_ft_face);
        overlay_ft_face = NULL;
    }
    if (overlay_ft_lib) {
        FT_Done_FreeType(overlay_ft_lib);
        overlay_ft_lib = NULL;
    }
    overlay_font_ok = false;
}

/* ===================== Overlay app icons ===================== */

/* Drawn square of the icon slot, in host pixels. */
#define OVERLAY_ICON_SZ 28
#ifndef MIN
#define MIN(a, b) ((a) < (b) ? (a) : (b))
#endif

static char *overlay_strndup(const char *s, size_t n) {
    char *r = malloc(n + 1);
    if (r) {
        memcpy(r, s, n);
        r[n] = '\0';
    }
    return r;
}

static bool overlay_endswith(const char *s, const char *suffix) {
    size_t ls = strlen(s), lx = strlen(suffix);
    return ls >= lx && strcmp(s + ls - lx, suffix) == 0;
}

/* Read the Icon= value (case-sensitive, not the localized Icon[lang]= form)
   out of a .desktop file, malloc'd, or NULL. */
static char *desktop_icon_from_file(FILE *f) {
    char line[1024];
    while (fgets(line, sizeof(line), f)) {
        if (strncmp(line, "Icon=", 5) != 0)
            continue;
        if (line[5] == '[')   /* Icon[locale]= */
            continue;
        size_t n = strlen(line);
        while (n > 5 && (line[n - 1] == '\n' || line[n - 1] == '\r' ||
                         line[n - 1] == ' ' || line[n - 1] == '\t'))
            n--;
        return overlay_strndup(line + 5, n - 5);
    }
    return NULL;
}

/* Find `<app_id>.desktop` under an XDG data dir and return its Icon= value,
   or NULL. */
static char *desktop_icon_name(const char *app_id) {
    const char *data_home = getenv("XDG_DATA_HOME");
    const char *data_dirs = getenv("XDG_DATA_DIRS");
    if (!data_dirs || !data_dirs[0])
        data_dirs = "/usr/local/share:/usr/share";
    char buf[4096];

    if (data_home && data_home[0]) {
        snprintf(buf, sizeof(buf), "%s/applications/%s.desktop",
                 data_home, app_id);
        FILE *f = fopen(buf, "r");
        if (f) {
            char *icon = desktop_icon_from_file(f);
            fclose(f);
            if (icon) return icon;
        }
    }
    char *copy = strdup(data_dirs);
    if (!copy) return NULL;
    for (char *p = copy, *dir; p; p = dir) {
        dir = strchr(p, ':');
        if (dir) *dir++ = '\0';
        if (p[0]) {
            snprintf(buf, sizeof(buf), "%s/applications/%s.desktop", p, app_id);
            FILE *f = fopen(buf, "r");
            if (f) {
                char *icon = desktop_icon_from_file(f);
                fclose(f);
                if (icon) {
                    free(copy);
                    return icon;
                }
            }
        }
    }
    free(copy);
    return NULL;
}

/* Turn an Icon= value (theme name, bare filename or absolute path) into a
   loadable .png/.svg path, or NULL. */
static char *overlay_find_icon_file(const char *name) {
    static const char *const themes[] = { "Adwaita", "hicolor", "default" };
    static const char *const sizes[] =
        { "scalable", "48x48", "32x32", "24x24" };
    static const char *const exts[] = { "png", "svg" };
    char roots[8][512];
    int n_roots = 0;
    const char *data_home = getenv("XDG_DATA_HOME");
    const char *data_dirs = getenv("XDG_DATA_DIRS");
    if (data_home && data_home[0] && n_roots < 8)
        snprintf(roots[n_roots++], sizeof(roots[0]), "%s/icons", data_home);
    if (!data_dirs || !data_dirs[0])
        data_dirs = "/usr/local/share:/usr/share";
    char *copy = strdup(data_dirs);
    for (char *p = copy, *dir; p && n_roots < 8; p = dir) {
        dir = strchr(p, ':');
        if (dir) *dir++ = '\0';
        if (p[0])
            snprintf(roots[n_roots++], sizeof(roots[0]), "%s/icons", p);
    }
    free(copy);

    if (strchr(name, '/') && access(name, R_OK) == 0 &&
            (overlay_endswith(name, ".png") ||
             overlay_endswith(name, ".svg")))
        return strdup(name);

    char buf[4096];
    for (int tr = 0; tr < n_roots; tr++) {
        for (size_t t = 0; t < sizeof(themes) / sizeof(themes[0]); t++) {
            for (size_t s = 0; s < sizeof(sizes) / sizeof(sizes[0]); s++) {
                for (size_t e = 0; e < sizeof(exts) / sizeof(exts[0]); e++) {
                    snprintf(buf, sizeof(buf), "%s/%s/%s/apps/%s.%s",
                             roots[tr], themes[t], sizes[s], name, exts[e]);
                    if (access(buf, R_OK) == 0)
                        return strdup(buf);
                }
            }
        }
    }
    static const char *const pixmap_roots[] = {
        "/usr/share/pixmaps", "/usr/local/share/pixmaps",
    };
    for (size_t pr = 0; pr < sizeof(pixmap_roots) / sizeof(pixmap_roots[0]); pr++) {
        for (size_t e = 0; e < sizeof(exts) / sizeof(exts[0]); e++) {
            snprintf(buf, sizeof(buf), "%s/%s.%s", pixmap_roots[pr], name, exts[e]);
            if (access(buf, R_OK) == 0)
                return strdup(buf);
        }
    }
    return NULL;
}

/* Decode a PNG into straight (non-premultiplied) RGBA8, malloc'd. */
static unsigned char *overlay_load_png(const char *path, int *w, int *h) {
    FILE *f = fopen(path, "rb");
    if (!f) return NULL;
    png_structp png = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL,
                                             NULL);
    if (!png) {
        fclose(f);
        return NULL;
    }
    png_infop info = png_create_info_struct(png);
    if (!info) {
        png_destroy_read_struct(&png, NULL, NULL);
        fclose(f);
        return NULL;
    }
    if (setjmp(png_jmpbuf(png))) {
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    png_init_io(png, f);
    png_read_info(png, info);
    int bw = (int)png_get_image_width(png, info);
    int bh = (int)png_get_image_height(png, info);
    png_byte ct = png_get_color_type(png, info);
    png_byte bd = png_get_bit_depth(png, info);
    if (ct == PNG_COLOR_TYPE_PALETTE)
        png_set_palette_to_rgb(png);
    if (ct == PNG_COLOR_TYPE_GRAY && bd < 8)
        png_set_expand_gray_1_2_4_to_8(png);
    if (png_get_valid(png, info, PNG_INFO_tRNS))
        png_set_tRNS_to_alpha(png);
    if (bd == 16)
        png_set_strip_16(png);
    if (ct == PNG_COLOR_TYPE_RGB || ct == PNG_COLOR_TYPE_GRAY)
        png_set_filler(png, 0xff, PNG_FILLER_AFTER);
    if (ct == PNG_COLOR_TYPE_GRAY || ct == PNG_COLOR_TYPE_GRAY_ALPHA)
        png_set_gray_to_rgb(png);
    png_read_update_info(png, info);

    size_t rowbytes = png_get_rowbytes(png, info);
    size_t size = (size_t)bh * rowbytes;
    unsigned char *rgba = malloc(size);
    if (!rgba) {
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    png_bytep *rows = malloc(sizeof(png_bytep) * (size_t)bh);
    if (!rows) {
        free(rgba);
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    for (int y = 0; y < bh; y++)
        rows[y] = rgba + (size_t)y * rowbytes;
    png_read_image(png, rows);
    free(rows);
    png_destroy_read_struct(&png, &info, NULL);
    fclose(f);
    *w = bw;
    *h = bh;
    return rgba;
}

/* Decode an SVG into straight RGBA8 at its intrinsic size, malloc'd. */
static unsigned char *overlay_load_svg(const char *path, int *w, int *h) {
    GError *err = NULL;
    RsvgHandle *handle = rsvg_handle_new_from_file(path, &err);
    if (!handle || err) {
        if (err) g_error_free(err);
        return NULL;
    }
    double iw = 0, ih = 0;
    if (!rsvg_handle_get_intrinsic_size_in_pixels(handle, &iw, &ih))
        iw = ih = 48.0;   /* dimension-less SVG: assume an icon-sized square */
    if (iw <= 0 || ih <= 0) {
        g_object_unref(handle);
        return NULL;
    }
    int bw = (int)iw, bh = (int)ih;
    cairo_surface_t *surf =
        cairo_image_surface_create(CAIRO_FORMAT_ARGB32, bw, bh);
    if (cairo_surface_status(surf) != CAIRO_STATUS_SUCCESS) {
        cairo_surface_destroy(surf);
        g_object_unref(handle);
        return NULL;
    }
    cairo_t *cr = cairo_create(surf);
    RsvgRectangle viewport = { 0, 0, iw, ih };
    if (!rsvg_handle_render_document(handle, cr, &viewport, &err)) {
        if (err) g_error_free(err);
        cairo_destroy(cr);
        cairo_surface_destroy(surf);
        g_object_unref(handle);
        return NULL;
    }
    cairo_destroy(cr);
    cairo_surface_flush(surf);

    /* Cairo's ARGB32 is premultiplied, little-endian byte order B,G,R,A. */
    int n = bw * bh;
    unsigned char *rgba = malloc(sizeof(unsigned char) * 4 * (size_t)n);
    if (rgba) {
        unsigned char *src = cairo_image_surface_get_data(surf);
        for (int i = 0; i < n; i++) {
            unsigned char a = src[i * 4 + 3];
            unsigned char r = src[i * 4 + 2];
            unsigned char g = src[i * 4 + 1];
            unsigned char b = src[i * 4 + 0];
            if (a > 0) {
                r = (unsigned char)MIN((r * 255 + a / 2) / a, 255);
                g = (unsigned char)MIN((g * 255 + a / 2) / a, 255);
                b = (unsigned char)MIN((b * 255 + a / 2) / a, 255);
            }
            rgba[i * 4 + 0] = r;
            rgba[i * 4 + 1] = g;
            rgba[i * 4 + 2] = b;
            rgba[i * 4 + 3] = a;
        }
    }
    cairo_surface_destroy(surf);
    g_object_unref(handle);
    *w = bw;
    *h = bh;
    return rgba;
}

/* Resolve and upload `app`'s icon as a GL_RGBA texture (host EGL context
   must be current).  Best-effort: on any failure the app keeps no icon and
   the overlay draws the placeholder instead. */
static void overlay_icon_load(struct tabbed_app *app) {
    app->icon_resolved = true;
    const char *app_id = app->toplevel ? app->toplevel->app_id : NULL;
    if (!app_id || !app_id[0])
        return;

    char *icon = desktop_icon_name(app_id);
    char *path = overlay_find_icon_file(icon ? icon : app_id);
    free(icon);
    if (!path)
        return;

    int w = 0, h = 0;
    unsigned char *rgba = NULL;
    if (overlay_endswith(path, ".svg"))
        rgba = overlay_load_svg(path, &w, &h);
    else if (overlay_endswith(path, ".png"))
        rgba = overlay_load_png(path, &w, &h);
    free(path);
    if (!rgba || w <= 0 || h <= 0) {
        free(rgba);
        return;
    }

    if (server.standalone) {
        /* No host GL context: hand the icon to the wlroots renderer as a
           premultiplied ARGB texture (B,G,R,A byte order). */
        unsigned char *pre = malloc((size_t)w * h * 4);
        if (pre) {
            for (int i = 0; i < w * h; i++) {
                unsigned char a = rgba[i * 4 + 3];
                if (a == 0) {
                    pre[i * 4 + 0] = 0;
                    pre[i * 4 + 1] = 0;
                    pre[i * 4 + 2] = 0;
                    pre[i * 4 + 3] = 0;
                } else {
                    pre[i * 4 + 0] = (unsigned char)(rgba[i * 4 + 2] * a / 255);
                    pre[i * 4 + 1] = (unsigned char)(rgba[i * 4 + 1] * a / 255);
                    pre[i * 4 + 2] = (unsigned char)(rgba[i * 4 + 0] * a / 255);
                    pre[i * 4 + 3] = a;
                }
            }
            app->icon_wlr = wlr_texture_from_pixels(server.renderer,
                DRM_FORMAT_ARGB8888, (uint32_t)w * 4, (uint32_t)w,
                (uint32_t)h, pre);
            free(pre);
        }
        free(rgba);
        app->icon_w = w;
        app->icon_h = h;
        if (app->icon_wlr)
            tabbed_log(TABBED_LOG_INFO, "[overlay] icon %s %dx%d\n", app_id, w, h);
        return;
    }

    GLuint tex;
    glGenTextures(1, &tex);
    glBindTexture(GL_TEXTURE_2D, tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, w, h, 0,
                 GL_RGBA, GL_UNSIGNED_BYTE, rgba);
    glBindTexture(GL_TEXTURE_2D, 0);
    free(rgba);
    app->icon_tex = tex;
    app->icon_w = w;
    app->icon_h = h;
    tabbed_log(TABBED_LOG_INFO, "[overlay] icon %s %dx%d\n", app_id, w, h);
}

static void draw_rect(int x, int y, int w, int h,
                      float r, float g, float b, float a)
{
    if (w <= 0 || h <= 0) return;
    GLfloat color[4] = { r, g, b, a };
    draw_texture_rect(host.overlay_white_tex, 1, 1,
                      0, 0, 1, 1, x, y, w, h, host.width, host.height, color);
}

/* Draw `s` at (x, y) (window coords, y is the row top) tinted by `color`.
   Non-ASCII characters are skipped with a narrow advance. */
static void draw_text(const char *s, int x, int y,
                      float r, float g, float b, float a)
{
    if (!overlay_font_ok) return;
    GLfloat color[4] = { r, g, b, a };
    int pen = x;
    for (const unsigned char *p = (const unsigned char *)s; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) {
            pen += 4;
            continue;
        }
        struct overlay_glyph *glyph = &host.overlay_glyphs[c - 32];
        draw_texture_rect(host.overlay_atlas_tex, host.overlay_atlas_w,
                          host.overlay_atlas_h,
                          glyph->ax, glyph->ay, glyph->pw, glyph->ph,
                          pen, y + glyph->top, glyph->pw, glyph->ph,
                          host.width, host.height, color);
        pen += glyph->adv;
    }
}

static int overlay_text_width(const char *s) {
    if (!overlay_font_ok) return 0;
    int w = 0;
    for (const unsigned char *p = (const unsigned char *)s; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) {
            w += 4;
            continue;
        }
        w += host.overlay_glyphs[c - 32].adv;
    }
    return w;
}

/* Copy `src` into `out`, truncated so that its on-screen width plus a
   trailing "..." fits within `max_px` when the title does not already fit
   whole.  Uses the same advance rules as overlay_text_width().  A title that
   fits within `max_px` is copied verbatim, so a row sized to a title's natural
   width never grows a needless ellipsis (e.g. "foot" staying "foot" instead of
   shrinking to "fo...").  Falls back to an empty string when not even one dot
   fits. */
static void fit_text(const char *src, int max_px, char *out, int out_sz)
{
    out[0] = '\0';
    if (!src || out_sz <= 1) return;

    if (overlay_text_width(src) <= max_px) {
        size_t n = 0;
        for (const unsigned char *p = (const unsigned char *)src; *p; p++) {
            if (n + 1 >= (size_t)out_sz)
                break;
            out[n++] = (char)*p;
        }
        out[n] = '\0';
        return;
    }

    const char *dots = "...";
    int dot_w = 0;
    for (const unsigned char *p = (const unsigned char *)dots; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) { dot_w += 4; continue; }
        dot_w += host.overlay_glyphs[c - 32].adv;
    }
    if (max_px < dot_w) return;

    tabbed_log(TABBED_LOG_DEBUG, "[overlay] ellipsis: '%s' budget=%d\n",
               src, max_px);
    int w = 0;
    size_t n = 0;
    const unsigned char *p;
    for (p = (const unsigned char *)src; *p; p++) {
        int c = *p;
        int adv = (c < 32 || c > 126) ? 4 : host.overlay_glyphs[c - 32].adv;
        if (w + adv + dot_w > max_px)
            break;
        if (n + 1 >= (size_t)out_sz)
            break;
        out[n++] = (char)c;
        w += adv;
    }
    if (*p) {
        if (n + 4 < (size_t)out_sz) {
            memcpy(out + n, dots, 3);
            n += 3;
        }
    }
    out[n] = '\0';
}

/* Row title for an overlay slot: the mapped toplevel's title, or the
   command line for a still-black (pending) tab. */
static const char *app_row_title(struct tabbed_app *app) {
    if (app->toplevel && app->toplevel->title && app->toplevel->title[0])
        return app->toplevel->title;
    if (app && app->cmd && app->cmd[0])
        return app->cmd;
    return NULL;
}

/* A row in the overlay (both the host-GL and the standalone wlr paths):
   skip slots that are dead or mid-close; black pending tabs are rows too. */
static bool app_overlay_row(struct tabbed_app *app) {
    return app_live(app) && !app->closing;
}

static void draw_tab_overlay(void) {
    if (!host.overlay_visible || server.num_apps < 1) return;

    int margin = 8, boxpad = 6;
    int icon_sz = OVERLAY_ICON_SZ, icon_gap = 8;
    int row_h = host.overlay_font_h > 0 ? host.overlay_font_h + 8 : 18;
    if (row_h < icon_sz + 4) row_h = icon_sz + 4;
    int max_row_w = 0, n_rows = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app_overlay_row(app)) continue;
        if (!app->icon_resolved)
            overlay_icon_load(app);
        const char *title = app_row_title(app);
        char fallback[16];
        if (!title) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int w = icon_sz + icon_gap + overlay_text_width(title);
        if (w > max_row_w) max_row_w = w;
        n_rows++;
    }
    if (n_rows == 0) return;

    int avail_w = host.width - 2 * margin - 2 * boxpad;
    if (max_row_w > avail_w) max_row_w = avail_w;

    int box_w = max_row_w + 2 * boxpad;
    int box_h = n_rows * row_h + 2 * boxpad;
    if (box_w > host.width - 2 * margin) box_w = host.width - 2 * margin;
    if (box_h > host.height - 2 * margin) box_h = host.height - 2 * margin;
    int box_x = (host.width - box_w) / 2;
    int box_y = (host.height - box_h) / 2;

    int bw = 1;
    draw_rect(box_x, box_y, box_w, box_h, 0.45f, 0.45f, 0.48f, 1.0f);
    draw_rect(box_x + bw, box_y + bw, box_w - 2 * bw, box_h - 2 * bw,
              0.07f, 0.07f, 0.09f, 1.0f);

    int row = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app_overlay_row(app)) continue;
        const char *title = app_row_title(app);
        char fallback[16];
        if (!title) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int ry = box_y + boxpad + row * row_h;
        bool active = app == server.active_app;
        char row_text[512];
        int budget = max_row_w - icon_sz - icon_gap;
        if (budget < 0) budget = 0;
        fit_text(title, budget, row_text, sizeof(row_text));
        int text_w = overlay_text_width(row_text);
        if (active) {
            int hw = icon_sz + icon_gap + text_w + 4;
            int max_hw = box_w - 2 * boxpad + 4;
            if (hw > max_hw) hw = max_hw;
            draw_rect(box_x + boxpad - 2, ry - 1, hw, row_h,
                      0.24f, 0.36f, 0.60f, 0.9f);
        }
        int ix = box_x + boxpad;
        int iy = ry + (row_h - icon_sz) / 2;
        if (app->icon_tex) {
            GLfloat tint[4] = { active ? 1.0f : 0.72f,
                                active ? 1.0f : 0.72f,
                                active ? 1.0f : 0.72f, 1.0f };
            draw_texture_rect(app->icon_tex, app->icon_w, app->icon_h,
                              0, 0, app->icon_w, app->icon_h,
                              ix, iy, icon_sz, icon_sz,
                              host.width, host.height, tint);
        } else {
            /* Generic placeholder for no icon or a still-black tab. */
            draw_rect(ix, iy, icon_sz, icon_sz, 0.45f, 0.45f, 0.48f, 0.85f);
            draw_rect(ix + 3, iy + 3, icon_sz - 6, icon_sz - 6,
                      0.07f, 0.07f, 0.09f, 1.0f);
        }
        draw_text(row_text, ix + icon_sz + icon_gap,
                  ry + (row_h - host.overlay_font_h) / 2,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.9f);
        row++;
    }
}

/* ---------- Standalone overlay rendering (wlr render pass) ----------
   The standalone output paints via the wlroots GLES2 renderer, so the overlay
   is drawn as a second pass on the same buffer directly with wlr textures.
   Mirrors the layout computed by draw_tab_overlay() for the host-GL path. */

static struct wlr_render_color overlay_premul(float r, float g, float b, float a) {
    return (struct wlr_render_color){ r * a, g * a, b * a, a };
}

static void overlay_pass_rect(struct wlr_render_pass *pass,
                              int x, int y, int w, int h,
                              float r, float g, float b, float a)
{
    if (w <= 0 || h <= 0) return;
    struct wlr_render_rect_options o = {
        .box = { .x = x, .y = y, .width = w, .height = h },
        .color = overlay_premul(r, g, b, a),
    };
    wlr_render_pass_add_rect(pass, &o);
}

static void overlay_pass_text(struct wlr_render_pass *pass, const char *s,
                              int x, int y, float alpha)
{
    if (!overlay_font_ok || !server.overlay_atlas_wlr) return;
    int pen = x;
    for (const unsigned char *p = (const unsigned char *)s; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) {
            pen += 4;
            continue;
        }
        struct overlay_glyph *glyph = &host.overlay_glyphs[c - 32];
        struct wlr_render_texture_options o = {
            .texture = server.overlay_atlas_wlr,
            .src_box = { .x = glyph->ax, .y = glyph->ay,
                         .width = glyph->pw, .height = glyph->ph },
            .dst_box = { .x = pen, .y = y + glyph->top,
                         .width = glyph->pw, .height = glyph->ph },
            .alpha = &alpha,
            .filter_mode = WLR_SCALE_FILTER_BILINEAR,
            .blend_mode = WLR_RENDER_BLEND_MODE_PREMULTIPLIED,
        };
        wlr_render_pass_add_texture(pass, &o);
        pen += glyph->adv;
    }
}

static void overlay_pass_icon(struct wlr_render_pass *pass,
                              struct tabbed_app *app,
                              int ix, int iy, int size, float alpha)
{
    if (!app || !app->icon_wlr) return;
    struct wlr_render_texture_options o = {
        .texture = app->icon_wlr,
        .dst_box = { .x = ix, .y = iy, .width = size, .height = size },
        .alpha = &alpha,
        .filter_mode = WLR_SCALE_FILTER_BILINEAR,
        .blend_mode = WLR_RENDER_BLEND_MODE_PREMULTIPLIED,
    };
    wlr_render_pass_add_texture(pass, &o);
}

static void draw_tab_overlay_pass(struct wlr_render_pass *pass) {
    if (!host.overlay_visible || server.num_apps < 1) return;

    int margin = 8, boxpad = 6;
    int icon_sz = OVERLAY_ICON_SZ, icon_gap = 8;
    int row_h = host.overlay_font_h > 0 ? host.overlay_font_h + 8 : 18;
    if (row_h < icon_sz + 4) row_h = icon_sz + 4;
    int max_row_w = 0, n_rows = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app_overlay_row(app)) continue;
        if (!app->icon_resolved)
            overlay_icon_load(app);
        const char *title = app_row_title(app);
        char fallback[16];
        if (!title) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int w0 = icon_sz + icon_gap + overlay_text_width(title);
        if (w0 > max_row_w) max_row_w = w0;
        n_rows++;
    }
    if (n_rows == 0) return;

    int avail_w = host.width - 2 * margin - 2 * boxpad;
    if (max_row_w > avail_w) max_row_w = avail_w;

    int box_w = max_row_w + 2 * boxpad;
    int box_h = n_rows * row_h + 2 * boxpad;
    if (box_w > host.width - 2 * margin) box_w = host.width - 2 * margin;
    if (box_h > host.height - 2 * margin) box_h = host.height - 2 * margin;
    int box_x = (host.width - box_w) / 2;
    int box_y = (host.height - box_h) / 2;

    int bw = 1;
    overlay_pass_rect(pass, box_x, box_y, box_w, box_h, 0.45f, 0.45f, 0.48f, 1.0f);
    overlay_pass_rect(pass, box_x + bw, box_y + bw, box_w - 2 * bw,
                      box_h - 2 * bw, 0.07f, 0.07f, 0.09f, 1.0f);

    int row = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app_overlay_row(app)) continue;
        const char *title = app_row_title(app);
        char fallback[16];
        if (!title) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int ry = box_y + boxpad + row * row_h;
        bool active = app == server.active_app;
        char row_text[512];
        int budget = max_row_w - icon_sz - icon_gap;
        if (budget < 0) budget = 0;
        fit_text(title, budget, row_text, sizeof(row_text));
        int text_w = overlay_text_width(row_text);
        if (active) {
            int hw = icon_sz + icon_gap + text_w + 4;
            int max_hw = box_w - 2 * boxpad + 4;
            if (hw > max_hw) hw = max_hw;
            overlay_pass_rect(pass, box_x + boxpad - 2, ry - 1, hw, row_h,
                              0.24f, 0.36f, 0.60f, 0.9f);
        }
        int ix = box_x + boxpad;
        int iy = ry + (row_h - icon_sz) / 2;
        if (app->icon_wlr) {
            overlay_pass_icon(pass, app, ix, iy, icon_sz,
                              active ? 1.0f : 0.72f);
        } else {
            overlay_pass_rect(pass, ix, iy, icon_sz, icon_sz,
                              0.45f, 0.45f, 0.48f, 0.85f);
            overlay_pass_rect(pass, ix + 3, iy + 3, icon_sz - 6, icon_sz - 6,
                              0.07f, 0.07f, 0.09f, 1.0f);
        }
        overlay_pass_text(pass, row_text, ix + icon_sz + icon_gap,
                          ry + (row_h - host.overlay_font_h) / 2,
                          active ? 1.0f : 0.648f);
        row++;
    }
}


/* ===================== Server-side wlroots setup ===================== */

static void swapchain_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    static uint64_t mods[] = { DRM_FORMAT_MOD_LINEAR };
    struct wlr_drm_format fmt = {
        .format = DRM_FORMAT_ARGB8888,
        .len = 1,
        .capacity = 1,
        .modifiers = mods,
    };
    if (server.swapchain) {
        wlr_swapchain_destroy(server.swapchain);
        server.swapchain = NULL;
    }
    server.swapchain = wlr_swapchain_create(server.allocator, width, height, &fmt);
    if (!server.swapchain)
        fprintf(stderr, "tabbed-wlroots: swapchain create failed at %dx%d\n",
                width, height);
}

static void output_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    if (!server.output || !server.allocator) return;

    struct wlr_output_state state;
    wlr_output_state_init(&state);
    wlr_output_state_set_enabled(&state, true);
    wlr_output_state_set_custom_mode(&state, width, height, 0);
    wlr_output_commit_state(server.output, &state);
    wlr_output_state_finish(&state);

    swapchain_resize(width, height);

    if (server.bg_rect)
        wlr_scene_rect_set_size(server.bg_rect, width, height);

    /* Keep every mapped client at the current maximized size so switching
       tabs is instant and no tab is left small after a host resize.  While
       fullscreen the fullscreen configure already sizes clients to the
       output, so skip the maximize request to avoid state churn. */
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel) continue;
        if (!server.clients_fullscreen)
            wlr_xdg_toplevel_set_maximized(app->toplevel, true);
        wlr_xdg_toplevel_set_size(app->toplevel, width, height);
    }

    needs_redraw = true;
}

static void handle_output_frame(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
    frame_pending = true;
}

/* How many standalone outputs have been seen since the last (re)connect.
   DRM destroys and re-creates the output when the session loses/regains its
   VT, so this is reset to keep accepting the re-added connector. */
static int standalone_output_count;

/* DRM destroys the output when the session (VT) is lost.  Clear our
   references so nothing touches freed memory, detach the frame listener
   (wlr_output_finish asserts it's empty), and let the connector re-added on
   resume be accepted again. */
static void handle_output_destroy(struct wl_listener *listener, void *data) {
    (void)listener;
    (void)data;
    wl_list_remove(&server.output_destroy.link);
    wl_list_remove(&server.frame.link);
    server.output = NULL;
    server.scene_output = NULL; /* wlroots frees it via its output addon */
    if (server.swapchain) {
        wlr_swapchain_destroy(server.swapchain);
        server.swapchain = NULL;
    }
    standalone_output_count = 0;
    frame_pending = false;
    needs_redraw = false;
}

static void handle_new_output(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_output *output = data;

    /* Standalone (multi-monitor allowed at the wlroots layer): drive only
       the first output with the tabbed canvas, like the headless nested
       single output.  Later outputs are left disabled. */
    if (server.standalone && standalone_output_count++ > 0) {
        tabbed_log(TABBED_LOG_INFO,
                "standalone: extra output ignored (first output only)\n");
        return;
    }

    if (!wlr_output_init_render(output, server.allocator, server.renderer)) {
        fprintf(stderr, "tabbed-wlroots: output init_render failed\n");
        return;
    }
    wlr_output_create_global(output, server.wl_display);

server.output = output;
    server.scene_output = wlr_scene_output_create(server.scene, output);
    wlr_scene_output_set_position(server.scene_output, 0, 0);

    /* Always render the pointer into our own frame buffer (software cursor)
       instead of a hardware cursor plane: the headless backend's set_cursor
       hook makes wlroots believe it has a plane (so the scene software pass
       is skipped) while actually drawing nothing, and a hardware plane would
       float the cursor outside the buffer we composite/dump. */
    if (server.standalone)
        wlr_output_lock_software_cursors(output, true);

    /* Give the standalone cursor a place to live.  Idempotent across VT
       round-trips (wlr_output_layout_add reuses the existing entry), and the
       cursor attaches its output cursor via the layout's add signal. */
    if (server.cursor)
        wlr_output_layout_add(server.output_layout, output, 0, 0);

    /* Render whenever the output is ready for a frame (refresh-rate driven),
       like tinywl; this is what drives client frame callbacks / surface
       enter events even before any damage has accumulated. */
    server.frame.notify = handle_output_frame;
    wl_signal_add(&output->events.frame, &server.frame);
    server.output_destroy.notify = handle_output_destroy;
    wl_signal_add(&output->events.destroy, &server.output_destroy);

    /* Enable the output up front so buffer commits succeed even before the
       host window has been configured.  A native output drives at its
       preferred mode; everything else keeps the fixed headless size. */
    int w = output->width > 0 ? output->width : host.width;
    int h = output->height > 0 ? output->height : host.height;
    struct wlr_output_state state;
    wlr_output_state_init(&state);
    wlr_output_state_set_enabled(&state, true);
    struct wlr_output_mode *mode = NULL;
    if (server.standalone && !server.standalone_headless) {
        if (mode_req_w > 0) {
            /* --screen-mode WxH[@Hz]: pick an exact-resolution mode, highest
               refresh when none was requested.  A request the output can't
               satisfy is a startup error: print every reported mode and exit
               (before any client launches or the socket is advertised). */
            struct wlr_output_mode *m;
            int best_refresh = 0;
            wl_list_for_each(m, &output->modes, link) {
                if (m->width != mode_req_w || m->height != mode_req_h)
                    continue;
                if (mode_req_refresh > 0) {
                    if (m->refresh == mode_req_refresh) {
                        mode = m;
                        break;
                    }
                    continue;
                }
                if (m->refresh > best_refresh) {
                    best_refresh = m->refresh;
                    mode = m;
                }
            }
            if (!mode) {
                fprintf(stderr, "tabbed-wlroots: no %dx%d",
                        mode_req_w, mode_req_h);
                if (mode_req_refresh > 0)
                    fprintf(stderr, "@%u.%03u", mode_req_refresh / 1000,
                            mode_req_refresh % 1000);
                if (wl_list_empty(&output->modes))
                    fprintf(stderr, " mode; output reports no modes\n");
                else
                    fprintf(stderr, " mode; available:\n");
                wl_list_for_each(m, &output->modes, link) {
                    fprintf(stderr, "    %dx%d@%u.%03u%s%s\n",
                            m->width, m->height, m->refresh / 1000,
                            m->refresh % 1000,
                            m->preferred ? " (preferred)" : "",
                            (m->width == mode_req_w && m->height == mode_req_h)
                                ? " (requested size)" : "");
                }
                exit(1);
            }
        } else {
            mode = wlr_output_preferred_mode(output);
        }
    }
    if (mode) {
        w = mode->width;
        h = mode->height;
        wlr_output_state_set_mode(&state, mode);
    } else {
        wlr_output_state_set_custom_mode(&state, w, h, 0);
    }
    wlr_output_commit_state(output, &state);
    wlr_output_state_finish(&state);

    /* Overlay geometry and the swapchain are sized to the visible canvas;
       in standalone there is no host window, so use the output size itself. */
    if (server.standalone) {
        host.width = w;
        host.height = h;
    }
    swapchain_resize(w, h);

    /* An opaque full-output background node gives the scene a deterministic
       backdrop so the nested frame is never transparent. (Direct scanout is
       disabled separately above; a rect alone cannot prevent it because
       wlroots culls a rect that a covering client surface occludes, leaving
       a single render-list entry which is exactly what triggers scanout.)
       On a re-connected output (VT round-trip) the node already exists; just
       resize it. */
    if (server.bg_rect) {
        wlr_scene_rect_set_size(server.bg_rect, w, h);
    } else {
        server.bg_rect = wlr_scene_rect_create(&server.scene->tree, w, h,
                                               (float[]){ 0.0f, 0.0f, 0.0f, 1.0f });
        if (server.bg_rect)
            wlr_scene_node_lower_to_bottom(&server.bg_rect->node);
    }

/* Standalone-only damage sentinel for the overlay; see
       standalone_overlay_damage().  A fully transparent rect, sized to the
       output and left enabled (it renders nothing).  It sits at the bottom of
       the z-order and is transiently raised inside standalone_overlay_damage()
       to re-populate its visible region and force whole-output damage. */
    if (server.overlay_damage_rect) {
        wlr_scene_rect_set_size(server.overlay_damage_rect, w, h);
    } else if (server.standalone) {
        server.overlay_damage_rect = wlr_scene_rect_create(
            &server.scene->tree, w, h, (float[]){ 0.0f, 0.0f, 0.0f, 0.0f });
    }
}

/* Nearest live slot, scanning right first (prefer_right) or left first.
   The scan stops at the array ends -- it never wraps -- so the reflow after
   a slot is removed matches the old first/last-tab behavior.  NULL when
   `app` is the only live slot. */
static struct tabbed_app *pick_successor(struct tabbed_app *app,
                                         int prefer_right) {
    if (!app) return NULL;
    int died = app_index(app);
    if (prefer_right) {
        for (int i = died + 1; i < server.num_apps; i++)
            if (app_live(server.apps[i]) && !server.apps[i]->closing)
                return server.apps[i];
        for (int i = died - 1; i >= 0; i--)
            if (app_live(server.apps[i]) && !server.apps[i]->closing)
                return server.apps[i];
    } else {
        for (int i = died - 1; i >= 0; i--)
            if (app_live(server.apps[i]) && !server.apps[i]->closing)
                return server.apps[i];
        for (int i = died + 1; i < server.num_apps; i++)
            if (app_live(server.apps[i]) && !server.apps[i]->closing)
                return server.apps[i];
    }
    return NULL;
}

/* Drop slot `idx` outright: free the tab's allocations, sever any other
   slot's parent_app reference to it, and compact server.apps[] so a closed
   tab leaves no hole that a later client could stumble into.  The caller
   must already have handed the active crown elsewhere; remove_app only
   defends active_app against a slot that was somehow still on it. */
static void remove_app(int idx) {
    if (idx < 0 || idx >= server.num_apps) return;
    struct tabbed_app *dead = server.apps[idx];
    if (server.active_app == dead)
        server.active_app = NULL;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i]->parent_app == dead)
            server.apps[i]->parent_app = NULL;
    if (dead->close_timer) {
        wl_event_source_remove(dead->close_timer);
        dead->close_timer = NULL;
    }
    if (host.egl_ok && dead->icon_tex) {
        glDeleteTextures(1, &dead->icon_tex);
        dead->icon_tex = 0;
    }
    if (dead->icon_wlr) {
        wlr_texture_destroy(dead->icon_wlr);
        dead->icon_wlr = NULL;
    }
    free(dead->cmd);
    free(dead);
    memmove(&server.apps[idx], &server.apps[idx + 1],
            (size_t)(server.num_apps - idx - 1) * sizeof(*server.apps));
    server.num_apps--;
}

static void handle_toplevel_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, destroy);
    app->toplevel = NULL;
    app->tree = NULL;

    /* The overlay's row for this tab disappears the moment the toplevel does,
       shrinking the box mid-menu.  The overlay is drawn into the scene-output
       buffer outside the scene graph, so its damage trackers never learn about
       the old pixels; without whole-output damage the vacated ring of the
       larger box stays baked into the reused swapchain buffer. */
    if (host.overlay_visible && server.standalone)
        standalone_overlay_damage();
    if (app->icon_tex) {
        glDeleteTextures(1, &app->icon_tex);
        app->icon_tex = 0;
    }

    /* wlroots emits destroy with data=NULL and asserts every toplevel
       event listener list is empty afterwards; remove all listeners we
       attached to satisfy that and avoid use-after-free. */
    wl_list_remove(&app->destroy.link);
    wl_list_remove(&app->map.link);
    wl_list_remove(&app->commit.link);
    wl_list_remove(&app->request_maximize.link);
    wl_list_remove(&app->request_fullscreen.link);
    wl_list_remove(&app->request_minimize.link);
    wl_list_remove(&app->request_move.link);
    wl_list_remove(&app->request_resize.link);

    /* A pending Alt+Delete escalation must not fire against this slot once
       the toplevel is gone; drop the timer and the closing latch. */
    app->closing = false;
    if (app->close_timer) {
        wl_event_source_remove(app->close_timer);
        app->close_timer = NULL;
    }

    if (server.active_app == app) {
        server.active_app = NULL;
        /* Prefer the neighbor to the left (index died-1); if this is the
           first tab, fall through to the right-side neighbor so the tab
           that was second becomes the new leftmost. */
        struct tabbed_app *succ = pick_successor(app, -1);
        if (succ) {
            set_active_app(succ);
        } else {
            /* last tab closed: close the host window (nested only) and exit */
            if (host.toplevel) xdg_toplevel_destroy(host.toplevel);
            if (host.surface) wl_surface_destroy(host.surface);
            shutdown_cleanup();
            exit(0);
        }
    }
    /* The slot itself is removed outright: closed tabs leave no hole. */
    remove_app(app_index(app));
}

/* Grace period after the Alt+Delete SIGTERM before SIGKILL escalation. */
#define TABBED_CLOSE_ESCALATE_MS 150

/* Escalate an Alt+Delete close to SIGKILL if the client ignored the SIGTERM
   and its toplevel is still up.  Live slots are removed at toplevel destroy
   (which also cancels this timer), so for a mapped tab the callback never
   fires against a reaped or reused pid.  For a black tab there is no
   toplevel whose destroy would reap the slot, so its removal happens here,
   right after the SIGKILL. */
static int close_tab_escalate(void *data) {
    struct tabbed_app *app = data;
    if (app->closing && app_killable(app))
        kill_app(app, SIGKILL);
    if (app->close_timer) {
        wl_event_source_remove(app->close_timer);
        app->close_timer = NULL;
    }
    if (app->closing && !app->toplevel)
        remove_app(app_index(app));
    return 0;
}

/* Alt+Delete close of the active tab.  The tab vanishes immediately: the
   active crown moves to the right neighbor (or the left neighbor if the
   closed tab was the rightmost) in this same call.  The client's whole
   process group gets SIGTERM, then SIGKILL after a short grace if it ignores
   the TERM (see close_tab_escalate).  A closing black tab (still pending)
   drops out of the overlay and cycle right away and is removed by the
   escalation; a closing last tab tears the session down here, since nothing
   else will. */
static void close_active_tab(void) {
    struct tabbed_app *app = server.active_app;
    if (!app || !app_killable(app)) return;
    pid_t g = app_signal_group(app);
    pid_t shown = (g > 0 && g != getpgid(0)) ? g : app->client_pid;

    app->closing = true;
    int died = app_index(app);

    /* A black tab never fires a toplevel destroy, so drop it from the
       overlay/cycle immediately; only the escalation timer and the
       success-removal paths touch it afterwards. */
    if (!app->toplevel)
        app->pending_claim = false;

    struct tabbed_app *succ = pick_successor(app, +1);
    if (succ) {
        set_active_app(succ);
    } else {
        /* Last live tab: tear the session down now. */
        tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: closing tab %d (pid %d)\n",
                   died, (int)shown);
        if (host.toplevel) xdg_toplevel_destroy(host.toplevel);
        if (host.surface) wl_surface_destroy(host.surface);
        shutdown_cleanup();
        exit(0);
    }

    kill_app(app, SIGTERM);
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: closing tab %d (pid %d)\n",
               died, (int)shown);
    app->close_timer = wl_event_loop_add_timer(server.loop, close_tab_escalate,
                                               app);
    if (app->close_timer)
        wl_event_source_timer_update(app->close_timer, TABBED_CLOSE_ESCALATE_MS);
}

static void handle_request_maximize(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, request_maximize);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (toplevel->base->initialized)
        wlr_xdg_toplevel_set_maximized(toplevel, true);
}

static void handle_request_fullscreen(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, request_fullscreen);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (!toplevel->base->initialized) return;
    /* wlroots 0.19 emits request_fullscreen with NULL data; the direction
       lives in toplevel->requested.fullscreen.  Honor the client's request
       and mirror it onto the host window: a fullscreen client fills the
       host window, and an un-fullscreen client puts it back. */
    bool fs = toplevel->requested.fullscreen;
    wlr_xdg_toplevel_set_fullscreen(toplevel, fs);
    tabbed_log(TABBED_LOG_INFO, "client fullscreen=%d\n", fs);
    if (host.toplevel) {
        if (fs)
            xdg_toplevel_set_fullscreen(host.toplevel, NULL);
        else
            xdg_toplevel_unset_fullscreen(host.toplevel);
    }
}

/* Propagate the host window's fullscreen state onto every client.  Called
   from host_xdg_toplevel_configure when that state actually changes. */
static void clients_set_fullscreen(bool fs) {
    server.clients_fullscreen = fs;
    tabbed_log(TABBED_LOG_INFO, "clients fullscreen=%d\n", fs);
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel || !app->toplevel->base->initialized) continue;
        wlr_xdg_toplevel_set_fullscreen(app->toplevel, fs);
        if (!fs) {
            wlr_xdg_toplevel_set_maximized(app->toplevel, true);
            wlr_xdg_toplevel_set_size(app->toplevel, server.output->width,
                                      server.output->height);
        }
    }
}

static void handle_request_minimize(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void handle_request_move(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void handle_request_resize(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void position_toplevel(struct tabbed_app *app) {
    if (!app || !app->tree) return;
    /* CSD clients (foot/kitty) reserve a titlebar gutter above their
       content, which we don't paint, so it shows as a dark bar and their
       content sits too low (bottom row/cursor cropped). Shift them up by
       that gutter so the dark bar is cropped instead of the terminal's
       bottom. Clients with no gutter (geometry.y >= 0, e.g. wltest) are
       left untouched. */
    struct wlr_box geom = app->toplevel->base->geometry;
    int y = -geom.y;
    if (geom.y < 0)
        y = 0;
    wlr_scene_node_set_position(&app->tree->node, -geom.x, y);
}

static void handle_toplevel_commit(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, commit);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (toplevel->base->initial_commit) {
        wlr_xdg_toplevel_set_maximized(toplevel, true);
        wlr_xdg_toplevel_set_size(toplevel, server.output->width,
                                  server.output->height);
        if (server.clients_fullscreen)
            wlr_xdg_toplevel_set_fullscreen(toplevel, true);
    }
    /* Geometry can settle after the first frames (kitty/foot report a
       negative y once they decide on their titlebar), so keep the scene
       position in sync with every commit instead of only at activation. */
    position_toplevel(app);

    /* [diag] What does this client commit, and is its scene node visible? */
    struct wlr_surface *s = toplevel->base->surface;
    struct wlr_buffer *cbuf = s ? s->current.buffer : NULL;
    struct wlr_dmabuf_attributes dma;
    static struct wlr_buffer *last_logged = NULL;
    if (cbuf && cbuf != last_logged) {
        last_logged = cbuf;
        bool is_dma = wlr_buffer_get_dmabuf(cbuf, &dma);
        bool node_on = app->tree ? app->tree->node.enabled : false;
        if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
            tabbed_log(TABBED_LOG_DEBUG, "[diag] commit app=%d geom=%dx%d+%d+%d "
                    "buf=%dx%d dma=%d%s node_enabled=%d active=%d\n",
                    app_index(app),
                    toplevel->base->geometry.width,
                    toplevel->base->geometry.height,
                    toplevel->base->geometry.x,
                    toplevel->base->geometry.y,
                    s->current.buffer_width,
                    s->current.buffer_height,
                    is_dma,
                    is_dma ? (dma.n_planes ? "" : " planes=0") : "",
                    node_on,
                    server.active_app == app);
            if (is_dma) {
                tabbed_log(TABBED_LOG_DEBUG, "[diag]   dmabuf planes=%d "
                        "format=0x%x mod=0x%llx\n",
                        dma.n_planes, dma.format,
                        (unsigned long long)dma.modifier);
            }
        }
        if (!is_dma) {
            /* shm buffer: flag for TABBED_AUTODUMP; at debug level also count
               non-black pixels and save the client's own buffer so we can tell
               "client painted nothing" from "we failed to import". */
            void *data;
            uint32_t fmt;
            size_t stride;
            if (wlr_buffer_begin_data_ptr_access(
                    cbuf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                    &data, &fmt, &stride)) {
                client_dumped = true;
                if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
                    int bw = cbuf->width, bh = cbuf->height;
                    unsigned long nonblack = 0, lum = 0;
                    unsigned char *p = data;
                    for (int yy = 0; yy < bh; yy++) {
                        unsigned char *row = p + (size_t)yy * stride;
                        for (int xx = 0; xx < bw; xx++) {
                            unsigned long v = row[xx*4+0] + row[xx*4+1]
                                            + row[xx*4+2];
                            lum += v;
                            if (v > 12) nonblack++;
                        }
                    }
                    tabbed_log(TABBED_LOG_DEBUG, "[diag]   shm fmt=0x%x "
                            "nonblack=%lu/%lu mean=%lu\n", fmt, nonblack,
                            (unsigned long)bw * bh,
                            lum / ((unsigned long)bw * bh + 1));
                    char cpath[64];
                    snprintf(cpath, sizeof(cpath), "/tmp/client_%d.ppm",
                             dump_seq);
                    FILE *cf = fopen(cpath, "wb");
                    if (cf) {
                        fprintf(cf, "P6\n%d %d\n255\n", bw, bh);
                        unsigned char *cp = data;
                        for (int yy = 0; yy < bh; yy++) {
                            unsigned char *crow = cp + (size_t)yy * stride;
                            for (int xx = 0; xx < bw; xx++) {
                                fputc(crow[xx*4+0], cf);
                                fputc(crow[xx*4+1], cf);
                                fputc(crow[xx*4+2], cf);
                            }
                        }
                        fclose(cf);
                        tabbed_log(TABBED_LOG_DEBUG, "[diag]   client buffer "
                                "-> %s\n", cpath);
                    }
                }
                wlr_buffer_end_data_ptr_access(cbuf);
            }
        }
    }
}

/* Insert `app` in the slot order immediately after `anchor`, shifting the
   slots after it right; append at the far right if anchor is NULL or no
   longer present. */
static void insert_app_after(struct tabbed_app *app, struct tabbed_app *anchor) {
    int at = server.num_apps;
    if (anchor)
        for (int i = 0; i < server.num_apps; i++)
            if (server.apps[i] == anchor) {
                at = i + 1;
                break;
            }
    if (at < server.num_apps)
        memmove(&server.apps[at + 1], &server.apps[at],
                (server.num_apps - at) * sizeof(*server.apps));
    server.apps[at] = app;
    server.num_apps++;
}

/* A new toplevel is a sub-window when its client was forked -- directly or
   transitively -- from an already-connected tab's client: the shell running
   inside a terminal tab forks gnome-calculator, so the calculator's pid chain
   runs back through the shell to the terminal client.  Exact pid equality (a
   client opening a second toplevel) is the depth-0 case.  Walk /proc/<pid>/stat
   ppid links, capped, to find the owning tab; NULL if the client is not
   descended from any tab. */
static struct tabbed_app *sub_window_owner(pid_t cpid) {
    if (cpid <= 1)
        return NULL;
    pid_t p = cpid;
    for (int depth = 0; depth < 8; depth++) {
        for (int i = 0; i < server.num_apps; i++)
            if (server.apps[i]->toplevel &&
                server.apps[i]->client_pid == p)
                return server.apps[i];
        char path[64];
        snprintf(path, sizeof(path), "/proc/%d/stat", (int)p);
        int fd = open(path, O_RDONLY | O_CLOEXEC);
        if (fd < 0)
            return NULL;
        char buf[4096];
        ssize_t n = read(fd, buf, sizeof(buf) - 1);
        close(fd);
        if (n <= 0)
            return NULL;
        buf[n] = '\0';
        char *last = strrchr(buf, ')');
        if (!last)
            return NULL;
        char state;
        pid_t ppid = -1;
        if (sscanf(last + 1, " %c %d", &state, &ppid) != 2 || ppid <= 1)
            return NULL;
        p = ppid;
    }
    return NULL;
}

static void handle_toplevel_map(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, map);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (tabbed_log_level() >= TABBED_LOG_DEBUG)
        tabbed_log(TABBED_LOG_DEBUG, "[diag] map app=%d\n", app_index(app));

    /* A new tab never steals focus on its own.  The exceptions: a
       Alt+Shift+T terminal (add_tab), a sub-window whose parent tab is the
       one currently shown, and the startup-selected last command-line tab
       when it finally maps (it has been the active, black tab all along,
       revealed the moment its first frame arrives).  Every other map stays
       hidden -- the overlay and cycling reach it, but it does not yank the
       active surface.  A slot's toplevel is set at claim time (before its
       map), so "is it already shown?" is whether the scene node is enabled,
       not whether active_toplevel() is set. */
    bool activate = false;
    if (app->origin == ORIGIN_ADD_TAB)
        activate = true;
    else if (app->origin == ORIGIN_SUB && app->parent_app &&
             app->parent_app->toplevel == active_toplevel())
        activate = true;
    else if (app == server.active_app && app->tree &&
             !app->tree->node.enabled)
        activate = true;

    /* A slot claimed while it was still black may have been drawn with a
       placeholder icon; once a real client maps it, re-resolve the icon so
       the overlay picks up its app_id. */
    app->icon_resolved = false;

    if (activate) {
        wlr_xdg_toplevel_set_activated(toplevel, true);
        set_active_surface(toplevel);
    }
}

static void handle_new_toplevel(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_xdg_toplevel *toplevel = data;

    pid_t cpid = -1;
    if (toplevel->base->client)
        wl_client_get_credentials(toplevel->base->client->client,
                                  &cpid, NULL, NULL);

    struct tabbed_app *app = NULL;
    /* A slot awaiting its toplevel -- an unclaimed command-line command or
       a fresh Alt+Shift+T terminal -- belongs to exactly ONE client: the one
       WE launched for it.  launch_client() runs each command in its own
       process group (setpgid(0,0)), so the connected client's group id
       equals the launcher pid app->pid, including through a shell wrapper
       (`sh -c "foot -e htop"`).  Matching by group -- not exact pid -- is
       what keeps a wrapped command on its own command-line slot.  A client
       from a group we never created (an external one) never matches, so it
       can't steal a still-loading tab's position. */
    pid_t pgid = cpid > 0 ? getpgid(cpid) : -1;
    for (int i = 0; i < server.num_apps && !app; i++) {
        struct tabbed_app *a = server.apps[i];
        if (a->toplevel || !a->pending_claim) continue;
        if (a->pid > 0 && a->pid == pgid)
            app = a;
    }
    /* A second toplevel from a client that already owns a tab is a sub-window
       of that tab: give it its own slot glued right after its parent (the
       protocol parent, else the owning tab), never touching a reserved
       pending slot.  Command-line commands are all forked at startup (see
       launch_all_cli); their clients match the pending loop above, and only
       then. */
    if (!app && cpid > 0) {
        struct tabbed_app *owner = sub_window_owner(cpid);
        if (owner) {
            if (apps_ensure_cap(server.num_apps + 1) != 0) return;
            struct tabbed_app *sub = calloc(1, sizeof(*sub));
            if (!sub) return;
            sub->pid = -1;
            sub->cmd = NULL;
            sub->origin = ORIGIN_SUB;
            sub->parent_app = owner;
            struct tabbed_app *pa = toplevel->parent
                ? app_for_toplevel(toplevel->parent) : NULL;
            insert_app_after(sub, pa ? pa : owner);
            app = sub;
        }
    }
    /* No pending slot matched (an external client, or one from a group we
       never created).  Closed tabs are removed outright, so there are no
       free holes to fall back into; this loop only catches a slot that is
       transiently without a toplevel and not reserved, so it usually falls
       through to the ORIGIN_EXTERNAL append below. */
    if (!app)
        for (int i = 0; i < server.num_apps; i++) {
            struct tabbed_app *a = server.apps[i];
            if (!a->toplevel && !a->pending_claim && !a->closing) {
                app = a;
                break;
            }
        }
    if (!app) {
        /* No slot for this toplevel (an external client with every slot
           taken).  Give it its own tab so it appears on top and stays
           reachable via tab cycling, right after the tab that created it
           (protocol parent, else the active tab); far right if unidentified. */
        if (apps_ensure_cap(server.num_apps + 1) != 0) return;
        struct tabbed_app *extra = calloc(1, sizeof(*extra));
        if (!extra) return;
        extra->pid = -1;
        extra->cmd = NULL;
        extra->origin = ORIGIN_EXTERNAL;
        struct tabbed_app *pa = toplevel->parent
            ? app_for_toplevel(toplevel->parent) : NULL;
        if (!pa)
            pa = app_for_toplevel(active_toplevel());
        insert_app_after(extra, pa);
        app = extra;
    }

    app->toplevel = toplevel;
    app->pending_claim = false;
    app->tree = wlr_scene_xdg_surface_create(&server.scene->tree,
                                             toplevel->base);
    /* hidden until it becomes the active tab */
    wlr_scene_node_set_enabled(&app->tree->node, false);

    /* [claim] ties the app slot to the *connected client's* PID, so tests
       can kill the tab that is actually active.  The slot was chosen above by
       the process-group match against a pending command (CLI or add_tab), by
       the sub-window/parent rule, or by the ORIGIN_EXTERNAL append. */
    /* The client that actually occupies this slot may be the command we
       forked, an add_tab() tab, or an external client.  Record its process
       group so a close signals the right one -- but only when that group is
       one WE own.  An externally started client (e.g. from the compositor's
       own terminal) shares our process group; adopting it would make
       close/shutdown group-signal the launcher's whole session.  Such
       clients are killed by pid. */
    app->client_pid = cpid;
    pid_t cpg = cpid > 0 ? getpgid(cpid) : -1;
    app->pgid = (cpg > 0 && cpg != getpgid(0)) ? cpg : -1;
    tabbed_log(TABBED_LOG_INFO, "[claim] app=%d pid=%d\n",
            app_index(app), (int)cpid);

    app->destroy.notify = handle_toplevel_destroy;
    wl_signal_add(&toplevel->events.destroy, &app->destroy);

    app->map.notify = handle_toplevel_map;
    wl_signal_add(&toplevel->base->surface->events.map, &app->map);

    app->commit.notify = handle_toplevel_commit;
    wl_signal_add(&toplevel->base->surface->events.commit, &app->commit);

    app->request_maximize.notify = handle_request_maximize;
    wl_signal_add(&toplevel->events.request_maximize, &app->request_maximize);
    app->request_fullscreen.notify = handle_request_fullscreen;
    wl_signal_add(&toplevel->events.request_fullscreen, &app->request_fullscreen);
    app->request_minimize.notify = handle_request_minimize;
    wl_signal_add(&toplevel->events.request_minimize, &app->request_minimize);
    app->request_move.notify = handle_request_move;
    wl_signal_add(&toplevel->events.request_move, &app->request_move);
    app->request_resize.notify = handle_request_resize;
    wl_signal_add(&toplevel->events.request_resize, &app->request_resize);
}

/* ===================== Tab management ===================== */

static struct tabbed_app *app_for_toplevel(struct wlr_xdg_toplevel *toplevel) {
    if (!toplevel) return NULL;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i]->toplevel == toplevel)
            return server.apps[i];
    return NULL;
}

static int app_index(struct tabbed_app *app) {
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i] == app)
            return i;
    return -1;
}

struct tabbed_popup {
    struct wlr_xdg_surface *xdg_surface;
    struct wlr_scene_tree *scene;
    struct wl_listener commit;
    struct wl_listener destroy;
    struct wl_listener reposition;
};

/* Enough of the host window for popups to be positioned within; open menus
   may exceed the toplevel but we keep them inside the visible area. */
static void popup_usable_box(struct wlr_box *box) {
    box->x = 0;
    box->y = 0;
    if (server.output) {
        box->width = server.output->width;
        box->height = server.output->height;
    } else {
        box->width = host.width;
        box->height = host.height;
    }
}

/* Popups (menus, tooltips) are regular wlr_scene_xdg_surface nodes under
   their parent's tree, so wlroots' scene renderer composites them into the
   output buffer like any other surface.  We only need to make sure the client
   gets its initial configure (unconstrain from the output box) and to place
   each popup under its parent's tree. */
static void popup_handle_commit(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, commit);
    struct wlr_xdg_surface *xdg_surface = tp->xdg_surface;
    /* The client cannot map/render the popup until it receives its initial
       configure, which wlroots only sends via wlr_xdg_popup_unconstrain_from
       (which also adjusts geometry within the usable area). initial_commit is
       true on the first commit; later commits are ignored. */
    if (xdg_surface->initial_commit && xdg_surface->popup) {
        struct wlr_box box;
        popup_usable_box(&box);
        wlr_xdg_popup_unconstrain_from_box(xdg_surface->popup, &box);
    }
}

static void popup_handle_reposition(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, reposition);
    if (tp->xdg_surface->popup) {
        struct wlr_box box;
        popup_usable_box(&box);
        wlr_xdg_popup_unconstrain_from_box(tp->xdg_surface->popup, &box);
    }
}

static void popup_handle_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, destroy);
    wl_list_remove(&tp->commit.link);
    wl_list_remove(&tp->destroy.link);
    wl_list_remove(&tp->reposition.link);
    free(tp);
}

static void create_popup(struct wlr_xdg_popup *popup,
                         struct wlr_scene_tree *parent_tree) {
    struct wlr_xdg_surface *xdg_surface = popup->base;
    struct tabbed_popup *tp = calloc(1, sizeof(*tp));
    if (!tp) return;
    tp->xdg_surface = xdg_surface;
    tp->scene = wlr_scene_xdg_surface_create(parent_tree, xdg_surface);
    /* wlr_scene_xdg_surface_create destroys the node when the surface is
       destroyed, so we only track positioning/reposition listeners here. */
    tp->commit.notify = popup_handle_commit;
    wl_signal_add(&xdg_surface->surface->events.commit, &tp->commit);
    tp->destroy.notify = popup_handle_destroy;
    /* Listen on the popup's own destroy: wlroots emits it (then asserts its
       event lists are empty) before the popup is freed. */
    wl_signal_add(&popup->events.destroy, &tp->destroy);
    tp->reposition.notify = popup_handle_reposition;
    wl_signal_add(&popup->events.reposition, &tp->reposition);
    /* remember the scene tree so a submenu popup can find its parent's tree */
    xdg_surface->data = tp;
}

static void handle_new_popup(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_xdg_popup *popup = data;

    /* Popups position themselves relative to their immediate parent surface,
       so place each popup under its parent's scene tree. */
    struct wlr_scene_tree *parent_tree = NULL;
    struct wlr_xdg_surface *parent =
        wlr_xdg_surface_try_from_wlr_surface(popup->parent);
    if (parent) {
        if (parent->role == WLR_XDG_SURFACE_ROLE_TOPLEVEL) {
            struct tabbed_app *app = app_for_toplevel(parent->toplevel);
            if (app) parent_tree = app->tree;
        } else if (parent->role == WLR_XDG_SURFACE_ROLE_POPUP) {
            struct tabbed_popup *tp = parent->data;
            if (tp) parent_tree = tp->scene;
        }
    }
    if (!parent_tree) return;
    create_popup(popup, parent_tree);
}

/* Make `app` the active slot.  A mapped slot shows its surface and takes
   keyboard focus; a pending (black) slot shows the backdrop and drops the
   seat focus until it maps.  The old active slot is hidden and deactivated.
   Called with the same app as already active only to promote it black ->
   mapped (the one case with something still to do), so callers that want a
   true no-op must guard first. */
static void set_active_app(struct tabbed_app *app) {
    if (!app) return;

    struct tabbed_app *old = server.active_app;
    if (old && old != app && old->toplevel) {
        if (old->tree)
            wlr_scene_node_set_enabled(&old->tree->node, false);
        wlr_xdg_toplevel_set_activated(old->toplevel, false);
    }
    server.active_app = app;

    if (app->toplevel) {
        wlr_xdg_toplevel_set_activated(app->toplevel, true);
        position_toplevel(app);
        if (app->tree)
            wlr_scene_node_set_enabled(&app->tree->node, true);
        if (tabbed_log_level() >= TABBED_LOG_DEBUG)
            tabbed_log(TABBED_LOG_DEBUG, "[diag] active app=%d surface=%dx%d "
                    "node on\n", app_index(app),
                    app->toplevel->base->surface->current.width,
                    app->toplevel->base->surface->current.height);
    } else if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        tabbed_log(TABBED_LOG_DEBUG, "[diag] active slot=%d (black, awaiting map)\n",
                app_index(app));
    }

    /* In standalone the seat keyboard is the emitting native device (set by
       the standalone handlers); fall back to the virtual keyboard otherwise
       so the nested/ctl path keeps using it.  A black active tab has no
       surface to enter, so clear the focus instead of leaving a stale one. */
    struct wlr_keyboard *kbd = wlr_seat_get_keyboard(server.seat);
    if (!kbd) kbd = &server.keyboard;
    if (app->toplevel)
        wlr_seat_keyboard_notify_enter(server.seat,
            app->toplevel->base->surface,
            kbd->keycodes, kbd->num_keycodes, &kbd->modifiers);
    else
        wlr_seat_keyboard_notify_clear_focus(server.seat);
    needs_redraw = true;
}

static void set_active_surface(struct wlr_xdg_toplevel *toplevel) {
    struct tabbed_app *app = app_for_toplevel(toplevel);
    if (!app) return;
    /* Promoting the already-active black tab to mapped is the one same-app
       call that must still run; everything else that's a true no-op returns
       here, so redundant activations emit no [diag] churn. */
    if (app == server.active_app && app->toplevel && app->tree &&
        app->tree->node.enabled)
        return;
    set_active_app(app);
}

static void cycle_tab(int dir) {
    if (server.num_apps == 0) return;
    int idx = -1;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i] == server.active_app) {
            idx = i;
            break;
        }
    for (int k = 1; k <= server.num_apps; k++) {
        int j = ((idx < 0 ? 0 : idx) + k * dir + server.num_apps) % server.num_apps;
        if (app_live(server.apps[j]) && !server.apps[j]->closing) {
            set_active_app(server.apps[j]);
            return;
        }
    }
}

/* Move the active tab one position up (dir>0: later in the list) or down
   (dir<0) within the overlay order, wrapping at the ends.  The active
   surface is unchanged; only its slot in server.apps[] moves, which the
   overlay and cycling both iterate.  Only live slots (mapped or pending
   black, mirroring cycle_tab) that aren't mid-close count as positions;
   with fewer than two of them there is nowhere to move. */
static void reorder_active_tab(int dir) {
    int n = 0;
    for (int i = 0; i < server.num_apps; i++)
        if (app_live(server.apps[i]) && !server.apps[i]->closing)
            n++;
    if (n < 2) return;
    int from = -1;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i] == server.active_app) {
            from = i;
            break;
        }
    if (from < 0) return;

    int neighbor = -1;
    if (dir > 0) {
        for (int i = from + 1; i < server.num_apps; i++)
            if (app_live(server.apps[i]) && !server.apps[i]->closing) {
                neighbor = i;
                break;
            }
        if (neighbor < 0)
            for (int i = 0; i < server.num_apps; i++)
                if (app_live(server.apps[i]) && !server.apps[i]->closing) {
                    neighbor = i;
                    break;
                }
    } else {
        for (int i = from - 1; i >= 0; i--)
            if (app_live(server.apps[i]) && !server.apps[i]->closing) {
                neighbor = i;
                break;
            }
        if (neighbor < 0)
            for (int i = server.num_apps - 1; i >= 0; i--)
                if (app_live(server.apps[i]) && !server.apps[i]->closing) {
                    neighbor = i;
                    break;
                }
    }
    if (neighbor < 0 || neighbor == from) return;

    /* Move the tab to `neighbor`'s slot and shift every slot between the two
       one position, so the middle of the list moves with it.  For adjacent
       tabs this is just a swap, but when `neighbor` wraps around to the far
       end (from is first/last of the live list) the other live tabs must all
       shuffle one place rather than staying put. */
    struct tabbed_app *moved = server.apps[from];
    if (neighbor < from) {
        memmove(&server.apps[neighbor + 1], &server.apps[neighbor],
                (size_t)(from - neighbor) * sizeof(*server.apps));
        server.apps[neighbor] = moved;
    } else {
        memmove(&server.apps[from], &server.apps[from + 1],
                (size_t)(neighbor - from) * sizeof(*server.apps));
        server.apps[neighbor] = moved;
    }

    tabbed_log(TABBED_LOG_INFO, "[reorder] app=%d dir=%d\n",
               neighbor, dir);
    needs_redraw = true;
    if (server.standalone)
        standalone_overlay_damage();
}

/* Fixed keybind repeat: first repeat after 600ms, then every 40ms (25Hz). */
#define TABBED_REPEAT_DELAY_MS 600
#define TABBED_REPEAT_INTERVAL_MS 40

static void kbd_repeat_cancel(void) {
    if (host.repeat_timer) {
        wl_event_source_remove(host.repeat_timer);
        host.repeat_timer = NULL;
    }
    host.repeat_key = 0;
}

static int kbd_repeat_cb(void *data) {
    (void)data;
    if (host.repeat_key == 0)
        return 0;
    if (host.repeat_kind == REPEAT_REORDER)
        reorder_active_tab(host.repeat_dir);
    else
        cycle_tab(host.repeat_dir);
    if (host.repeat_timer)
        wl_event_source_timer_update(host.repeat_timer,
                                     TABBED_REPEAT_INTERVAL_MS);
    return 0;
}

static void kbd_repeat_start(int key, int dir, int kind) {
    kbd_repeat_cancel();
    host.repeat_key = key;
    host.repeat_dir = dir;
    host.repeat_kind = kind;
    host.repeat_timer = wl_event_loop_add_timer(server.loop, kbd_repeat_cb, NULL);
    if (host.repeat_timer)
        wl_event_source_timer_update(host.repeat_timer, TABBED_REPEAT_DELAY_MS);
}

/* ===================== Clipboard bridge implementation ===================== */

static void bridge_mimes_reset(void) {
    for (size_t i = 0; i < bridge.mimes_len; i++)
        free(bridge.mimes[i]);
    bridge.mimes_len = 0;
}

static void bridge_mimes_append(const char *mime) {
    if (bridge.mimes_len == bridge.mimes_cap) {
        size_t ncap = bridge.mimes_cap ? bridge.mimes_cap * 2 : 8;
        char **nm = realloc(bridge.mimes, ncap * sizeof(*nm));
        if (!nm)
            return;
        bridge.mimes = nm;
        bridge.mimes_cap = ncap;
    }
    bridge.mimes[bridge.mimes_len++] = strdup(mime);
}

static void bridge_inner_src_destroy(struct wl_listener *l, void *data);
static bool bridge_prefetch_mime_compatible(const char *mime);
static void bridge_prefetch_serve(const char *mime, int32_t fd);

/* Compositor-side nested source: when a nested client pastes, wlroots calls
   our impl->send() and we pull the data from the host offer straight into the
   fd wlroots gave us (zero copy, no relay). */
static void bridge_inner_source_send(struct wlr_data_source *src,
                                     const char *mime, int32_t fd) {
    (void)src;
    if (bridge_prefetch_mime_compatible(mime)) {
        bridge_prefetch_serve(mime, fd);
        return;
    }
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_offer) {
        zwlr_data_control_offer_v1_receive(bridge.dc_offer, mime, fd);
        close(fd);
    } else if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE &&
               bridge.dd_offer) {
        wl_data_offer_receive(bridge.dd_offer, mime, fd);
        close(fd);
    } else {
        close(fd);
    }
}

static void bridge_inner_source_destroy(struct wlr_data_source *src) {
    free(src);
}

static const struct wlr_data_source_impl bridge_inner_source_impl = {
    .send = bridge_inner_source_send,
    .destroy = bridge_inner_source_destroy,
};

static void bridge_set_inner_src(struct wlr_data_source *src) {
    if (bridge.inner_src == src)
        return;
    if (bridge.inner_src) {
        wl_list_remove(&bridge.inner_src_destroy.link);
        bridge.inner_src = NULL;
    }
    bridge.inner_src = src;
    if (src) {
        bridge.inner_src_destroy.notify = bridge_inner_src_destroy;
        wl_signal_add(&src->events.destroy, &bridge.inner_src_destroy);
    }
}

static void bridge_inner_src_destroy(struct wl_listener *l, void *data) {
    (void)data;
    wl_list_remove(&l->link);
    bridge.inner_src = NULL;
}

/* Put a host selection into the nested seat.  The source stays valid for the
   whole lifetime of the host offer, so pastes can be served asynchronously. */
static void bridge_mirror_to_nested(void) {
    struct wlr_data_source *src = calloc(1, sizeof(*src));
    if (!src) {
        bridge_mimes_reset();
        return;
    }
    wlr_data_source_init(src, &bridge_inner_source_impl);
    for (size_t i = 0; i < bridge.mimes_len; i++) {
        char **p = wl_array_add(&src->mime_types, sizeof(char *));
        if (!p) {
            for (size_t j = i; j < bridge.mimes_len; j++)
                free(bridge.mimes[j]);
            bridge.mimes_len = 0;
            break;
        }
        *p = bridge.mimes[i];
        bridge.mimes[i] = NULL; /* ownership moves into the wl_array */
    }
    bridge.mimes_len = 0;
    bridge_set_inner_src(src);
    wlr_seat_set_selection(server.seat, src,
        wl_display_next_serial(server.wl_display));
}

static void bridge_clear_nested(void) {
    if (!server.seat->selection_source)
        return;
    bridge.ignore_next_inner = true;
    wlr_seat_set_selection(server.seat, NULL,
        wl_display_next_serial(server.wl_display));
}

/* ---------------- text prefetch: serve pastes from a buffered copy -------- */

#define TABBED_PREFETCH_MAX (16 * 1024 * 1024)

static void bridge_prefetch_cancel(void) {
    if (bridge.prefetch_src) {
        wl_event_source_remove(bridge.prefetch_src);
        bridge.prefetch_src = NULL;
    }
    if (bridge.prefetch_fd >= 0) {
        close(bridge.prefetch_fd);
        bridge.prefetch_fd = -1;
    }
    free(bridge.prefetch_buf);
    bridge.prefetch_buf = NULL;
    bridge.prefetch_len = bridge.prefetch_cap = 0;
    bridge.prefetch_mime[0] = '\0';
    bridge.prefetch_ready = false;
}

/* Drain the prefetch pipe into the buffer.  Returns true when the stream is
   finished (EOF/error) and the buffer should be kept as the paste payload. */
static bool bridge_prefetch_drain(int fd) {
    for (;;) {
        size_t room = bridge.prefetch_cap - bridge.prefetch_len;
        if (bridge.prefetch_len + 4096 > bridge.prefetch_cap &&
                bridge.prefetch_cap < TABBED_PREFETCH_MAX) {
            size_t ncap = bridge.prefetch_cap ? bridge.prefetch_cap * 2 : 8192;
            if (ncap > TABBED_PREFETCH_MAX)
                ncap = TABBED_PREFETCH_MAX;
            char *nb = realloc(bridge.prefetch_buf, ncap);
            if (nb) {
                bridge.prefetch_buf = nb;
                bridge.prefetch_cap = ncap;
                room = bridge.prefetch_cap - bridge.prefetch_len;
            }
        }
        if (room == 0) {
            /* cap reached: drain without storing to keep the writer unblocked */
            char tmp;
            ssize_t n = read(fd, &tmp, 1);
            if (n > 0)
                continue;
            if (n == 0)
                return true;
            if (errno == EINTR)
                continue;
            if (errno == EAGAIN)
                return false;
            return true;
        }
        ssize_t n = read(fd, bridge.prefetch_buf + bridge.prefetch_len, room);
        if (n > 0) {
            bridge.prefetch_len += (size_t)n;
            continue;
        }
        if (n == 0)
            return true; /* EOF */
        if (errno == EINTR)
            continue;
        if (errno == EAGAIN)
            return false; /* more data pending */
        return true;      /* read error: keep whatever we got */
    }
}

static int bridge_prefetch_cb(int fd, uint32_t mask, void *data) {
    (void)data; (void)mask;
    if (!bridge_prefetch_drain(fd))
        return 0;
    if (bridge.prefetch_src) {
        wl_event_source_remove(bridge.prefetch_src);
        bridge.prefetch_src = NULL;
    }
    close(fd);
    bridge.prefetch_fd = -1;
    bridge.prefetch_ready = true;
    return 0;
}

/* Pick the best text MIME offered for prefetching. */
static const char *bridge_pick_text_mime(void) {
    static const char *pref[] = {
        "text/plain;charset=utf-8", "text/plain", "UTF8_STRING", NULL,
    };
    for (int i = 0; pref[i]; i++)
        for (size_t j = 0; j < bridge.mimes_len; j++)
            if (strcmp(bridge.mimes[j], pref[i]) == 0)
                return bridge.mimes[j];
    for (size_t j = 0; j < bridge.mimes_len; j++)
        if (strncmp(bridge.mimes[j], "text/", 5) == 0)
            return bridge.mimes[j];
    return NULL;
}

/* Start pulling the current host offer's primary text MIME into our buffer.
   Must be called while bridge.mimes holds the freshly collected list. */
static void bridge_prefetch_start(void) {
    bridge_prefetch_cancel();
    if (!bridge.mimes_len)
        return;
    const char *mime = bridge_pick_text_mime();
    if (!mime)
        return;
    int p[2];
    if (pipe2(p, O_CLOEXEC | O_NONBLOCK) != 0)
        return;
    bridge.prefetch_fd = p[0];
    bridge.prefetch_src = wl_event_loop_add_fd(server.loop, p[0],
        WL_EVENT_READABLE, bridge_prefetch_cb, NULL);
    if (!bridge.prefetch_src) {
        close(p[0]);
        close(p[1]);
        bridge.prefetch_fd = -1;
        return;
    }
    snprintf(bridge.prefetch_mime, sizeof(bridge.prefetch_mime), "%s", mime);
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_offer) {
        zwlr_data_control_offer_v1_receive(bridge.dc_offer, mime, p[1]);
        close(p[1]);
    } else if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE &&
               bridge.dd_offer) {
        wl_data_offer_receive(bridge.dd_offer, mime, p[1]);
        close(p[1]);
    } else {
        bridge_prefetch_cancel();
    }
}

/* The requested MIME can be served from the prefetched plain-text buffer. */
static bool bridge_prefetch_mime_compatible(const char *mime) {
    if (!bridge.prefetch_ready || bridge.prefetch_mime[0] == '\0')
        return false;
    if (strcmp(mime, bridge.prefetch_mime) == 0)
        return true;
    bool a = strncmp(mime, "text/plain", 10) == 0 ||
             strcmp(mime, "UTF8_STRING") == 0;
    bool b = strncmp(bridge.prefetch_mime, "text/plain", 10) == 0 ||
             strcmp(bridge.prefetch_mime, "UTF8_STRING") == 0;
    return a && b;
}

static void bridge_prefetch_serve(const char *mime, int32_t fd) {
    if (!bridge_prefetch_mime_compatible(mime)) {
        close(fd);
        return;
    }
    size_t off = 0;
    while (off < bridge.prefetch_len) {
        ssize_t n = write(fd, bridge.prefetch_buf + off,
                          bridge.prefetch_len - off);
        if (n > 0) {
            off += (size_t)n;
        } else if (n < 0 && (errno == EAGAIN || errno == EINTR)) {
            continue;
        } else {
            break;
        }
    }
    close(fd);
}

/* ---------------- host backend: wlr-data-control ---------------- */

static void bridge_dc_source_send(void *data,
        struct zwlr_data_control_source_v1 *src, const char *mime, int32_t fd) {
    (void)data; (void)src;
    if (bridge.inner_src)
        wlr_data_source_send(bridge.inner_src, mime, fd);
    else
        close(fd);
}

static void bridge_dc_source_cancelled(void *data,
        struct zwlr_data_control_source_v1 *src) {
    (void)data;
    zwlr_data_control_source_v1_destroy(src);
    bridge.dc_source = NULL;
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
}

static const struct zwlr_data_control_source_v1_listener bridge_dc_source_listener = {
    .send = bridge_dc_source_send,
    .cancelled = bridge_dc_source_cancelled,
};

static void bridge_dc_offer_mime(void *data,
        struct zwlr_data_control_offer_v1 *offer, const char *mime) {
    (void)data; (void)offer;
    bridge_mimes_append(mime);
}

static const struct zwlr_data_control_offer_v1_listener bridge_dc_offer_listener = {
    .offer = bridge_dc_offer_mime,
};

static void bridge_dc_device_finished(void *data,
        struct zwlr_data_control_device_v1 *dev) {
    (void)data; (void)dev;
    bridge.backend = bridge.dd ? BRIDGE_BACKEND_WL_DATA_DEVICE
                               : BRIDGE_BACKEND_NONE;
    if (bridge.dc_offer) {
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
        bridge.dc_offer = NULL;
    }
    if (bridge.dc_device) {
        zwlr_data_control_device_v1_destroy(bridge.dc_device);
        bridge.dc_device = NULL;
    }
    tabbed_log(TABBED_LOG_INFO, "clipboard bridge: host data-control "
            "finished; falling back to %s\n",
            bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE ?
            "focus-based wl_data_device" : "none");
}

static void bridge_dc_device_data_offer(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    if (bridge.dc_pending_echo) {
        bridge.dc_pending_echo = false;
        bridge.dc_echo_offer = offer;
    }
    bridge_mimes_reset();
    zwlr_data_control_offer_v1_add_listener(offer, &bridge_dc_offer_listener, NULL);
}

static void bridge_dc_device_selection(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    bridge_prefetch_cancel();
    /* Destroying our own previous source in bridge_host_set_selection makes the
       compositor briefly emit selection(NULL) before the echo of the new source;
       it is not a real clear, so ignore it while our echo is still pending. */
    if (!offer && bridge.dc_pending_echo)
        return;
    if (offer && offer == bridge.dc_echo_offer) {
        bridge.dc_echo_offer = NULL;
        bridge_mimes_reset();
        zwlr_data_control_offer_v1_destroy(offer);
        bridge.dc_pending_echo = false;
        return;
    }
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    if (bridge.dc_offer)
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
    bridge.dc_offer = offer;
    if (!offer) {
        bridge_mimes_reset();
        bridge_clear_nested();
        return;
    }
    bridge_prefetch_start();
    bridge_mirror_to_nested();
}

/* Primary selection is intentionally not bridged; the offer must still be
   acknowledged (NULL handler would make libwayland abort on the event) and
   destroyed so it does not leak. */
static void bridge_dc_device_primary_selection(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    if (offer)
        zwlr_data_control_offer_v1_destroy(offer);
}

static const struct zwlr_data_control_device_v1_listener bridge_dc_listener = {
    .data_offer = bridge_dc_device_data_offer,
    .selection = bridge_dc_device_selection,
    .primary_selection = bridge_dc_device_primary_selection,
    .finished = bridge_dc_device_finished,
};

/* ---------------- host backend: wl_data_device (focus-based) ---------------- */

static void bridge_dd_source_send(void *data, struct wl_data_source *src,
        const char *mime, int32_t fd) {
    (void)data; (void)src;
    if (bridge.inner_src)
        wlr_data_source_send(bridge.inner_src, mime, fd);
    else
        close(fd);
}

static void bridge_dd_source_cancelled(void *data, struct wl_data_source *src) {
    (void)data;
    wl_data_source_destroy(src);
    bridge.dd_source = NULL;
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    bridge.host_set_pending = true;
}

static const struct wl_data_source_listener bridge_dd_source_listener = {
    .send = bridge_dd_source_send,
    .cancelled = bridge_dd_source_cancelled,
};

static void bridge_dd_offer_mime(void *data, struct wl_data_offer *offer,
                                 const char *mime) {
    (void)data; (void)offer;
    bridge_mimes_append(mime);
}

static const struct wl_data_offer_listener bridge_dd_offer_listener = {
    .offer = bridge_dd_offer_mime,
    /* source_actions / action left unset: drag & drop is not bridged */
};

static void bridge_dd_data_offer(void *data, struct wl_data_device *dev,
                                 struct wl_data_offer *offer) {
    (void)data; (void)dev;
    if (bridge.dd_pending_echo) {
        bridge.dd_pending_echo = false;
        bridge.dd_echo_offer = offer;
    }
    bridge_mimes_reset();
    wl_data_offer_add_listener(offer, &bridge_dd_offer_listener, NULL);
}

static void bridge_dd_selection(void *data, struct wl_data_device *dev,
                                struct wl_data_offer *offer) {
    (void)data; (void)dev;
    if (!offer) {
        /* Focus blip: the host selection is momentarily gone (or we lost
           keyboard focus).  Keep the last-known nested selection and, above
           all, leave the pending-echo flags intact so an in-flight dc/dd
           set_selection reply is still recognized as our own echo. */
        bridge_mimes_reset();
        return;
    }
    bridge_prefetch_cancel();
    if (offer == bridge.dd_echo_offer) {
        bridge.dd_echo_offer = NULL;
        bridge_mimes_reset();
        wl_data_offer_destroy(offer);
        bridge.dd_pending_echo = false;
        return;
    }
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    if (bridge.dd_offer)
        wl_data_offer_destroy(bridge.dd_offer);
    bridge.dd_offer = offer;
    bridge_prefetch_start();
    bridge_mirror_to_nested();
}

static const struct wl_data_device_listener bridge_dd_listener = {
    .data_offer = bridge_dd_data_offer,
    .selection = bridge_dd_selection,
    /* enter/leave/motion/drop left unset: drag & drop is not bridged */
};

/* ---------------- nested seat side ---------------- */

static void bridge_seat_request_set_selection(struct wl_listener *l, void *data) {
    (void)l;
    struct wlr_seat_request_set_selection_event *event = data;
    bridge.inner_clear_requested = (event->source == NULL);
    wlr_seat_set_selection(server.seat, event->source, event->serial);
}

static void bridge_host_set_selection(struct wlr_data_source *src) {
    bridge_set_inner_src(src);

    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_device) {
        if (bridge.dc_source) {
            zwlr_data_control_source_v1_destroy(bridge.dc_source);
            bridge.dc_source = NULL;
        }
        struct zwlr_data_control_source_v1 *s =
            zwlr_data_control_manager_v1_create_data_source(bridge.dc_manager);
        char **p;
        wl_array_for_each(p, &src->mime_types)
            zwlr_data_control_source_v1_offer(s, *p);
        zwlr_data_control_source_v1_add_listener(s, &bridge_dc_source_listener, NULL);
        bridge.dc_source = s;
        bridge.dc_pending_echo = true;
        bridge.dd_pending_echo = true;
        zwlr_data_control_device_v1_set_selection(bridge.dc_device, s);
        bridge.host_set_pending = false;
        return;
    }

    if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE && bridge.dd) {
        if (bridge.dd_source) {
            wl_data_source_destroy(bridge.dd_source);
            bridge.dd_source = NULL;
        }
        if (!bridge.kbd_serial) {
            bridge.host_set_pending = true;
            tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host keyboard "
                    "serial yet; deferring host set_selection until focus\n");
            return;
        }
        struct wl_data_source *s =
            wl_data_device_manager_create_data_source(bridge.ddm);
        char **p;
        wl_array_for_each(p, &src->mime_types)
            wl_data_source_offer(s, *p);
        wl_data_source_add_listener(s, &bridge_dd_source_listener, NULL);
        bridge.dd_source = s;
        bridge.dc_pending_echo = true;
        bridge.dd_pending_echo = true;
        wl_data_device_set_selection(bridge.dd, s, bridge.kbd_serial);
        bridge.host_set_pending = false;
        return;
    }
}

static void bridge_host_clear(void) {
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_device)
        zwlr_data_control_device_v1_set_selection(bridge.dc_device, NULL);
    /* focus-based backend: nothing reliable to clear without focus/serial */
}

static void bridge_seat_set_selection(struct wl_listener *l, void *data) {
    (void)l; (void)data;
    struct wlr_data_source *src = server.seat->selection_source;
    if (src && src->impl == &bridge_inner_source_impl)
        return; /* our own host->nested mirror */
    if (bridge.ignore_next_inner) {
        bridge.ignore_next_inner = false;
        return;
    }
    if (!src) {
        if (bridge.inner_clear_requested) {
            bridge.inner_clear_requested = false;
            bridge_host_clear();
        }
        return;
    }
    bridge.inner_clear_requested = false;
    bridge_host_set_selection(src);
}

/* ---------------- lifecycle ---------------- */

static void bridge_attach_seat(void) {
    bridge.request_set_selection.notify = bridge_seat_request_set_selection;
    wl_signal_add(&server.seat->events.request_set_selection,
        &bridge.request_set_selection);
    bridge.set_selection.notify = bridge_seat_set_selection;
    wl_signal_add(&server.seat->events.set_selection, &bridge.set_selection);
}

static void bridge_init(void) {
    if (!host.seat) {
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host seat; disabled\n");
        return;
    }
    /* Re-entrant: drop any objects bound to a previous host seat so a runtime
       seat re-add (registry churn, e.g. VT round-trip) re-binds cleanly. */
    if (bridge.dd)
        wl_data_device_release(bridge.dd);
    bridge.dd = NULL;
    if (bridge.dc_device)
        zwlr_data_control_device_v1_destroy(bridge.dc_device);
    bridge.dc_device = NULL;
    bridge.dd_offer = NULL;
    bridge.dc_offer = NULL;
    bridge.dd_echo_offer = NULL;
    bridge.dc_echo_offer = NULL;
    bridge.backend = BRIDGE_BACKEND_NONE;
    if (bridge.ddm) {
        bridge.dd = wl_data_device_manager_get_data_device(bridge.ddm, host.seat);
        wl_data_device_add_listener(bridge.dd, &bridge_dd_listener, NULL);
    }
    if (bridge.dc_manager) {
        bridge.dc_device = zwlr_data_control_manager_v1_get_data_device(
            bridge.dc_manager, host.seat);
        zwlr_data_control_device_v1_add_listener(bridge.dc_device,
            &bridge_dc_listener, NULL);
        bridge.backend = BRIDGE_BACKEND_DATA_CONTROL;
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: host data-control backend\n");
    } else if (bridge.dd) {
        bridge.backend = BRIDGE_BACKEND_WL_DATA_DEVICE;
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: focus-based wl_data_device "
                "backend (host lacks wlr-data-control; host->nested sync needs "
                "focus)\n");
    } else {
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host clipboard path\n");
    }
}

static void bridge_cleanup(void) {
    if (bridge.inner_src) {
        wl_list_remove(&bridge.inner_src_destroy.link);
        bridge.inner_src = NULL;
    }
    if (bridge.dc_source) {
        zwlr_data_control_source_v1_destroy(bridge.dc_source);
        bridge.dc_source = NULL;
    }
    if (bridge.dd_source) {
        wl_data_source_destroy(bridge.dd_source);
        bridge.dd_source = NULL;
    }
    if (bridge.dc_offer) {
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
        bridge.dc_offer = NULL;
    }
    if (bridge.dd_offer) {
        wl_data_offer_destroy(bridge.dd_offer);
        bridge.dd_offer = NULL;
    }
    if (bridge.dc_device) {
        zwlr_data_control_device_v1_destroy(bridge.dc_device);
        bridge.dc_device = NULL;
    }
    bridge_mimes_reset();
    free(bridge.mimes);
    bridge.mimes = NULL;
    bridge.mimes_cap = 0;
    bridge_prefetch_cancel();
    bridge.backend = BRIDGE_BACKEND_NONE;
}

/* ===================== Host-side listeners ===================== */

/* wl_seat capabilities handler: see host_seat_capabilities() below (defined
   after the host keyboard/pointer listeners it installs). */
static void host_seat_capabilities(void *data, struct wl_seat *seat,
                                   uint32_t capabilities);
static void host_seat_name(void *data, struct wl_seat *seat, const char *name) {
    (void)data; (void)seat; (void)name;
}
static const struct wl_seat_listener host_seat_listener = {
    .capabilities = host_seat_capabilities,
    .name = host_seat_name,
};

static void host_registry_global(void *data, struct wl_registry *registry,
                                 uint32_t name, const char *interface,
                                 uint32_t version)
{
    (void)data;
    if (strcmp(interface, wl_compositor_interface.name) == 0) {
        host.compositor = wl_registry_bind(registry, name,
            &wl_compositor_interface, version < 4 ? version : 4);
    } else if (strcmp(interface, xdg_wm_base_interface.name) == 0) {
        host.wm_base = wl_registry_bind(registry, name,
            &xdg_wm_base_interface, version < 1 ? version : 1);
    } else if (strcmp(interface, zxdg_decoration_manager_v1_interface.name) == 0) {
        host.decoration = wl_registry_bind(registry, name,
            &zxdg_decoration_manager_v1_interface, 1);
    } else if (strcmp(interface, wl_seat_interface.name) == 0) {
        /* Bind the seat and rely on the capabilities event (which the
           compositor always sends after a bind) to (re)create the keyboard
           and pointer objects -- including after a VT round-trip, where the
           compositor invalidates seat objects and a re-bind or capability
           re-gain must be observed to keep receiving input. */
        host.seat = wl_registry_bind(registry, name,
            &wl_seat_interface, version < 5 ? version : 5);
        host.seat_name = name;
        wl_seat_add_listener(host.seat, &host_seat_listener, NULL);
        if (host.registry_synced)
            bridge_init();   /* runtime seat re-add: re-establish the bridge */
    } else if (strcmp(interface, wl_data_device_manager_interface.name) == 0) {
        bridge.ddm = wl_registry_bind(registry, name,
            &wl_data_device_manager_interface, version < 3 ? version : 3);
    } else if (strcmp(interface,
                      zwlr_data_control_manager_v1_interface.name) == 0) {
        bridge.dc_manager = wl_registry_bind(registry, name,
            &zwlr_data_control_manager_v1_interface, version < 2 ? version : 2);
    }
}

static void host_registry_global_remove(void *data, struct wl_registry *registry,
                                        uint32_t name)
{
    (void)data; (void)registry;
    /* Only the wl_seat global's removal matters to us: its children (keyboard,
       pointer, clipboard data devices) are invalidated with it and must be
       re-created when the compositor advertises a new seat.  Other globals we
       bind (compositor, xdg_wm_base, ...) are process-lifetime. */
    if (host.seat_name && name == host.seat_name) {
        tabbed_log(TABBED_LOG_DEBUG, "[seat] global %u removed\n", name);
        host.seat_name = 0;
        host.seat = NULL;
        host.keyboard = NULL;
        host.pointer = NULL;
        /* Seat-owned bridge objects are invalidated too; null them so the
           next bridge_init() on a fresh seat re-binds cleanly. */
        bridge.dd = NULL;
        bridge.dc_device = NULL;
        bridge.dd_offer = NULL;
        bridge.dc_offer = NULL;
        bridge.dd_echo_offer = NULL;
        bridge.dc_echo_offer = NULL;
        bridge.backend = BRIDGE_BACKEND_NONE;
    }
}

static const struct wl_registry_listener host_registry_listener = {
    .global = host_registry_global,
    .global_remove = host_registry_global_remove,
};

static void host_xdg_wm_ping(void *data, struct xdg_wm_base *wm, uint32_t serial) {
    (void)data;
    xdg_wm_base_pong(wm, serial);
}

static const struct xdg_wm_base_listener host_xdg_wm_listener = {
    .ping = host_xdg_wm_ping,
};

static void host_xdg_surface_configure(void *data, struct xdg_surface *s,
                                       uint32_t serial)
{
    (void)data;
    xdg_surface_ack_configure(s, serial);
}

static const struct xdg_surface_listener host_xdg_surface_listener = {
    .configure = host_xdg_surface_configure,
};

static void host_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    host.width = width;
    host.height = height;
    if (host.egl_window)
        wl_egl_window_resize(host.egl_window, width, height, 0, 0);
    if (host.egl_ok) {
        eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                       host.egl_context);
    }
    output_resize(width, height);
    needs_redraw = true;
}

static void host_xdg_toplevel_configure(void *data, struct xdg_toplevel *t,
                                        int32_t width, int32_t height,
                                        struct wl_array *states)
{
    (void)data; (void)t;
    host.fullscreen = false;
    uint32_t *state;
    wl_array_for_each(state, states)
        if (*state == XDG_TOPLEVEL_STATE_FULLSCREEN)
            host.fullscreen = true;
    /* Mirror the host window's state onto the clients: fullscreen begets
       fullscreen, anything else begets maximized. */
    if (host.fullscreen != server.clients_fullscreen) {
        tabbed_log(TABBED_LOG_INFO, "host fullscreen=%d\n", host.fullscreen);
        clients_set_fullscreen(host.fullscreen);
    }
    if (width > 0 && height > 0)
        host_resize(width, height);
    host.configured = true;
}

static void host_xdg_toplevel_close(void *data, struct xdg_toplevel *t) {
    (void)data; (void)t;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: window closed\n");
    shutdown_cleanup();
    exit(0);
}

static const struct xdg_toplevel_listener host_xdg_toplevel_listener = {
    .configure = host_xdg_toplevel_configure,
    .close = host_xdg_toplevel_close,
};

static void host_decoration_configure(void *data,
                                      struct zxdg_toplevel_decoration_v1 *dec,
                                      uint32_t mode)
{
    (void)data; (void)dec;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: host decoration mode=%u (%s)\n",
            mode,
            mode == ZXDG_TOPLEVEL_DECORATION_V1_MODE_SERVER_SIDE
                ? "server-side" : "client-side");
}

static const struct zxdg_toplevel_decoration_v1_listener host_decoration_listener = {
    .configure = host_decoration_configure,
};

/* ---------- host keyboard ---------- */

/* (Re)build the xkb_state used to translate raw evdev keycodes into
   keysyms for host hotkey matching.  The state is derived from whatever
   keymap is current (host-provided or fallback), so the hotkeys work on
   any keyboard/layout without hardcoded keycodes. */
static void xkb_state_reload(void)
{
    if (server.xkb_state) {
        xkb_state_unref(server.xkb_state);
        server.xkb_state = NULL;
    }
    if (!server.xkb_keymap)
        return;
    server.xkb_state = xkb_state_new(server.xkb_keymap);
    server.xkb_prefix_mod = xkb_keymap_mod_get_index(server.xkb_keymap,
            tab_prefix == PREFIX_SUPER ? XKB_PREFIX_MOD4_NAME
                                       : XKB_MOD_NAME_ALT);
    tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: prefix modifier index=%u "
            "(%s)\n", (unsigned)server.xkb_prefix_mod,
            tab_prefix == PREFIX_SUPER ? "Super/Mod4" : "Alt");
}

static void host_kbd_keymap(void *data, struct wl_keyboard *kbd, uint32_t format,
                            int32_t fd, uint32_t size)
{
    (void)data; (void)kbd;
    if (format != WL_KEYBOARD_KEYMAP_FORMAT_XKB_V1 || size == 0 || !server.xkb_ctx) {
        close(fd);
        return;
    }
    tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: host keymap: format=%u size=%u\n",
               format, size);

    /* The keymap is an shm file (size includes the trailing NUL), so mmap it
       like wlroots' own clients do; fall back to a plain read loop. */
    char *buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
    bool mapped = buf != MAP_FAILED;
    size_t total = mapped ? size : 0;
    if (!mapped) {
        buf = malloc(size + 1);
        if (!buf) {
            close(fd);
            return;
        }
        while (total < size) {
            ssize_t rd = read(fd, buf + total, size - total);
            if (rd > 0) {
                total += rd;
            } else if (rd < 0 && (errno == EAGAIN || errno == EINTR)) {
                struct timespec ts = { .tv_sec = 0, .tv_nsec = 1000000 };
                nanosleep(&ts, NULL);
            } else {
                break;
            }
        }
        buf[total] = '\0';
        if (total < size)
            tabbed_log(TABBED_LOG_DEBUG,
                       "tabbed-wlroots: host keymap: short read %zu/%u bytes\n",
                       total, size);
    }

    struct xkb_keymap *km = xkb_keymap_new_from_string(
        server.xkb_ctx, buf, XKB_KEYMAP_FORMAT_TEXT_V1, 0);
    if (km) {
        wlr_keyboard_set_keymap(&server.keyboard, km);
        if (server.xkb_keymap)
            xkb_keymap_unref(server.xkb_keymap);
        server.xkb_keymap = km;
        xkb_state_reload();
        tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: host keymap parsed OK\n");
    } else {
        tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: failed to parse host "
                "keymap (%u bytes); keeping fallback keymap\n", size);
        if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
            char hex[129];
            size_t n = total < 64 ? total : 64;
            for (size_t i = 0; i < n; i++)
                snprintf(hex + i * 2, sizeof(hex) - i * 2, "%02x",
                         (unsigned char)buf[i]);
            tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: keymap head (%zu/%u "
                    "bytes): %s\n", n, size, hex);
        }
    }

    if (mapped)
        munmap(buf, size);
    else
        free(buf);
    close(fd);
}

static void host_kbd_enter(void *data, struct wl_keyboard *kbd, uint32_t serial,
                           struct wl_surface *surface, struct wl_array *keys)
{
    (void)data; (void)kbd; (void)surface; (void)keys;
    /* Remember the enter serial for host clipboard set_selection.  Only the
       focus-based wl_data_device backend can hold a stale echo guard (a
       set_selection sent with a no-longer-valid serial gets no reply): drop it
       on refocus there.  The data-control backend echoes independently of
       focus, so its in-flight guard must be preserved here, or the host's echo
       of our own set_selection is mistaken for a real selection and mirrored
       back into an endless set_selection/receive loop. */
    bridge.kbd_serial = serial;
    if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE) {
        bridge.dc_pending_echo = false;
        bridge.dd_pending_echo = false;
    }
    if (bridge.host_set_pending && server.seat->selection_source &&
            server.seat->selection_source->impl != &bridge_inner_source_impl) {
        bridge.host_set_pending = false;
        bridge_host_set_selection(server.seat->selection_source);
    }
    tabbed_log(TABBED_LOG_DEBUG, "[kbd] enter surface=%p serial=%u active=%p\n",
               (void *)surface, serial, (void *)active_toplevel());
    struct wlr_xdg_toplevel *tl = active_toplevel();
    if (tl)
        wlr_seat_keyboard_notify_enter(server.seat, tl->base->surface,
            server.keyboard.keycodes, server.keyboard.num_keycodes,
            &server.keyboard.modifiers);
}

static void host_kbd_leave(void *data, struct wl_keyboard *kbd, uint32_t serial,
                           struct wl_surface *surface)
{
    (void)data; (void)kbd; (void)serial; (void)surface;
    tabbed_log(TABBED_LOG_DEBUG, "[kbd] leave surface=%p serial=%u\n",
               (void *)surface, serial);
    wlr_seat_keyboard_notify_clear_focus(server.seat);
}

/* Temporary grey-band diagnosis: dump the scene buffer (client content as
   wlroots rendered it) to /tmp/scene_N.ppm. The buffer memory is top-down,
   XRGB8888. */
static void dump_scene_buffer(struct wlr_buffer *buf) {
    if (!buf) return;
    void *data;
    uint32_t format;
    size_t stride;
    if (!wlr_buffer_begin_data_ptr_access(buf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                                          &data, &format, &stride)) {
        tabbed_log(TABBED_LOG_INFO, "[dump] scene buffer not CPU-readable "
                "(%dx%d)\n", buf->width, buf->height);
        return;
    }
    /* [diag] classify the buffer: count non-black pixels so we can tell
       "client painted nothing" from "we failed to import". */
    int w = buf->width, h = buf->height;
    unsigned long nonblack = 0, lum = 0;
    unsigned char *p = data;
    for (int y = 0; y < h; y++) {
        unsigned char *row = p + (size_t)y * stride;
        for (int x = 0; x < w; x++) {
            uint32_t b = row[x*4+0];
            unsigned long v = b + row[x*4+1] + row[x*4+2];
            lum += v;
            if (v > 12) nonblack++;
        }
    }
    tabbed_log(TABBED_LOG_INFO, "[dump] scene %dx%d fmt=0x%x "
            "nonblack=%lu/%lu mean=%lu\n", w, h, format, nonblack,
            (unsigned long)w * h, lum / ((unsigned long)w * h + 1));
    char path[64];
    snprintf(path, sizeof(path), "/tmp/scene_%d.ppm", dump_seq);
    FILE *f = fopen(path, "wb");
    if (f) {
        int w = buf->width, h = buf->height;
        fprintf(f, "P6\n%d %d\n255\n", w, h);
        unsigned char *p = data;
        for (int y = 0; y < h; y++) {
            unsigned char *row = p + (size_t)y * stride;
            for (int x = 0; x < w; x++) {
                fputc(row[x*4+0], f);
                fputc(row[x*4+1], f);
                fputc(row[x*4+2], f);
            }
        }
        fclose(f);
        tabbed_log(TABBED_LOG_INFO, "[dump] scene buffer -> %s (%dx%d, "
                "fmt=0x%x)\n", path, w, h, format);
    }
    wlr_buffer_end_data_ptr_access(buf);
    dump_seq++;
}

/* Dump what we are about to present to the host (our composited back buffer).
   Must be called with the host EGL context current and back buffer freshly
   drawn. GL readback is bottom-up, so flip vertically. */
static void dump_host_back(void) {
    int w = host.width, h = host.height;
    unsigned char *px = malloc((size_t)w * h * 4);
    if (!px) return;
    /* The blit draws are queued on the GPU; without a finish the readback can
       race the previous frame's swap and return stale/mid-clear content. */
    glFinish();
    glReadPixels(0, 0, w, h, GL_RGBA, GL_UNSIGNED_BYTE, px);
    unsigned long nonblack = 0, lum = 0;
    for (int y = 0; y < h * w; y++) {
        unsigned long v = px[y*4+0] + px[y*4+1] + px[y*4+2];
        lum += v;
        if (v > 12) nonblack++;
    }
    tabbed_log(TABBED_LOG_INFO, "[dump] host %dx%d nonblack=%lu/%lu mean=%lu\n",
            w, h, nonblack, (unsigned long)w * h,
            lum / ((unsigned long)w * h + 1));
    char path[64];
    snprintf(path, sizeof(path), "/tmp/host_%d.ppm", dump_seq);
    FILE *f = fopen(path, "wb");
    if (f) {
        fprintf(f, "P6\n%d %d\n255\n", w, h);
        for (int y = h - 1; y >= 0; y--) {
            unsigned char *row = px + (size_t)y * w * 4;
            for (int x = 0; x < w; x++) {
                fputc(row[x*4+0], f);
                fputc(row[x*4+1], f);
                fputc(row[x*4+2], f);
            }
        }
        fclose(f);
        tabbed_log(TABBED_LOG_INFO, "[dump] host back buffer -> %s (%dx%d)\n",
                path, w, h);
    }
    free(px);
    dump_seq++;
}

/* Dump the standalone frame buffer as it will be presented (scene + overlay
   composited by the wlroots renderer).  With a GLES2 renderer we glReadPixels
   the buffer's FBO in the wlroots EGL context; otherwise fall back to a CPU
   read (e.g. the shm-backed buffers of the pixman renderer).  Uses the same
   "[dump] host back buffer ->" message as the nested dump so tests can parse
   either mode with one helper. */
static void dump_standalone_buffer(struct wlr_buffer *buf) {
    int w = buf->width, h = buf->height;
    unsigned char *px = malloc((size_t)w * h * 4);
    if (!px) return;
    bool flip = false;
    struct wlr_egl *egl = wlr_gles2_renderer_get_egl(server.renderer);
    GLuint fbo = egl ? wlr_gles2_renderer_get_buffer_fbo(server.renderer, buf)
                     : 0;
    EGLDisplay d = egl ? wlr_egl_get_display(egl) : EGL_NO_DISPLAY;
    EGLContext c = egl ? wlr_egl_get_context(egl) : EGL_NO_CONTEXT;
    if (d != EGL_NO_DISPLAY && c != EGL_NO_CONTEXT && fbo) {
        eglMakeCurrent(d, EGL_NO_SURFACE, EGL_NO_SURFACE, c);
        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
        glPixelStorei(GL_PACK_ALIGNMENT, 1);
        glReadPixels(0, 0, w, h, GL_RGBA, GL_UNSIGNED_BYTE, px);
        glBindFramebuffer(GL_FRAMEBUFFER, 0);
        eglMakeCurrent(d, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
        flip = true;
    } else {
        void *data;
        uint32_t format;
        size_t stride;
        if (!wlr_buffer_begin_data_ptr_access(buf,
                WLR_BUFFER_DATA_PTR_ACCESS_READ, &data, &format, &stride)) {
            free(px);
            tabbed_log(TABBED_LOG_INFO,
                    "[dump] standalone buffer not CPU-readable\n");
            return;
        }
        for (int y = 0; y < h; y++)
            memcpy(px + (size_t)y * w * 4, data + (size_t)y * stride,
                   (size_t)w * 4);
        wlr_buffer_end_data_ptr_access(buf);
    }

    unsigned long nonblack = 0, lum = 0;
    for (int y = 0; y < h * w; y++) {
        unsigned long v = px[y*4+0] + px[y*4+1] + px[y*4+2];
        lum += v;
        if (v > 12) nonblack++;
    }
    tabbed_log(TABBED_LOG_INFO, "[dump] host %dx%d nonblack=%lu/%lu mean=%lu\n",
            w, h, nonblack, (unsigned long)w * h,
            lum / ((unsigned long)w * h + 1));
    char path[64];
    snprintf(path, sizeof(path), "/tmp/host_%d.ppm", dump_seq);
    FILE *f = fopen(path, "wb");
    if (f) {
        fprintf(f, "P6\n%d %d\n255\n", w, h);
        for (int y = 0; y < h; y++) {
            int sy = flip ? h - 1 - y : y;
            unsigned char *row = px + (size_t)sy * w * 4;
            for (int x = 0; x < w; x++) {
                fputc(row[x*4+0], f);
                fputc(row[x*4+1], f);
                fputc(row[x*4+2], f);
            }
        }
        fclose(f);
        tabbed_log(TABBED_LOG_INFO, "[dump] host back buffer -> %s (%dx%d)\n",
                path, w, h);
        if (server.cursor)
            tabbed_log(TABBED_LOG_INFO,
                "[dump] cursor at (%f,%f)\n", server.cursor->x, server.cursor->y);
    }
    free(px);
    dump_seq++;
}

/* TABBED_SYNTH_INPUT=1: ignore the real host keyboard entirely and accept
   input only from the stdin event feed (the test/driver channel).  The host
   keyboard listener stays attached (its enter/leave events still drive the
   clipboard bridge), but key and modifier events from the real host are
   dropped so a stray physical press can't cancel a synthesized repeat or
   clobber the injected modifier state. */
static bool synth_input_only;

/* Forward declarations for the shared handlers (defined just below
   host_kbd_key / host_ptr_motion). */
static bool process_key_event(uint32_t time, uint32_t key, uint32_t state,
                              uint32_t mods_depressed);
static void process_modifiers(uint32_t mods_depressed, uint32_t mods_latched,
                              uint32_t mods_locked, uint32_t group);
static void host_ptr_motion(uint32_t time, double sx, double sy);

static void host_kbd_key(void *data, struct wl_keyboard *kbd, uint32_t serial,
                         uint32_t time, uint32_t key, uint32_t state)
{
    (void)data;
    if (synth_input_only && kbd)
        return;
    (void)kbd;
    bridge.kbd_serial = serial;
    if (!process_key_event(time, key, state, host.host_mods_depressed)) {
        /* forward the key to our clients, like a native device would */
        struct wlr_keyboard_key_event event = {
            .time_msec = time,
            .keycode = key,
            .update_state = true,
            .state = state,
        };
        wlr_keyboard_notify_key(&server.keyboard, &event);
        wlr_seat_set_keyboard(server.seat, &server.keyboard);
        wlr_seat_keyboard_notify_key(server.seat, time, key, state);
    }
}

/* Standalone overlay visibility.  The overlay is drawn into the scene output
   buffer outside the scene graph, so the scene's damage trackers never learn
   about its pixels; a swapchain buffer reused after the overlay was drawn
   keeps the stale overlay baked in unless we force a repaint on transition.
   Bumping the sentinel rect's size routes through wlr_scene_rect_set_size ->
   wlr_scene_node_update() with NULL damage, which re-damages the node's whole
   populated "visible" region, so both swapchain slots repaint within the next
   two frames: the overlay fully appears on press and fully clears on release. */
static void standalone_overlay_damage(void) {
    if (!server.output || !server.overlay_damage_rect) return;
    struct wlr_scene_rect *r = server.overlay_damage_rect;
    /* The sentinel's "visible" region is only kept populated while it is the
       topmost sibling (the scene's damage traversal walks children in reverse
       z-order, and an opaque client surface above it would empty the shared
       update region before the sentinel is visited).  Raise it, so the reorder
       traversal populates its full-screen visible region, then bump its size
       to re-damage that whole region; restore the z-order immediately so the
       always-enabled transparent rect never intercepts pointer hit-testing. */
    wlr_scene_node_raise_to_top(&r->node);
    wlr_scene_rect_set_size(r, r->width, r->height - 1);
    wlr_scene_rect_set_size(r, r->width, r->height);
    wlr_scene_node_lower_to_bottom(&r->node);
}

static void update_overlay_visible(bool alt) {
    if (alt == host.overlay_visible) return;
    host.overlay_visible = alt;
    if (server.standalone)
        standalone_overlay_damage();
    needs_redraw = true;
}

/* handle_new_output() forces software cursors on every standalone output, so
   the pointer is always composited into our frame by the scene renderer --
   which only repaints where the frame was damaged.  Cursor motion damages the
   *output*, not the scene, so force whole-output damage on every move or the
   pointer would never be painted. */
static void standalone_cursor_motion(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
    if (server.standalone)
        standalone_overlay_damage();
}

static struct wl_listener standalone_cursor_motion_listener = {
    .notify = standalone_cursor_motion,
};

/* Is the configured tab-management prefix (Alt, or Super/Mod4 with
   --modifier super) currently pressed?  Uses the xkb modifier index when a
   keymap is compiled; with no keymap (xkb init failed) it falls back to the
   raw wl_keyboard modifier bit: mod1/alt = 1<<3, mod4/super = 1<<6. */
static bool prefix_active(uint32_t mods_depressed) {
    if (server.xkb_state)
        return xkb_state_mod_index_is_active(server.xkb_state,
                server.xkb_prefix_mod, XKB_STATE_MODS_EFFECTIVE);
    return (mods_depressed & (tab_prefix == PREFIX_SUPER ? (1u << 6)
                                                         : (1u << 3))) != 0;
}

/* Shared key handling for both the host keyboard and native input devices:
   tab-switch bindings + overlay visibility, with the caller forwarding the
   key to the seat afterwards.  `mods_depressed` uses the wl_keyboard modifier
   layout (shift=1<<0, ctrl=1<<2, alt=1<<3).  Returns true when the key was
   consumed by a binding and must not be forwarded to the seat. */
static bool process_key_event(uint32_t time, uint32_t key, uint32_t state,
                              uint32_t mods_depressed)
{
    (void)time;
    if (server.xkb_state)
        xkb_state_update_key(server.xkb_state, key + 8,
                             state == WL_KEYBOARD_KEY_STATE_PRESSED
                                 ? XKB_KEY_DOWN : XKB_KEY_UP);
    xkb_keysym_t sym = server.xkb_state
        ? xkb_state_key_get_one_sym(server.xkb_state, key + 8)
        : XKB_KEY_NoSymbol;
    /* With no compiled keymap (xkb init failed) fall back to the raw
       evdev keycodes / modifier bits for the hotkey matching below. */
    bool alt = prefix_active(mods_depressed);
    if (alt != host.overlay_visible)
        update_overlay_visible(alt);
    char symbuf[32];
    xkb_keysym_get_name(sym, symbuf, sizeof(symbuf));
    tabbed_log(TABBED_LOG_DEBUG,
        "[kbd] key=%u state=%u sym=%s ctrl=%d alt=%d repeat_key=%u\n",
        key, state, sym ? symbuf : "-",
        (mods_depressed & (1u << 2)) != 0, alt, host.repeat_key);
    /* Ctrl+Alt+F1..F12 switch virtual terminals in standalone mode.  wlroots
       has no built-in handler; the compositor must notice the key and ask the
       session (libseat/logind) to activate another VT.  Both the press and
       release are consumed so the focused client never sees the chord. */
    if (server.standalone && server.session &&
            sym >= XKB_KEY_XF86Switch_VT_1 &&
            sym <= XKB_KEY_XF86Switch_VT_12) {
        if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
            unsigned vt = sym - XKB_KEY_XF86Switch_VT_1 + 1;
            tabbed_log(TABBED_LOG_INFO,
                "tabbed-wlroots: vt switch -> %u\n", vt);
            wlr_session_change_vt(server.session, vt);
        }
        return true;
    }
    /* Function keys (F9/F10/F11) are not grabbed: they pass through to the
       focused client, which may have its own bindings (e.g. a browser's F11
       fullscreen request, which handle_request_fullscreen mirrors onto the
       host window).  Frame dumps are available via SIGUSR1 instead. */
    /* Alt+Up / Alt+Down cycle tabs.  Grabbed so the focused client never
       sees them.  The host sends a single physical press, so repeats are
       synthesized by kbd_repeat_start(); subsequent host presses of an
       already-held key are ignored so a host-sent repeat never cycles twice.
       Plain arrow keys (not Fn+arrow) are used because many laptop firmware
       swallow Alt+Fn+PageUp (the Fn key reports as XF86WakeUp there), which
       makes Alt+PageUp/PageDown unreliable. */
    bool prev, next;
    if (server.xkb_state) {
        prev = sym == XKB_KEY_Up;
        next = sym == XKB_KEY_Down;
    } else {
        prev = key == 103;
        next = key == 108;
    }
    /* Alt+Shift+Up / Alt+Shift+Down move the active tab within the overlay
       list (wrapping at the ends), without switching the active surface.
       Checked before the plain Alt+arrow cycle below so Shift always means
       "reorder, don't switch"; hold to keep moving via kbd_repeat_start.
       Grabbed so the focused client never sees the chord (a terminal would
       otherwise act on Shift+arrow). */
    bool shift = (mods_depressed & (1u << 0)) != 0;
    if (alt && shift && (prev || next)) {
        if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
            if (host.repeat_key != key) {
                int dir = next ? 1 : -1;
                reorder_active_tab(dir);
                kbd_repeat_start(key, dir, REPEAT_REORDER);
            }
        } else {
            kbd_repeat_cancel();
        }
        return true;
    }
    if (alt && (prev || next)) {
        if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
            if (host.repeat_key != key) {
                int dir = next ? 1 : -1;
                cycle_tab(dir);
                kbd_repeat_start(key, dir, REPEAT_CYCLE);
            }
        } else {
            kbd_repeat_cancel();
        }
        return true;
    }
    /* prefix+Delete closes the active tab.  Grabbed so the focused client never
       sees the key; a latch drops host-synthesized repeats so one hold can't
       close a tab per repeat.  The active surface already moved to the right
       neighbor inside close_active_tab(), so the tab is gone this frame even
       before the client process exits. */
    {   bool is_delete = server.xkb_state
            ? (sym == XKB_KEY_Delete)
            : key == 111;
        if (alt && is_delete) {
            kbd_repeat_cancel();
            if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
                if (!delete_key_held) {
                    delete_key_held = true;
                    close_active_tab();
                }
            } else {
                delete_key_held = false;
            }
            return true;
        }
    }
    /* Alt+Shift+T opens a new terminal tab ($TERMINAL, default alacritty).
       The tab is inserted right after the current one and becomes active when
       it maps.  Grabbed so the focused client never sees the chord; a latch
       drops host-synthesized repeats so one hold can't open a terminal per
       repeat. */
    {
        bool is_t = server.xkb_state
            ? (sym == XKB_KEY_t || sym == XKB_KEY_T)
            : key == 20;
        if (alt && shift && is_t) {
            kbd_repeat_cancel();
            if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
                if (!term_key_held) {
                    term_key_held = true;
                    if (!cmd_in_path(term_cmd)) {
                        tabbed_log(TABBED_LOG_INFO,
                                "tabbed-wlroots: '%s' not found in PATH; "
                                "no terminal opened (set $TERMINAL)\n",
                                term_cmd);
                    } else {
                        add_tab(term_cmd);
                    }
                }
            } else {
                term_key_held = false;
            }
            return true;
        }
    }
    /* any other key activity stops the tab-switch repeat */
    kbd_repeat_cancel();
    return false;
}

/* Shared modifier handling for the host keyboard and native devices. */
static void process_modifiers(uint32_t mods_depressed, uint32_t mods_latched,
                              uint32_t mods_locked, uint32_t group)
{
    host.host_mods_depressed = mods_depressed;
    if (server.xkb_state)
        xkb_state_update_mask(server.xkb_state, mods_depressed,
                              mods_latched, mods_locked, group, group, group);
    bool alt = prefix_active(mods_depressed);
    if (alt != host.overlay_visible)
        update_overlay_visible(alt);
    if (host.repeat_key && !alt)
        kbd_repeat_cancel();
}

static void host_kbd_modifiers(void *data, struct wl_keyboard *kbd, uint32_t serial,
                               uint32_t mods_depressed, uint32_t mods_latched,
                               uint32_t mods_locked, uint32_t group)
{
    (void)data; (void)serial;
    if (synth_input_only && kbd)
        return;
    (void)kbd;
    process_modifiers(mods_depressed, mods_latched, mods_locked, group);
    wlr_keyboard_notify_modifiers(&server.keyboard, mods_depressed,
                                  mods_latched, mods_locked, group);
    wlr_seat_keyboard_notify_modifiers(server.seat, &server.keyboard.modifiers);
}

static void host_kbd_repeat_info(void *data, struct wl_keyboard *kbd,
                                 int32_t rate, int32_t delay)
{
    (void)data; (void)kbd;
    wlr_keyboard_set_repeat_info(&server.keyboard, rate, delay);
}

static const struct wl_keyboard_listener host_kbd_listener = {
    .keymap = host_kbd_keymap,
    .enter = host_kbd_enter,
    .leave = host_kbd_leave,
    .key = host_kbd_key,
    .modifiers = host_kbd_modifiers,
    .repeat_info = host_kbd_repeat_info,
};

/* ============ Standalone native input devices ============
   In standalone mode real keyboard/pointer devices come from the backend
   (libinput).  Their events are routed through the same hotkey logic and are
   then forwarded into the shared seat keyboard exactly like host input.

   The keyboard listeners are per-device (one struct standalone_kbdev per
   libinput keyboard): ending a single global slot makes modifier state come
   from whichever device attached last (often an HDMI-CEC or consumer-control
   node), so Shift held on the real keyboard never reached the seat. */

static void standalone_kbd_key(struct wl_listener *listener, void *data) {
    struct standalone_kbdev *kd = wl_container_of(listener, kd, key);
    struct wlr_keyboard_key_event *ev = data;
    uint32_t mods = wlr_keyboard_get_modifiers(kd->keyboard);
    if (!process_key_event(ev->time_msec, ev->keycode, ev->state, mods)) {
        wlr_seat_set_keyboard(server.seat, kd->keyboard);
        wlr_seat_keyboard_notify_key(server.seat, ev->time_msec, ev->keycode,
                                     ev->state);
    }
}

static void standalone_kbd_modifiers(struct wl_listener *listener, void *data) {
    (void)data;
    struct standalone_kbdev *kd = wl_container_of(listener, kd, modifiers);
    struct wlr_keyboard *kb = kd->keyboard;
    process_modifiers(kb->modifiers.depressed, kb->modifiers.latched,
                      kb->modifiers.locked, kb->modifiers.group);
    wlr_seat_set_keyboard(server.seat, kb);
    wlr_seat_keyboard_notify_modifiers(server.seat, &kb->modifiers);
}

/* The device is going away (libinput suspends all devices when the session
   loses its VT).  Drop our listeners so wlr_keyboard_finish's assert that
   every event list is empty holds, then free the struct.  wlroots emits the
   input device's destroy signal from within wlr_keyboard_finish(), so this
   runs before the assert. */
static void standalone_kbd_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct standalone_kbdev *kd = wl_container_of(listener, kd, destroy);
    wl_list_remove(&kd->destroy.link);
    wl_list_remove(&kd->key.link);
    wl_list_remove(&kd->modifiers.link);
    wl_list_remove(&kd->link);
    free(kd);
}

/* Forward the wlr_cursor's position to the seat as the effect/click point.
   wlroots is the single source of truth for where the pointer is: it clamps
   cursor->x/y against the output layout (wlr_cursor_warp_closest), so the
   visible arrow and the coordinates forwarded here stay in the same space,
   even when a requested --screen-mode mode differs from the geometry the
   output layout derives from the committed state.  Never hand-clamp a second
   copy. */
static void standalone_forward_pointer(uint32_t time) {
    struct wlr_output *output = server.output;
    if (!server.cursor || !output) return;
    double x = server.cursor->x;
    double y = server.cursor->y;
    wlr_output_layout_output_coords(server.output_layout, output, &x, &y);
    host_ptr_motion(time, x, y);
}

/* Shared standalone pointer-motion handling, used by both the libinput device
   listeners and the stdin ctl feed (which has no device, hence NULL).  The
   wlr_cursor never moves on its own in wlroots 0.19 -- the device wiring only
   re-emits motion on cursor->events.motion -- so every relative delta must be
   turned into wlr_cursor_move() or the visible pointer stays pinned while the
   seat (and therefore client hover) keeps moving.  With a NULL device the move
   falls back to the output layout's closest-point mapping. */
static void native_ptr_motion(uint32_t time, struct wlr_input_device *dev,
                              double dx, double dy) {
    if (!server.cursor) return;
    wlr_cursor_move(server.cursor, dev, dx, dy);
    standalone_forward_pointer(time);
}

static void native_ptr_abs(uint32_t time, struct wlr_input_device *dev,
                           double x, double y) {
    if (!server.cursor) return;
    wlr_cursor_warp_absolute(server.cursor, dev, x, y);
    standalone_forward_pointer(time);
}

static void standalone_ptr_motion_event(struct wl_listener *listener, void *data) {
    struct standalone_ptrdev *pd = wl_container_of(listener, pd, motion);
    struct wlr_pointer_motion_event *ev = data;
    native_ptr_motion(ev->time_msec,
                      (struct wlr_input_device *)&pd->pointer->base,
                      ev->delta_x, ev->delta_y);
}

static void standalone_ptr_abs_event(struct wl_listener *listener, void *data) {
    struct standalone_ptrdev *pd = wl_container_of(listener, pd, motion_absolute);
    struct wlr_pointer_motion_absolute_event *ev = data;
    native_ptr_abs(ev->time_msec,
                   (struct wlr_input_device *)&pd->pointer->base,
                   ev->x, ev->y);
}

static void standalone_ptr_button_event(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_pointer_button_event *ev = data;
    if (!server.seat) return;
    wlr_seat_pointer_notify_button(server.seat, ev->time_msec, ev->button,
                                   ev->state);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void standalone_ptr_axis_event(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_pointer_axis_event *ev = data;
    if (!server.seat) return;
    wlr_seat_pointer_notify_axis(server.seat, ev->time_msec, ev->orientation,
                                 ev->delta, ev->delta_discrete, ev->source,
                                 WL_POINTER_AXIS_RELATIVE_DIRECTION_IDENTICAL);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void standalone_ptr_frame_event(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

/* The device is going away (libinput suspends all devices when the session
   loses its VT).  Drop our listeners so wlr_pointer_finish's assert that
   every event list is empty holds, then free the struct. */
static void standalone_ptr_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct standalone_ptrdev *pd = wl_container_of(listener, pd, destroy);
    wl_list_remove(&pd->destroy.link);
    wl_list_remove(&pd->motion.link);
    wl_list_remove(&pd->motion_absolute.link);
    wl_list_remove(&pd->button.link);
    wl_list_remove(&pd->axis.link);
    wl_list_remove(&pd->frame.link);
    wl_list_remove(&pd->link);
    free(pd);
}

static void handle_new_input(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_input_device *device = data;

    switch (device->type) {
    case WLR_INPUT_DEVICE_KEYBOARD: {
        struct wlr_keyboard *kb = wlr_keyboard_from_input_device(device);
        /* Without a keymap the device never emits modifier events; give it
           ours so both the hotkeys and the seat work. */
        if (server.xkb_keymap)
            wlr_keyboard_set_keymap(kb, server.xkb_keymap);
        struct standalone_kbdev *kd = calloc(1, sizeof(*kd));
        if (!kd) break;
        kd->keyboard = kb;
        kd->key.notify = standalone_kbd_key;
        wl_signal_add(&kb->events.key, &kd->key);
        kd->modifiers.notify = standalone_kbd_modifiers;
        wl_signal_add(&kb->events.modifiers, &kd->modifiers);
        kd->destroy.notify = standalone_kbd_destroy;
        wl_signal_add(&kb->base.events.destroy, &kd->destroy);
        wl_list_insert(server.kbdevs.prev, &kd->link);
        tabbed_log(TABBED_LOG_INFO, "standalone: keyboard '%s'\n", device->name);
        break;
    }
    case WLR_INPUT_DEVICE_POINTER: {
        struct wlr_pointer *ptr = wlr_pointer_from_input_device(device);
        if (server.cursor)
            wlr_cursor_attach_input_device(server.cursor, device);
        struct standalone_ptrdev *pd = calloc(1, sizeof(*pd));
        if (!pd) break;
        pd->pointer = ptr;
        pd->motion.notify = standalone_ptr_motion_event;
        wl_signal_add(&ptr->events.motion, &pd->motion);
        pd->motion_absolute.notify = standalone_ptr_abs_event;
        wl_signal_add(&ptr->events.motion_absolute, &pd->motion_absolute);
        pd->button.notify = standalone_ptr_button_event;
        wl_signal_add(&ptr->events.button, &pd->button);
        pd->axis.notify = standalone_ptr_axis_event;
        wl_signal_add(&ptr->events.axis, &pd->axis);
        pd->frame.notify = standalone_ptr_frame_event;
        wl_signal_add(&ptr->events.frame, &pd->frame);
        pd->destroy.notify = standalone_ptr_destroy;
        wl_signal_add(&ptr->base.events.destroy, &pd->destroy);
        wl_list_insert(server.ptrdevs.prev, &pd->link);
        tabbed_log(TABBED_LOG_INFO, "standalone: pointer '%s'\n", device->name);
        break;
    }
    default:
        break;
    }
}

/* ============ stdin event feed (test/driver channel) ============
   Reads raw keyboard events from stdin and dispatches them into the
   same host_kbd_key / host_kbd_modifiers handlers a real host would
   deliver, so the key handler itself stays under test.  Two records:

       1 | u32 key  | u32 state        (WL_KEYBOARD_KEY_STATE_*)
       2 | u32 mods | u32 latched | u32 locked | u32 group
*/
#define CTL_CMD_KEY  1
#define CTL_CMD_MODS 2
#define CTL_CMD_WARP 3
#define CTL_CMD_PTR_MOTION 4

#define CTL_MAX_MSG  20          /* 1 + 4 + 4 (or 1 + 16) after padding */
#define CTL_BUF_SIZE 512

static uint32_t ctl_serial;
static uint32_t ctl_time;

static void ctl_dispatch(const uint8_t *msg, size_t len) {
    uint32_t u32[4];
    if (len < 5) return;
    switch (msg[0]) {
    case CTL_CMD_KEY:
        if (len < 9) return;
        memcpy(u32, msg + 1, 8);
        ctl_time += 1;
        host_kbd_key(NULL, NULL, ++ctl_serial, ctl_time, u32[0], u32[1]);
        break;
    case CTL_CMD_MODS:
        if (len < 17) return;
        memcpy(u32, msg + 1, 16);
        ctl_time += 1;
        host_kbd_modifiers(NULL, NULL, ++ctl_serial, u32[0], u32[1],
                           u32[2], u32[3]);
        break;
    case CTL_CMD_WARP:
        if (len < 9) return;
        memcpy(u32, msg + 1, 8);
        ctl_time += 1;
        /* Absolute standalone-output-pixel position, so tests can place the
           visible cursor (wlr_cursor_warp with a NULL device).  Warp doesn't
           emit a motion event, so damage the scene here like motion would, and
           forward the new position to the seat so the effect point stays where
           the arrow lands. */
        wlr_cursor_warp(server.cursor, NULL, (double)u32[0], (double)u32[1]);
        if (server.standalone) {
            standalone_forward_pointer(ctl_time);
            standalone_overlay_damage();
        }
        break;
    case CTL_CMD_PTR_MOTION:
        if (len < 9) return;
        memcpy(u32, msg + 1, 8);
        ctl_time += 1;
        /* Relative delta through the same path a libinput pointer device
           takes (native_ptr_motion -> wlr_cursor_move).  With no device there
           is no cursor->events.motion, so damage the scene explicitly. */
        native_ptr_motion(ctl_time, NULL, (double)u32[0], (double)u32[1]);
        if (server.standalone)
            standalone_overlay_damage();
        break;
    }
}

static int ctl_cb(int fd, uint32_t mask, void *data) {
    static uint8_t buf[CTL_BUF_SIZE];
    static size_t have = 0;
    (void)data;

    /* stdin closed: stop watching but keep the compositor running */
    if (mask & (WL_EVENT_HANGUP | WL_EVENT_ERROR)) {
        wl_event_source_remove(server.ctl_source);
        server.ctl_source = NULL;
        return 0;
    }

    ssize_t n = read(fd, buf + have, sizeof(buf) - have);
    if (n <= 0) {
        if (n == 0) {
            wl_event_source_remove(server.ctl_source);
            server.ctl_source = NULL;
        }
        return 0;
    }
    have += (size_t)n;

    uint8_t msg[CTL_MAX_MSG];
    while (have >= 5) {
        size_t need = (buf[0] == CTL_CMD_MODS) ? 17 : 9;
        if (have < need) break;
        memcpy(msg, buf, need);
        ctl_dispatch(msg, need);
        memmove(buf, buf + need, have - need);
        have -= need;
    }
    return 0;
}

/* ---------- host pointer ---------- */

static struct wlr_surface *surface_at(double x, double y,
                                      double *sx, double *sy)
{
    struct wlr_scene_node *node = wlr_scene_node_at(
        &server.scene->tree.node, x, y, sx, sy);
    if (node && node->type == WLR_SCENE_NODE_BUFFER) {
        struct wlr_scene_buffer *buffer = wlr_scene_buffer_from_node(node);
        struct wlr_scene_surface *scene_surface =
            wlr_scene_surface_try_from_buffer(buffer);
        if (scene_surface)
            return scene_surface->surface;
    }
    return NULL;
}

static void host_ptr_motion(uint32_t time, double sx, double sy) {
    if (!server.seat) return;
    double nx = 0.0, ny = 0.0;
    struct wlr_surface *surface = surface_at(sx, sy, &nx, &ny);
    if (surface) {
        wlr_seat_pointer_notify_enter(server.seat, surface, nx, ny);
        wlr_seat_pointer_notify_motion(server.seat, time, nx, ny);
    } else {
        wlr_seat_pointer_notify_clear_focus(server.seat);
    }
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_enter(void *data, struct wl_pointer *p, uint32_t serial,
                           struct wl_surface *surface, wl_fixed_t sx, wl_fixed_t sy)
{
    (void)data; (void)p; (void)serial; (void)surface;
    host_ptr_motion(0, wl_fixed_to_double(sx), wl_fixed_to_double(sy));
}

static void host_ptr_leave(void *data, struct wl_pointer *p, uint32_t serial,
                           struct wl_surface *surface)
{
    (void)data; (void)p; (void)serial; (void)surface;
    if (server.seat) {
        wlr_seat_pointer_notify_clear_focus(server.seat);
        wlr_seat_pointer_notify_frame(server.seat);
    }
}

static void host_ptr_motion_event(void *data, struct wl_pointer *p, uint32_t time,
                                  wl_fixed_t sx, wl_fixed_t sy)
{
    (void)data; (void)p;
    host_ptr_motion(time, wl_fixed_to_double(sx), wl_fixed_to_double(sy));
}

static void host_ptr_button(void *data, struct wl_pointer *p, uint32_t serial,
                            uint32_t time, uint32_t button, uint32_t state)
{
    (void)data; (void)p; (void)serial;
    if (!server.seat) return;
    wlr_seat_pointer_notify_button(server.seat, time, button, state);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_axis(void *data, struct wl_pointer *p, uint32_t time,
                          uint32_t axis, wl_fixed_t value)
{
    (void)data; (void)p;
    if (!server.seat) return;
    int32_t discrete = axis < 2 ? host.axis_discrete[axis] : 0;
    host.axis_discrete[axis] = 0;
    wlr_seat_pointer_notify_axis(server.seat, time, axis,
                                 wl_fixed_to_double(value), discrete,
                                 host.axis_source,
                                 WL_POINTER_AXIS_RELATIVE_DIRECTION_IDENTICAL);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_axis_source(void *data, struct wl_pointer *p, uint32_t source)
{
    (void)data; (void)p;
    host.axis_source = source;
}

static void host_ptr_axis_discrete(void *data, struct wl_pointer *p, uint32_t axis,
                                   int32_t discrete)
{
    (void)data; (void)p;
    if (axis < 2)
        host.axis_discrete[axis] += discrete;
}

static void host_ptr_axis_stop(void *data, struct wl_pointer *p, uint32_t time,
                               uint32_t axis)
{
    (void)data; (void)p; (void)time; (void)axis;
}

static void host_ptr_frame(void *data, struct wl_pointer *p) {
    (void)data; (void)p;
}

static const struct wl_pointer_listener host_ptr_listener = {
    .enter = host_ptr_enter,
    .leave = host_ptr_leave,
    .motion = host_ptr_motion_event,
    .button = host_ptr_button,
    .axis = host_ptr_axis,
    .frame = host_ptr_frame,
    .axis_source = host_ptr_axis_source,
    .axis_stop = host_ptr_axis_stop,
    .axis_discrete = host_ptr_axis_discrete,
};

/* When the host compositor (labwc on a VT round-trip) removes a seat
   capability, every object created from that seat -- our wl_keyboard /
   wl_pointer -- is invalidated, yet the client keeps running silently with
   no input ever arriving again.  Re-create the objects as capabilities are
   re-gained; the compositor re-sends keymap/modifiers/enter on the fresh
   wl_keyboard, and host_kbd_enter() re-focuses our nested seat. */
static void host_seat_capabilities(void *data, struct wl_seat *seat,
                                   uint32_t capabilities)
{
    (void)data; (void)seat;
    tabbed_log(TABBED_LOG_DEBUG, "[seat] capabilities=0x%x\n", capabilities);
    const bool have_kbd = (capabilities & WL_SEAT_CAPABILITY_KEYBOARD) != 0;
    const bool have_ptr = (capabilities & WL_SEAT_CAPABILITY_POINTER) != 0;
    if (have_kbd && !host.keyboard) {
        host.keyboard = wl_seat_get_keyboard(host.seat);
        if (host.keyboard) {
            tabbed_log(TABBED_LOG_DEBUG, "[seat] re-gained keyboard\n");
            wl_keyboard_add_listener(host.keyboard, &host_kbd_listener, NULL);
        }
    } else if (!have_kbd && host.keyboard) {
        wl_keyboard_release(host.keyboard);
        host.keyboard = NULL;
        tabbed_log(TABBED_LOG_DEBUG, "[seat] keyboard capability lost\n");
    }
    if (have_ptr && !host.pointer) {
        host.pointer = wl_seat_get_pointer(host.seat);
        if (host.pointer) {
            tabbed_log(TABBED_LOG_DEBUG, "[seat] re-gained pointer\n");
            wl_pointer_add_listener(host.pointer, &host_ptr_listener, NULL);
        }
    } else if (!have_ptr && host.pointer) {
        wl_pointer_release(host.pointer);
        host.pointer = NULL;
        tabbed_log(TABBED_LOG_DEBUG, "[seat] pointer capability lost\n");
    }
}

/* ===================== Host init / EGL ===================== */

static bool host_init(void) {
    const char *disp = getenv("WAYLAND_DISPLAY");
    if (!disp)
        disp = "wayland-0";
    host.display = wl_display_connect(NULL);
    if (!host.display) {
        fprintf(stderr, "tabbed-wlroots: cannot connect to host compositor "
                "(WAYLAND_DISPLAY=%s). Run me inside a running Wayland session.\n",
                disp);
        return false;
    }

    host.registry = wl_display_get_registry(host.display);
    wl_registry_add_listener(host.registry, &host_registry_listener, NULL);
    wl_display_roundtrip(host.display);
    host.registry_synced = true;

    if (!host.compositor || !host.wm_base) {
        fprintf(stderr, "tabbed-wlroots: host lacks compositor/xdg_wm_base\n");
        return false;
    }

    host.surface = wl_compositor_create_surface(host.compositor);
    host.xdg_surface = xdg_wm_base_get_xdg_surface(host.wm_base, host.surface);
    host.toplevel = xdg_surface_get_toplevel(host.xdg_surface);
    xdg_toplevel_set_title(host.toplevel, "tabbed-wlroots");
    if (host.decoration) {
        /* Ask the host compositor (labwc) for a server-side title bar, so
           the nested window always has a host-drawn decoration above our
           own tab content (including full-bleed clients like the test). */
        host.decoration_obj = zxdg_decoration_manager_v1_get_toplevel_decoration(
            host.decoration, host.toplevel);
        zxdg_toplevel_decoration_v1_add_listener(host.decoration_obj,
            &host_decoration_listener, NULL);
        zxdg_toplevel_decoration_v1_set_mode(host.decoration_obj,
            ZXDG_TOPLEVEL_DECORATION_V1_MODE_SERVER_SIDE);
    }
    xdg_surface_add_listener(host.xdg_surface, &host_xdg_surface_listener, NULL);
    xdg_toplevel_add_listener(host.toplevel, &host_xdg_toplevel_listener, NULL);
    xdg_wm_base_add_listener(host.wm_base, &host_xdg_wm_listener, NULL);
    wl_surface_commit(host.surface);
    wl_display_roundtrip(host.display);

    /* Host keyboard/pointer are created by the seat capabilities handler
       during the registry round-trip above; nothing more to fetch here. */
    bridge_init();

    /* Try EGL on the host wayland platform */
    pfn_eglGetPlatformDisplayEXT = (PFNEGLGETPLATFORMDISPLAYEXTPROC)
        eglGetProcAddress("eglGetPlatformDisplayEXT");
    if (!pfn_eglGetPlatformDisplayEXT) {
        fprintf(stderr, "tabbed-wlroots: no EGL platform support; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }

    host.egl_display = pfn_eglGetPlatformDisplayEXT(EGL_PLATFORM_WAYLAND_EXT,
                                                    host.display, NULL);
    if (host.egl_display == EGL_NO_DISPLAY) {
        fprintf(stderr, "tabbed-wlroots: EGL display failed; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }
    if (!eglInitialize(host.egl_display, NULL, NULL)) {
        fprintf(stderr, "tabbed-wlroots: eglInitialize failed; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }

    eglBindAPI(EGL_OPENGL_ES_API);

    const EGLint config_attribs[] = {
        EGL_SURFACE_TYPE, EGL_WINDOW_BIT,
        EGL_RENDERABLE_TYPE, EGL_OPENGL_ES2_BIT,
        EGL_RED_SIZE, 8,
        EGL_GREEN_SIZE, 8,
        EGL_BLUE_SIZE, 8,
        EGL_ALPHA_SIZE, 0,
        EGL_NONE
    };
    EGLint ncfg = 0;
    if (!eglChooseConfig(host.egl_display, config_attribs, &host.egl_config,
                         1, &ncfg) || ncfg < 1) {
        fprintf(stderr, "tabbed-wlroots: no EGL config; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    const EGLint ctx_attribs[] = {
        EGL_CONTEXT_CLIENT_VERSION, 2,
        EGL_NONE
    };
    host.egl_context = eglCreateContext(host.egl_display, host.egl_config,
                                        EGL_NO_CONTEXT, ctx_attribs);
    if (host.egl_context == EGL_NO_CONTEXT) {
        fprintf(stderr, "tabbed-wlroots: EGL context failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    host.width = 1280;
    host.height = 800;
    host.egl_window = wl_egl_window_create(host.surface, host.width, host.height);
    host.egl_surface = eglCreateWindowSurface(host.egl_display, host.egl_config,
                                              (EGLNativeWindowType)host.egl_window, NULL);
    if (host.egl_surface == EGL_NO_SURFACE) {
        fprintf(stderr, "tabbed-wlroots: EGL window surface failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    if (!eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                        host.egl_context)) {
        fprintf(stderr, "tabbed-wlroots: eglMakeCurrent failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }
    eglSwapInterval(host.egl_display, 0);

    pfn_eglCreateImageKHR = (PFNEGLCREATEIMAGEKHRPROC)egl_proc("eglCreateImageKHR");
    pfn_eglDestroyImageKHR = (PFNEGLDESTROYIMAGEKHRPROC)egl_proc("eglDestroyImageKHR");
    pfn_glEGLImageTargetTexture2DOES = (PFNGLEGLIMAGETARGETTEXTURE2DOESPROC)
        egl_proc("glEGLImageTargetTexture2DOES");

    if (!gl_setup()) {
        fprintf(stderr, "tabbed-wlroots: GL setup failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }
    overlay_font_init();

    host.egl_ok = true;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: EGL (GPU) rendering enabled\n");
    return true;
}

/* ===================== Scene buffer -> host blit ===================== */

static bool import_scene_buffer(struct wlr_buffer *buf, GLuint tex) {
    struct wlr_dmabuf_attributes attrs;
    if (wlr_buffer_get_dmabuf(buf, &attrs)) {
        if (attrs.n_planes < 1) return false;

        EGLint att[48];
        int n = 0;
        att[n++] = EGL_WIDTH;  att[n++] = attrs.width;
        att[n++] = EGL_HEIGHT; att[n++] = attrs.height;
        att[n++] = EGL_LINUX_DRM_FOURCC_EXT; att[n++] = (EGLint)attrs.format;
        for (int p = 0; p < attrs.n_planes; p++) {
            att[n++] = EGL_DMA_BUF_PLANE0_FD_EXT + p * 3;     att[n++] = attrs.fd[p];
            att[n++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT + p * 3; att[n++] = (EGLint)attrs.offset[p];
            att[n++] = EGL_DMA_BUF_PLANE0_PITCH_EXT + p * 3;  att[n++] = (EGLint)attrs.stride[p];
        }
        if (attrs.modifier != DRM_FORMAT_MOD_INVALID) {
            att[n++] = EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT;
            att[n++] = (EGLint)(attrs.modifier & 0xffffffff);
            att[n++] = EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT;
            att[n++] = (EGLint)(attrs.modifier >> 32);
        }
        att[n++] = EGL_NONE;

        EGLImageKHR img = pfn_eglCreateImageKHR(host.egl_display, EGL_NO_CONTEXT,
                                                EGL_LINUX_DMA_BUF_EXT,
                                                (EGLClientBuffer)NULL, att);
        if (img == EGL_NO_IMAGE_KHR) {
            tabbed_log(TABBED_LOG_DEBUG, "[import] eglCreateImageKHR failed "
                    "(format 0x%x modifier 0x%llx)\n", attrs.format,
                    (unsigned long long)attrs.modifier);
            return false;
        }
        glBindTexture(GL_TEXTURE_2D, tex);
        pfn_glEGLImageTargetTexture2DOES(GL_TEXTURE_2D, img);
        pfn_eglDestroyImageKHR(host.egl_display, img);
        return true;
    }

    /* Fallback for non-dmabuf buffers (on a headless backend the allocator
       yields shm buffers). Upload via CPU read so shm clients and the shm
       swapchain both render into the host window. */
    void *data;
    uint32_t fmt;
    size_t stride;
    if (!wlr_buffer_begin_data_ptr_access(buf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                                          &data, &fmt, &stride)) {
        tabbed_log(TABBED_LOG_DEBUG, "[import] buffer is neither dmabuf nor "
                "CPU-readable\n");
        return false;
    }
    glBindTexture(GL_TEXTURE_2D, tex);
    glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
    switch (fmt) {
    case DRM_FORMAT_XRGB8888:
    case DRM_FORMAT_ARGB8888:
        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, buf->width, buf->height, 0,
                     GL_BGRA_EXT, GL_UNSIGNED_BYTE, data);
        break;
    default:
        tabbed_log(TABBED_LOG_DEBUG, "[import] unsupported CPU fallback format "
                "0x%x\n", fmt);
        wlr_buffer_end_data_ptr_access(buf);
        return false;
    }
    wlr_buffer_end_data_ptr_access(buf);
    return true;
}

/* Pace presents to the host compositor: this fires after the host has shown
   the buffer we queued, so we know we may queue the next one. Any frame drawn
   while a present is still pending is coalesced into the back buffer and
   presented here, keeping exactly one outstanding buffer (no burst, no
   tearing on busy repainters like terminals). */
static const struct wl_callback_listener host_frame_listener;
/* Request a host frame callback and present the drawing in the back buffer.
   The callback must be requested *before* the swap: frame requests are part
   of the state committed by eglSwapBuffers, so requesting it after would wait
   on a commit that never comes. */
static void present_to_host(void) {
    host.frame_cb = wl_surface_frame(host.surface);
    wl_callback_add_listener(host.frame_cb, &host_frame_listener, NULL);
    eglSwapBuffers(host.egl_display, host.egl_surface);
    host.present_pending = true;
}

static void host_frame_done(void *data, struct wl_callback *callback,
                            uint32_t callback_data)
{
    (void)data; (void)callback; (void)callback_data;
    if (host.frame_cb) {
        wl_callback_destroy(host.frame_cb);
        host.frame_cb = NULL;
    }
    host.present_pending = false;

    if (host.back_dirty) {
        host.back_dirty = false;
        present_to_host();
    }
}

static const struct wl_callback_listener host_frame_listener = {
    .done = host_frame_done,
};

/* The scene is rendered by the wlroots GLES2 renderer, which owns its own
   EGL display/context, while we sample that buffer from a *different* EGL
   context (host.egl_display). Without an explicit barrier the GPU may still
   be executing the renderer's draw commands when we import+read the dmabuf,
   which shows as flicker/tearing on content that repaints continuously.
   Make the renderer's context current on this thread and glFinish() so the
   buffer is guaranteed fully rendered before we blit it. */
static void sync_renderer_context(void) {
    struct wlr_egl *src = wlr_gles2_renderer_get_egl(server.renderer);
    if (!src) return;
    EGLDisplay d = wlr_egl_get_display(src);
    EGLContext c = wlr_egl_get_context(src);
    if (d == EGL_NO_DISPLAY || c == EGL_NO_CONTEXT) return;
    if (d == host.egl_display && c == host.egl_context) return;
    eglMakeCurrent(d, EGL_NO_SURFACE, EGL_NO_SURFACE, c);
    glFinish();
    eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                   host.egl_context);
}

static void blit_scene_buffer(struct wlr_buffer *buf) {
    int w = host.width, h = host.height;
    glViewport(0, 0, w, h);
    glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
    glClear(GL_COLOR_BUFFER_BIT);

    bool imported = buf && import_scene_buffer(buf, host.import_tex);
    if (imported) {
        static const GLfloat white[4] = { 1, 1, 1, 1 };
        glEnable(GL_BLEND);
        glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
        draw_texture_rect(host.import_tex, buf->width, buf->height,
                          0, 0, buf->width, buf->height, 0, 0,
                          buf->width, buf->height, w, h, white);
        draw_tab_overlay();
        glDisable(GL_BLEND);
    }
    if (dump_host_req) {
        dump_host_req = false;
        dump_host_back();
    }

    if (!imported) {
        /* Never present a frame that is only the clear colour: keep the last
           good frame on the host. A later frame with a good import presents
           normally. */
        return;
    }

    if (host.present_pending) {
        /* Host hasn't shown the previous buffer yet: redraw into the back
           buffer and coalesce the swap until the frame callback arrives. */
        host.back_dirty = true;
    } else {
        present_to_host();
    }
}

/* Standalone (native-output) frame: composite the scene into our swapchain,
   then draw the Alt overlay as a second pass on the same buffer from wlr
   textures.  There is no host EGL surface to blit to and no host frame-call
   pacing; the native output's own commit drives presentation. */
static void render_standalone(void) {
    if (!server.scene_output || !server.swapchain) return;

    struct wlr_scene_output_state_options options = {
        .swapchain = server.swapchain,
    };
    struct wlr_output_state state;
    wlr_output_state_init(&state);
    bool rendered = wlr_scene_output_build_state(server.scene_output, &state,
                                                 &options);
    if (!rendered || !state.buffer) {
        tabbed_log(TABBED_LOG_DEBUG, "[render] build_state failed\n");
        wlr_output_state_finish(&state);
        goto frame_done;
    }

    if (dump_scene_req) {
        dump_scene_req = false;
        dump_scene_buffer(state.buffer);
    }

    if (host.overlay_visible) {
        struct wlr_render_pass *pass = wlr_renderer_begin_buffer_pass(
            server.renderer, state.buffer, NULL);
        if (pass) {
            draw_tab_overlay_pass(pass);
            wlr_render_pass_submit(pass);
        }
    }

    if (dump_host_req) {
        dump_host_req = false;
        dump_standalone_buffer(state.buffer);
    }

    if (!wlr_output_commit_state(server.output, &state))
        tabbed_log(TABBED_LOG_DEBUG, "[render] output commit failed\n");

frame_done:
    struct timespec now;
    clock_gettime(CLOCK_MONOTONIC, &now);
    wlr_scene_output_send_frame_done(server.scene_output, &now);

    wlr_output_state_finish(&state);
}

static void render_and_present(void) {
    if (server.standalone) {
        render_standalone();
        return;
    }
    if (!host.egl_ok || !host.configured) return;
    if (!server.scene_output || !server.swapchain) return;

    struct wlr_scene_output_state_options options = {
        .swapchain = server.swapchain,
    };
    struct wlr_output_state state;
    wlr_output_state_init(&state);
    bool rendered = wlr_scene_output_build_state(server.scene_output, &state,
                                                 &options);
    if (!rendered || !state.buffer) {
        tabbed_log(TABBED_LOG_DEBUG, "[render] build_state failed\n");
        wlr_output_state_finish(&state);
        goto frame_done;
    }

    /* [diag] What did wlroots composite? A swapchain-sized buffer means we
       composited the scene; anything else implies direct scanout of a client
       buffer (which our blit may or may not import). */
    if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        struct wlr_output *out = server.output;
        tabbed_log(TABBED_LOG_DEBUG, "[diag] frame buffer %dx%d (output %dx%d)\n",
                state.buffer->width, state.buffer->height,
                out ? out->width : 0, out ? out->height : 0);
    }

    /* Barrier between the wlr renderer's context and our host blit. */
    sync_renderer_context();

    if (dump_scene_req) {
        dump_scene_req = false;
        dump_scene_buffer(state.buffer);
    }

    static int autodump = -1;
    if (autodump < 0)
        autodump = getenv("TABBED_AUTODUMP") ? 1 : 0;
    if (autodump > 0 && client_dumped && --autodump == 0) {
        dump_scene_req = true;
        dump_host_req = true;
    }

    blit_scene_buffer(state.buffer);

    if (!wlr_output_commit_state(server.output, &state))
        tabbed_log(TABBED_LOG_DEBUG, "[render] output commit failed\n");

frame_done:
    struct timespec now;
    clock_gettime(CLOCK_MONOTONIC, &now);
    wlr_scene_output_send_frame_done(server.scene_output, &now);

    wlr_output_state_finish(&state);
}

/* ===================== Launch client ===================== */

/* Does the first whitespace-delimited word of `cmd` resolve to an executable
   on PATH?  Mirrors how `sh -c <cmd>` resolves the first word, so this is a
   cheap pre-launch "which" check.  Returns 1 if found (or uncheckable, e.g.
   a word too long or no PATH), 0 if the word is definitely missing. */
static int cmd_in_path(const char *cmd) {
    while (*cmd == ' ' || *cmd == '\t')
        cmd++;
    const char *p = cmd;
    while (*p && *p != ' ' && *p != '\t' && *p != '\n')
        p++;
    if (p == cmd)
        return 0;
    char word[256];
    size_t n = (size_t)(p - cmd);
    if (n >= sizeof(word))
        return 1;   /* give up on absurdly long commands */
    memcpy(word, cmd, n);
    word[n] = '\0';

    if (strchr(word, '/'))
        return access(word, X_OK) == 0;

    const char *path_env = getenv("PATH");
    if (!path_env) path_env = "/usr/local/bin:/usr/bin:/bin";
    char buf[512];
    for (const char *d = path_env; d && *d; ) {
        const char *colon = strchr(d, ':');
        size_t len = colon ? (size_t)(colon - d) : strlen(d);
        if (len == 0) {
            len = 1;
            buf[0] = '.';
        } else {
            if (len + 1 + n >= sizeof(buf)) {
                if (colon) d = colon + 1; else d = NULL;
                continue;
            }
            memcpy(buf, d, len);
            buf[len] = '/';
        }
        memcpy(buf + len + 1, word, n);
        buf[len + 1 + n] = '\0';
        if (access(buf, X_OK) == 0)
            return 1;
        if (colon) d = colon + 1; else d = NULL;
    }
    return 0;
}

static void launch_client(struct tabbed_app *app) {
    pid_t pid = fork();
    if (pid == 0) {
        /* Own process group so we can kill the whole client tree on exit. */
        setpgid(0, 0);
        const char *xdg_runtime = getenv("XDG_RUNTIME_DIR");
        if (!xdg_runtime) xdg_runtime = "/tmp";
        setenv("WAYLAND_DISPLAY", tabbed_socket, 1);
        setenv("XDG_RUNTIME_DIR", xdg_runtime, 1);
        setenv("GDK_BACKEND", "wayland", 1);
        setenv("QT_QPA_PLATFORM", "wayland", 1);
        unsetenv("DISPLAY");
        /* Unless debugging, don't let client chatter spill onto the launching
           terminal; the client inherits our stdout/stderr. */
        if (tabbed_log_level() < TABBED_LOG_DEBUG) {
            int nullfd = open("/dev/null", O_WRONLY);
            if (nullfd >= 0) {
                dup2(nullfd, STDOUT_FILENO);
                dup2(nullfd, STDERR_FILENO);
                if (nullfd > STDERR_FILENO) close(nullfd);
            }
        }
        execlp("/bin/sh", "sh", "-c", app->cmd, NULL);
        _exit(127);
    }
    if (pid > 0) {
        app->pid = pid;
        tabbed_log(TABBED_LOG_INFO, "[launch] app=%d pid=%d cmd=%s\n",
                app_index(app), pid, app->cmd);
    }
}

/* Fork every command-line command at startup, in command-line order.  Each
   slot keeps its position because handle_new_toplevel claims it by process
   group (launch_client runs each command in its own setpgid'd group, whose
   id equals app->pid), so the tab order mirrors the command line no matter
   which client connects first.  A command that never connects leaves its
   tab black; a command whose process group exits without ever connecting is
   swept away later (see sweep_dead_startup_groups). */
static void launch_all_cli(void) {
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *a = server.apps[i];
        if (a->origin != ORIGIN_CLI) continue;
        launch_client(a);
    }
}

/* Drop black tabs whose command's whole process group has exited (e.g.
   `tabbed-wlroots /bin/false` -- sh runs false, the group empties, and the
   tab would otherwise stay black forever).  Runs from the main loop after a
   SIGCHLD, never from the handler: it frees slots.  Group liveness, not the
   launcher pid's, decides: `sh -c "cmd &"` returns while cmd is still
   starting, but cmd holds the group open, so kill(-groupid,0) succeeds and
   the tab survives. */
static void sweep_dead_startup_groups(void) {
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *a = server.apps[i];
        if (a->toplevel || !a->pending_claim || a->closing || a->pid <= 0)
            continue;
        errno = 0;
        if (kill(-a->pid, 0) == 0 || errno == EPERM)
            continue;   /* the group still has a member */
        if (errno != ESRCH)
            continue;
        if (server.active_app == a) {
            server.active_app = NULL;
            struct tabbed_app *succ = pick_successor(a, -1);
            if (!succ) succ = pick_successor(a, +1);
            if (succ)
                set_active_app(succ);
            else {
                /* the last tab died before ever connecting: tear down */
                if (host.toplevel) xdg_toplevel_destroy(host.toplevel);
                if (host.surface) wl_surface_destroy(host.surface);
                shutdown_cleanup();
                exit(0);
            }
        }
        tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: dropping tab %d (pid %d) "
                "-- command exited without connecting\n", i, (int)a->pid);
        remove_app(i);
        i--;
    }
    /* If the sweep's succession handed active to a slot that this same pass
       then removed, put the crown back on some live tab (or nothing). */
    if (!server.active_app) {
        struct tabbed_app *succ = NULL;
        for (int i = 0; i < server.num_apps; i++)
            if (app_live(server.apps[i]) && !server.apps[i]->closing) {
                succ = server.apps[i];
                break;
            }
        if (succ)
            set_active_app(succ);
    }
}

/* Drain the SIGCHLD latch and reap dead startup groups; called from both
   event loops after each dispatch. */
static void sweep_dead_startup(void) {
    if (!sigchld_seen) return;
    sigchld_seen = 0;
    sweep_dead_startup_groups();
}

/* Add a new tab launching `cmd` and start it, exactly as if `cmd` had been
   given as a command-line argument.  The tab is inserted in the slot order
   right after the currently active tab (falling back to the far right if
   none is active), so the new tab sits to its right in the cycle.  Returns
   the new app index, or -1 on allocation failure. */
static int add_tab(const char *cmd) {
    if (apps_ensure_cap(server.num_apps + 1) != 0) return -1;
    struct tabbed_app *app = calloc(1, sizeof(*app));
    if (!app) return -1;
    app->cmd = strdup(cmd);
    app->pid = -1;
    app->pending_claim = true;
    app->origin = ORIGIN_ADD_TAB;

    /* Anchor on the active slot itself, not its toplevel: while the active
       tab is still black (its client has not connected yet) it has no
       toplevel, so anchoring on the toplevel would append the new terminal
       far right instead of beside the current tab. */
    insert_app_after(app, server.active_app);
    int idx = app_index(app);
    launch_client(app);
    return idx;
}

/* ===================== Crash handler ===================== */

static void crash_handler(int sig, siginfo_t *info, void *ctx) {
    (void)sig; (void)info; (void)ctx;
    void *bt[64];
    int n = backtrace(bt, 64);
    write(2, "\n=== BACKTRACE ===\n", 19);
    backtrace_symbols_fd(bt, n, 2);
    remove_socket_file();
    _exit(139);
}

static void sigchld_handler(int sig) {
    (void)sig;
    sigchld_seen = 1;
    int status;
    pid_t pid;
    if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        /* snprintf()/write() are async-signal-safe; fprintf() is not (it
           takes the FILE lock, which can deadlock if we interrupt a logging
           fprintf in the main loop). */
        char buf[64];
        while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
            int n = snprintf(buf, sizeof(buf),
                             "[child] pid %d exited status 0x%x\n", pid, status);
            if (n > 0 && (size_t)n < sizeof(buf))
                (void)!write(STDERR_FILENO, buf, (size_t)n);
        }
    } else {
        while (waitpid(-1, &status, WNOHANG) > 0)
            ;
    }
}

/* On SIGTERM or Ctrl-C (SIGINT), take down the clients and exit cleanly
   rather than leaving them orphaned when the compositor dies.  The clients
   live in their own process groups, so a terminal Ctrl-C only reaches us.

   These signals are delivered through the event loop (wl_event_loop_add_signal
   in main) rather than a raw sigaction handler: the full teardown calls
   malloc/free and libwayland proxy destroys, which are not async-signal-safe
   and deadlock if the signal interrupts fork()/malloc()/logging (observed:
   SIGTERM landing inside launch_client's fork() left libc's allocator lock
   held, and shutdown_cleanup() -> bridge_cleanup() -> calloc() blocked on it
   forever).  Running it from a normal loop callback makes that impossible. */
static int close_signal_cb(int sig, void *data) {
    (void)sig;
    (void)data;
    shutdown_cleanup();
    _exit(0);
    return 0;
}

/* SIGUSR1: save the current scene buffer and host back buffer on the next
   frame, for inspecting what the client has actually drawn so far. */
static void sigusr1_handler(int sig) {
    (void)sig;
    dump_scene_req = 1;
    dump_host_req = 1;
    needs_redraw = 1;
}

/* Does the comma-separated WLR_BACKENDS list contain `name`? */
static bool backends_include(const char *env, const char *name) {
    size_t len = strlen(name);
    for (const char *p = env; p && *p; ) {
        const char *comma = strchr(p, ',');
        size_t n = comma ? (size_t)(comma - p) : strlen(p);
        if (n == len && strncmp(p, name, len) == 0)
            return true;
        p = comma ? comma + 1 : NULL;
    }
    return false;
}

/* ===================== Main ===================== */

/* Parse a --screen-mode value: WxH or WxH@Hz (the Hz is matched at the
   mode's mHz precision, so "60" == 60.000).  Stores into mode_req_w/h/
   refresh; returns false on a malformed value. */
static bool parse_screen_mode(const char *val) {
    int w = 0, h = 0;
    const char *p = val;
    for (; *p >= '0' && *p <= '9'; p++)
        w = w * 10 + (*p - '0');
    if (*p != 'x')
        return false;
    p++;
    for (; *p >= '0' && *p <= '9'; p++)
        h = h * 10 + (*p - '0');
    if (w <= 0 || h <= 0)
        return false;
    unsigned refresh_mhz = 0;
    if (*p == '@') {
        char *end = NULL;
        double hz = strtod(p + 1, &end);
        if (end == p + 1 || hz <= 0.0 || *end != '\0')
            return false;
        refresh_mhz = (unsigned)(hz * 1000.0 + 0.5);
    } else if (*p != '\0') {
        return false;
    }
    mode_req_w = w;
    mode_req_h = h;
    mode_req_refresh = (int)refresh_mhz;
    return true;
}

int main(int argc, char *argv[]) {
    snprintf(tabbed_socket, sizeof(tabbed_socket), "tabbed-wayland-%d",
             (int)getpid());
    const char *runtime = getenv("XDG_RUNTIME_DIR");
    if (!runtime) runtime = "/tmp";
    snprintf(socket_path, sizeof(socket_path), "%s/%s", runtime, tabbed_socket);
    /* Clear a stale leftover (e.g. from a crashed previous run with the same
       name) before we try to bind; harmless if there is none. */
    remove_socket_file();

    /* Resolve TABBED_LOG up front so signal handlers can read the cached
       level without touching non-async-signal-safe functions. */
    tabbed_log_level_init();

    /* TABBED_SYNTH_INPUT: keep real host keyboard events out of the test
       channel so the stdin feed is the only source of key/modifier input. */
    {
        const char *v = getenv("TABBED_SYNTH_INPUT");
        synth_input_only = v && v[0] && v[0] != '0';
    }

    /* Alt+Shift+T opens a terminal named by $TERMINAL when set, else the
       alacritty default.  Every command-line argument is one tab launcher,
       except --screen-mode WxH[@Hz], which selects the native output mode and
       is consumed here, --modifier alt|super, which picks the modifier
       prefix for the tab-management chords, and --start-cmd-index N, which
       picks the command (1-based) that starts focused.  Handle all of this up
       front so a missing command (or a bad request) can be reported and the
       process can exit before any window is created. */
    {
        const char *env_term = getenv("TERMINAL");
        if (env_term && env_term[0])
            term_cmd = env_term;
    }
    char **appv = calloc((size_t)argc, sizeof(*appv));
    if (!appv) {
        fprintf(stderr, "tabbed-wlroots: out of memory\n");
        return 1;
    }
    int napps = 0;
    for (int i = 1; i < argc; i++) {
        if (strcmp(argv[i], "-h") == 0 || strcmp(argv[i], "--help") == 0) {
            fprintf(stderr,
                    "usage: %s [--screen-mode WxH[@Hz]] [--modifier alt|super] "
                    "[--start-cmd-index N] [prog...]\n"
                    "       Select the native output mode (standalone only): "
                    "e.g. --screen-mode 1920x1080\n"
                    "       or --screen-mode 1920x1080@60.  A request nothing "
                    "supports prints every mode and exits.\n"
                    "       --modifier picks the tab-management modifier "
                    "(default alt); 'super' suits standalone/DRM and "
                    "labwc-style hosts.\n"
                    "       --start-cmd-index picks the command (1-based) that "
                    "starts focused; without it the last command does.\n"
                    "       Each <prog> is one shell command; quote it when it "
                    "takes args, e.g. \"firefox -no-remote\".\n"
                    "       With no arguments, a single terminal tab opens "
                    "($TERMINAL, default alacritty).\n"
                    "       -h / --help print this help.\n", argv[0]);
            free(appv);
            return 0;
        }
        const char *val = NULL;
        if (strcmp(argv[i], "--screen-mode") == 0) {
            if (i + 1 >= argc) {
                fprintf(stderr, "tabbed-wlroots: --screen-mode needs a value, "
                        "e.g. --screen-mode 1920x1080\n");
                free(appv);
                return 2;
            }
            val = argv[++i];
        } else if (strncmp(argv[i], "--screen-mode=", 14) == 0) {
            val = argv[i] + 14;
        } else if (strcmp(argv[i], "--modifier") == 0) {
            if (i + 1 >= argc) {
                fprintf(stderr, "tabbed-wlroots: --modifier needs a value, "
                        "e.g. --modifier super\n");
                free(appv);
                return 2;
            }
            const char *m = argv[++i];
            if (strcmp(m, "alt") == 0) {
                tab_prefix = PREFIX_ALT;
            } else if (strcmp(m, "super") == 0) {
                tab_prefix = PREFIX_SUPER;
            } else {
                fprintf(stderr, "tabbed-wlroots: bad --modifier '%s' "
                        "(use 'alt' or 'super')\n", m);
                free(appv);
                return 2;
            }
            continue;
        } else if (strncmp(argv[i], "--modifier=", 11) == 0) {
            const char *m = argv[i] + 11;
            if (strcmp(m, "alt") == 0) {
                tab_prefix = PREFIX_ALT;
            } else if (strcmp(m, "super") == 0) {
                tab_prefix = PREFIX_SUPER;
            } else {
                fprintf(stderr, "tabbed-wlroots: bad --modifier '%s' "
                        "(use 'alt' or 'super')\n", m);
                free(appv);
                return 2;
            }
            continue;
        } else if (strcmp(argv[i], "--start-cmd-index") == 0) {
            if (i + 1 >= argc) {
                fprintf(stderr, "tabbed-wlroots: --start-cmd-index needs a "
                        "value, e.g. --start-cmd-index 2\n");
                free(appv);
                return 2;
            }
            const char *n = argv[++i];
            char *end = NULL;
            long idx = strtol(n, &end, 10);
            if (end == n || *end != '\0' || idx < 1 || idx > 2147483647L) {
                fprintf(stderr, "tabbed-wlroots: bad --start-cmd-index '%s' "
                        "(use a 1-based command number, e.g. --start-cmd-index "
                        "2)\n", n);
                free(appv);
                return 2;
            }
            /* Convert to the program's 0-based index as soon as possible. */
            start_cmd_index = (int)idx - 1;
            continue;
        } else if (strncmp(argv[i], "--start-cmd-index=",
                           sizeof("--start-cmd-index=") - 1) == 0) {
            const char *n = argv[i] + sizeof("--start-cmd-index=") - 1;
            char *end = NULL;
            long idx = strtol(n, &end, 10);
            if (end == n || *end != '\0' || idx < 1 || idx > 2147483647L) {
                fprintf(stderr, "tabbed-wlroots: bad --start-cmd-index '%s' "
                        "(use a 1-based command number)\n", n);
                free(appv);
                return 2;
            }
            start_cmd_index = (int)idx - 1;
            continue;
        }
        if (val) {
            if (!parse_screen_mode(val)) {
                fprintf(stderr, "tabbed-wlroots: bad --screen-mode '%s' "
                        "(use WxH or WxH@Hz, e.g. 1920x1080 or "
                        "1920x1080@60)\n", val);
                free(appv);
                return 2;
            }
            continue;
        }
        appv[napps++] = argv[i];
    }
    int total_apps = napps;
    bool default_tab = false;
    if (total_apps == 0) {
        /* No arguments: open one terminal tab, as Alt+Shift+T would. */
        default_tab = true;
        total_apps = 1;
    }
    if (start_cmd_index >= 0 && start_cmd_index >= total_apps) {
        fprintf(stderr, "tabbed-wlroots: --start-cmd-index %d is out of range: "
                "1..%d (%d command%s)\n", start_cmd_index + 1, total_apps,
                total_apps, total_apps == 1 ? "" : "s");
        free(appv);
        return 2;
    }
    for (int i = 0; i < total_apps; i++) {
        const char *cmd = default_tab ? term_cmd : appv[i];
        if (!cmd_in_path(cmd)) {
            fprintf(stderr, "tabbed-wlroots: '%s' not found in PATH%s\n",
                    cmd, default_tab ? " (set $TERMINAL)" : "");
            free(appv);
            return 1;
        }
    }

    struct sigaction crash_sa = {
        .sa_sigaction = crash_handler,
        .sa_flags = SA_SIGINFO | SA_NODEFER,
    };
    sigaction(SIGSEGV, &crash_sa, NULL);
    sigaction(SIGABRT, &crash_sa, NULL);
    signal(SIGCHLD, sigchld_handler);
    signal(SIGUSR1, sigusr1_handler);

    /* wlroots logs follow TABBED_LOG: quiet keeps only errors, info drops
       protocol noise, debug shows everything. */
    switch (tabbed_log_level()) {
    case TABBED_LOG_DEBUG:
        wlr_log_init(WLR_DEBUG, NULL);
        break;
    case TABBED_LOG_INFO:
        wlr_log_init(WLR_INFO, NULL);
        break;
    default:
        wlr_log_init(WLR_ERROR, NULL);
        break;
    }

    /* Mode selection: TABBED_MODE=standalone (or any forced WLR_BACKENDS)
       drives a native output directly (DRM, or headless for tests); the
       default nested mode blits a headless output into a host window. */
    server.standalone = false;
    {
        const char *mode = getenv("TABBED_MODE");
        const char *wlr_backends = getenv("WLR_BACKENDS");
        if (mode && strcmp(mode, "standalone") == 0)
            server.standalone = true;
        if (wlr_backends && wlr_backends[0])
            server.standalone = true;
    }

    server.wl_display = wl_display_create();
    if (!server.wl_display) {
        fprintf(stderr, "tabbed-wlroots: failed to create Wayland display\n");
        return 1;
    }
    server.loop = wl_display_get_event_loop(server.wl_display);
    wl_list_init(&server.kbdevs);
    wl_list_init(&server.ptrdevs);

    /* Route SIGTERM/SIGINT through the event loop (signalfd) so shutdown runs
       in normal context; see close_signal_cb for why a raw handler is unsafe. */
    wl_event_loop_add_signal(server.loop, SIGTERM, close_signal_cb, NULL);
    wl_event_loop_add_signal(server.loop, SIGINT, close_signal_cb, NULL);

    /* stdin event feed: lets tests/drivers inject raw keyboard events
       into the real host key handlers without a host compositor. */
    server.ctl_source = wl_event_loop_add_fd(server.loop, STDIN_FILENO,
                                             WL_EVENT_READABLE,
                                             ctl_cb, NULL);

    if (server.standalone) {
        /* autocreate honours WLR_BACKENDS and otherwise picks the current
           session's wayland/x11 backend (we run inside some compositor
           elsewhere), so force DRM+libinput unless told otherwise. */
        const char *wlr_backends = getenv("WLR_BACKENDS");
        if (!wlr_backends || !wlr_backends[0]) {
            wlr_backends = "drm,libinput";
            setenv("WLR_BACKENDS", wlr_backends, 1);
        }
        server.standalone_headless = backends_include(wlr_backends, "headless");
        /* autocreate wraps every backend in a wlr_multi_backend, which breaks
           the plain headless backend's manual wlr_headless_add_output() below
           (it asserts wlr_backend_is_headless()), so create the headless
           backend directly instead. */
        if (server.standalone_headless)
            server.backend = wlr_headless_backend_create(server.loop);
        else
            server.backend = wlr_backend_autocreate(server.loop, &server.session);
    } else {
        server.backend = wlr_headless_backend_create(server.loop);
    }
    if (!server.backend) {
        fprintf(stderr, "tabbed-wlroots: failed to create %s backend\n",
                server.standalone ? "backend (autocreate)"
                                  : "headless backend");
        return 1;
    }

    server.renderer = wlr_renderer_autocreate(server.backend);
    if (!server.renderer) {
        fprintf(stderr, "tabbed-wlroots: no GPU renderer available\n");
        return 1;
    }
    wlr_renderer_init_wl_display(server.renderer, server.wl_display);

    /* Standalone has no host EGL context: build the overlay glyph atlas with
       the wlr renderer instead (nested mode does this inside init_egl()). */
    if (server.standalone)
        overlay_font_init();

    server.allocator = wlr_allocator_autocreate(server.backend, server.renderer);
    if (!server.allocator) {
        fprintf(stderr, "tabbed-wlroots: failed to create allocator\n");
        return 1;
    }

    /* wl_surface at v4: legacy clients (e.g. VLC's Wayland vout) place video
       via non-zero wl_surface.attach offsets, which is a protocol violation
       from v5 on. Advertise v4 so those offsets are accepted and ignored,
       like before the v5 breaking change. */
    wlr_compositor_create(server.wl_display, 4, server.renderer);
    wlr_subcompositor_create(server.wl_display);
    wlr_shm_create_with_renderer(server.wl_display, 1, server.renderer);
    wlr_linux_dmabuf_v1_create_with_renderer(server.wl_display, 5, server.renderer);
    wlr_data_device_manager_create(server.wl_display);
    wlr_data_control_manager_v1_create(server.wl_display);

    /* Never let wlroots present a client buffer to the headless output
       directly (direct scanout). We must composite into our own swapchain so
       the nested frame is exactly what the host window shows; scanout of a
       client buffer hands us a buffer our host blit can't keep in sync and the
       window goes black (seen with Firefox). The scene field is WLR_PRIVATE,
       so the supported way is this env var, parsed at wlr_scene_create(). */
    setenv("WLR_SCENE_DISABLE_DIRECT_SCANOUT", "1", 1);

    server.scene = wlr_scene_create();
    server.xdg_shell = wlr_xdg_shell_create(server.wl_display, 6);

    server.seat = wlr_seat_create(server.wl_display, "tabbed");
    wlr_seat_set_capabilities(server.seat,
        WL_SEAT_CAPABILITY_POINTER | WL_SEAT_CAPABILITY_KEYBOARD);
    /* The request_set_selection handler is what actually performs the
       wlr_seat_set_selection for clients using the data-control manager; the
       host-forwarding it triggers is a no-op without an outer host (backend
       NONE), so standalone needs it too or wl-copy-style clipboard requests
       are silently dropped. */
    bridge_attach_seat();

    /* Standalone has no host compositor to draw a pointer, so give the
       output a real wlr_cursor.  Theme/size follow the XDG cursor convention:
       XCURSOR_THEME (default "default") and XCURSOR_SIZE (default 24px).
       wlroots resolves the theme itself (search path, Inherits chains) and,
       when nothing is installed, substitutes a builtin arrow -- so the pointer
       is never invisible.  We only report when the requested theme was
       silently swapped for the builtin. */
    if (server.standalone) {
        server.output_layout = wlr_output_layout_create(server.wl_display);
        server.cursor = wlr_cursor_create();
        if (!server.output_layout || !server.cursor) {
            fprintf(stderr,
                "tabbed-wlroots: failed to create output layout/cursor\n");
            return 1;
        }
        wlr_cursor_attach_output_layout(server.cursor, server.output_layout);

        const char *theme_env = getenv("XCURSOR_THEME");
        const char *theme = theme_env && *theme_env ? theme_env : "default";

        uint32_t size = 24;
        const char *size_env = getenv("XCURSOR_SIZE");
        if (size_env) {
            char *end = NULL;
            unsigned long v = strtoul(size_env, &end, 10);
            if (end != size_env && v > 0)
                size = (uint32_t)v;
        }

        server.xcursor_mgr = wlr_xcursor_manager_create(theme, size);
        if (server.xcursor_mgr)
            wlr_xcursor_manager_load(server.xcursor_mgr, 1);

        /* Detect the builtin from the manager's own state: wlr_xcursor_theme_load
           renames the theme object to "default" when it substitutes the builtin
           arrow (cursor_count == 0), so a mismatch with the requested name
           means the theme didn't exist on disk.  A theme literally named
           "default" is indistinguishable (the builtin adopts that name), so
           skip the warning there and only fail warm either way. */
        struct wlr_xcursor *cur = server.xcursor_mgr ?
            wlr_xcursor_manager_get_xcursor(server.xcursor_mgr, "default", 1)
            : NULL;
        if (cur && strcmp(theme, "default") != 0 &&
                !wl_list_empty(&server.xcursor_mgr->scaled_themes)) {
            struct wlr_xcursor_manager_theme *mt = wl_container_of(
                server.xcursor_mgr->scaled_themes.next, mt, link);
            if (mt->theme && mt->theme->name &&
                    strcmp(mt->theme->name, theme) != 0)
                tabbed_log(TABBED_LOG_INFO,
                    "[cursor] theme '%s' not found; wlroots builtin cursor "
                    "in use\n", theme);
        }
        if (!cur) {
            tabbed_log(TABBED_LOG_INFO,
                "[cursor] no cursor theme available; no pointer shown\n");
        } else {
            wlr_cursor_set_xcursor(server.cursor, server.xcursor_mgr, "default");
            wl_signal_add(&server.cursor->events.motion,
                          &standalone_cursor_motion_listener);
        }
    }

    /* virtual keyboard fed from the host keyboard */
    static const struct wlr_keyboard_impl keyboard_impl = {
        .name = "tabbed-keyboard",
    };
    wlr_keyboard_init(&server.keyboard, &keyboard_impl, "tabbed-keyboard");

    /* fallback keymap until the host sends one */
    server.xkb_ctx = xkb_context_new(XKB_CONTEXT_NO_FLAGS);
    if (server.xkb_ctx) {
        xkb_context_set_log_level(server.xkb_ctx, XKB_LOG_LEVEL_DEBUG);
        xkb_context_set_log_fn(server.xkb_ctx, tabbed_xkb_log);
        struct xkb_rule_names names = {
            .rules = NULL, .model = "pc105",
            .layout = "us", .variant = NULL, .options = NULL,
        };
        server.xkb_keymap = xkb_keymap_new_from_names(
            server.xkb_ctx, &names, XKB_KEYMAP_COMPILE_NO_FLAGS);
        if (server.xkb_keymap) {
            wlr_keyboard_set_keymap(&server.keyboard, server.xkb_keymap);
            xkb_state_reload();
        }
    }
    wlr_seat_set_keyboard(server.seat, &server.keyboard);

    server.new_output.notify = handle_new_output;
    wl_signal_add(&server.backend->events.new_output, &server.new_output);
    server.new_toplevel.notify = handle_new_toplevel;
    wl_signal_add(&server.xdg_shell->events.new_toplevel, &server.new_toplevel);
    server.new_popup.notify = handle_new_popup;
    wl_signal_add(&server.xdg_shell->events.new_popup, &server.new_popup);

    /* Standalone: attach the native (libinput) input devices to the seat. */
    if (server.standalone) {
        server.new_input.notify = handle_new_input;
        wl_signal_add(&server.backend->events.new_input, &server.new_input);
    }

    /* The headless backend (nested always, and standalone under
       WLR_BACKENDS=headless when no real display is available) has no
       outputs of its own, so add ours manually; DRM emits its outputs via
       new_output.  new_output fires during backend start. */
    if (!server.standalone || server.standalone_headless) {
        int w = server.standalone && mode_req_w > 0 ? mode_req_w : 1280;
        int h = server.standalone && mode_req_h > 0 ? mode_req_h : 800;
        host.width = w;
        host.height = h;
        wlr_headless_add_output(server.backend, host.width, host.height);
    }

    if (!wlr_backend_start(server.backend)) {
        fprintf(stderr, "tabbed-wlroots: failed to start backend\n");
        return 1;
    }

    if (wl_display_add_socket(server.wl_display, tabbed_socket) < 0) {
        fprintf(stderr, "tabbed-wlroots: failed to add socket '%s': %s\n",
                tabbed_socket, strerror(errno));
        return 1;
    }

    /* Standalone mode presents onto the native output directly; nested mode
       connects to the host compositor and presents inside it. */
    if (!server.standalone && !host_init()) {
        fprintf(stderr, "tabbed-wlroots: could not start nested session\n");
        remove_socket_file();
        return 1;
    }

    tabbed_log(TABBED_LOG_INFO, "Wayland socket: %s\n", tabbed_socket);

    server.apps = calloc((size_t)total_apps, sizeof(*server.apps));
    if (!server.apps) {
        fprintf(stderr, "tabbed-wlroots: out of memory for %d apps\n",
                total_apps);
        remove_socket_file();
        return 1;
    }
    server.apps_cap = total_apps;

    for (int i = 0; i < total_apps; i++) {
        struct tabbed_app *app = calloc(1, sizeof(*app));
        if (!app) {
            remove_socket_file();
            return 1;
        }
        app->cmd = strdup(default_tab ? term_cmd : appv[i]);
        app->pid = -1;
        app->origin = ORIGIN_CLI;
        /* Live-but-black until the command claims the slot with a toplevel. */
        app->pending_claim = true;
        server.apps[i] = app;
    }
    server.num_apps = total_apps;

    for (int i = 0; i < server.num_apps; i++) {
        if (server.apps[i]->cmd[0] == '-') {
            if (i > 0) {
                fprintf(stderr,
                        "tabbed-wlroots: warning: %s starts with '-'; it is "
                        "run as its own tab, not an option to %s\n"
                        "                If intended, quote it: \"%s %s\"\n",
                        server.apps[i]->cmd, server.apps[i - 1]->cmd,
                        server.apps[i - 1]->cmd, server.apps[i]->cmd);
            } else {
                fprintf(stderr,
                        "tabbed-wlroots: warning: %s starts with '-'; if this "
                        "is meant for a first command, quote them together, "
                        "e.g. \"%s\"\n",
                        server.apps[i]->cmd, server.apps[i]->cmd);
            }
        }
    }

    /* The selected command-line command is active from the very first frame:
       black, titled by its command line, until the client maps.  The user
       waits only on that one tab.  --start-cmd-index picks it (1-based);
       without the flag the last command is the one shown, so the startup tab
       is always the one the caller can count on. */
    int focus_idx = start_cmd_index >= 0 ? start_cmd_index : total_apps - 1;
    set_active_app(server.apps[focus_idx]);

    /* Fork every command-line command at once; the process-group match in
       handle_new_toplevel gives each its own slot on arrival. */
    launch_all_cli();

    const char *prefix = tab_prefix == PREFIX_SUPER ? "Super" : "Alt";
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: running. "
            "%s+Up/Down switches tabs; %s+Shift+Up/Down reorders; "
            "%s+Delete closes the active tab; "
            "%s+Shift+T opens a terminal (%s).\n",
            prefix, prefix, prefix, prefix, term_cmd);

    /* Standalone event loop: no host display, so drive the server loop alone.
       The native output's frame signal (or the headless 60Hz timer) wakes the
       dispatcher and triggers a render. */
    if (server.standalone) {
        for (;;) {
            int ret;
            do {
                ret = wl_event_loop_dispatch(server.loop, -1);
            } while (ret == -1 && errno == EINTR);
            wl_display_flush_clients(server.wl_display);
            sweep_dead_startup();
            if (frame_pending || needs_redraw) {
                frame_pending = false;
                needs_redraw = false;
                render_and_present();
            }
        }
    }

    /* Nested event loop: service both the server and the host displays */
    int server_fd = wl_event_loop_get_fd(server.loop);
    int host_fd = wl_display_get_fd(host.display);

    for (;;) {
        wl_display_dispatch_pending(host.display);

        /* Never block in a host read: use the non-blocking prepare/read
           pattern so the server loop (headless frame timer) is always
           serviced while waiting on the host socket. */
        if (wl_display_prepare_read(host.display) == 0) {
            wl_display_flush(host.display);
            struct pollfd fds[2] = {
                { .fd = server_fd, .events = POLLIN },
                { .fd = host_fd, .events = POLLIN },
            };
            int ret;
            do {
                ret = poll(fds, 2, -1);
            } while (ret < 0 && errno == EINTR);

            if (ret > 0 && (fds[1].revents & (POLLIN | POLLERR)))
                wl_display_read_events(host.display);
            else
                wl_display_cancel_read(host.display);

            if (ret > 0 && (fds[0].revents & (POLLIN | POLLERR)))
                wl_event_loop_dispatch(server.loop, 0);
        } else {
            wl_event_loop_dispatch(server.loop, 0);
        }
        wl_display_flush_clients(server.wl_display);
        sweep_dead_startup();
        wl_display_dispatch_pending(host.display);

        /* The headless output fires a frame signal at ~60Hz; render then
           (also when a redraw was requested directly). */
        if (frame_pending || needs_redraw) {
            frame_pending = false;
            needs_redraw = false;
            render_and_present();
        }
        wl_display_flush(host.display);
    }

    /* Unreachable in practice: every shutdown path exits via
       shutdown_cleanup(). Kept for completeness. */
    shutdown_cleanup();
    return 0;
}