justfile

# EXWM-VR task runner
# https://just.systems

set dotenv-load

project_root := justfile_directory()
core_el := `find lisp/core -name '*.el' -not -name '*-pkg.el' -not -name '*-autoloads.el' 2>/dev/null | sort`
vr_el := `find lisp/vr -name '*.el' 2>/dev/null | sort`
ext_el := `find lisp/ext -name '*.el' 2>/dev/null | sort`
all_el := core_el + " " + vr_el + " " + ext_el
load_flags := "-L " + project_root + "/lisp/core -L " + project_root + "/lisp/vr -L " + project_root + "/lisp/ext"

# ── build ──────────────────────────────────────────────

[group('build')]
build:
    @echo "Byte-compiling Elisp..."
    emacs --batch \
        {{load_flags}} \
        --eval '(setq byte-compile-error-on-warn nil)' \
        -f batch-byte-compile {{all_el}}
    @echo "Done."

[group('build')]
build-compositor:
    @echo "Building compositor (Rust)..."
    cargo build --manifest-path "{{project_root}}/compositor/Cargo.toml"

[group('build')]
build-all: build build-compositor

# ── test ───────────────────────────────────────────────

[group('test')]
test:
    @echo "Running ERT tests..."
    emacs --batch \
        {{load_flags}} \
        -l "{{project_root}}/test/run-tests.el"

[group('test')]
test-compositor:
    @echo "Running compositor tests..."
    cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml"

[group('test')]
test-integration:
    @echo "Running integration tests..."
    emacs --batch \
        {{load_flags}} \
        -l "{{project_root}}/test/run-tests.el" \
        --eval '(ert-run-tests-batch-and-exit "week.*-integration")'

[group('test')]
test-all: test test-compositor test-integration

# ── lint ───────────────────────────────────────────────

[group('lint')]
lint-elisp:
    @echo "Linting Elisp..."
    emacs --batch \
        {{load_flags}} \
        --eval '(setq byte-compile-error-on-warn t)' \
        -f batch-byte-compile {{all_el}}

[group('lint')]
lint-rust:
    @echo "Linting Rust..."
    cargo clippy --manifest-path "{{project_root}}/compositor/Cargo.toml" -- -D warnings

[group('lint')]
lint-all: lint-elisp lint-rust

# ── vr ─────────────────────────────────────────────────

[group('vr')]
vr-mock:
    @echo "Launching compositor with Monado headless..."
    XRT_COMPOSITOR_FORCE_HEADLESS=1 \
        cargo run --manifest-path "{{project_root}}/compositor/Cargo.toml"

[group('vr')]
vr-test:
    @echo "Running VR integration tests..."
    XRT_COMPOSITOR_FORCE_HEADLESS=1 \
        cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml" \
        -- --test-threads=1 vr_

[group('vr')]
vr-preflight:
    @echo "VR hardware preflight checks..."
    @echo "=== GPU ==="
    @test -e /dev/dri/card0 && echo "  /dev/dri/card0: OK" || echo "  /dev/dri/card0: MISSING"
    @test -e /dev/dri/renderD128 && echo "  /dev/dri/renderD128: OK" || echo "  /dev/dri/renderD128: MISSING"
    @echo "=== HMD USB ==="
    @lsusb 2>/dev/null | grep -i "bigscreen\|beyond\|valve\|htc\|oculus\|meta" || echo "  No known HMD detected via USB"
    @echo "=== Monado ==="
    @monado-cli probe 2>&1 && echo "  Monado: OK" || echo "  Monado: probe failed"
    @echo "=== Vulkan ==="
    @vulkaninfo --summary 2>&1 | head -10 || echo "  vulkaninfo not available"

[group('vr')]
vr-drm-info:
    @echo "DRM connector info..."
    @for card in /dev/dri/card*; do \
        echo "=== $card ==="; \
        drm_info "$card" 2>/dev/null || \
        for conn in /sys/class/drm/$(basename "$card")-*/; do \
            echo "  $(basename $conn): status=$(cat $conn/status 2>/dev/null) non_desktop=$(cat $conn/non_desktop 2>/dev/null)"; \
        done; \
    done

[group('vr')]
vr-hardware-test suite="smoke":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "Running VR hardware test suite: {{suite}}..."
    case "{{suite}}" in
    smoke)
        echo "--- Smoke test: build + basic GPU tests ---"
        cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml" \
            --features full-backend,vr
        ;;
    drm-lease)
        echo "--- DRM lease tests ---"
        cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml" \
            --features full-backend,vr -- --test-threads=1 drm_lease
        ;;
    full)
        echo "--- Full VR hardware test suite ---"
        cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml" \
            --features full-backend,vr -- --test-threads=1
        ;;
    *)
        echo "Unknown suite: {{suite}} (use smoke, drm-lease, or full)"
        exit 1
        ;;
    esac

[group('vr')]
vr-benchmark-gpu:
    @echo "Running GPU benchmark suite..."
    cargo bench --manifest-path "{{project_root}}/compositor/Cargo.toml" \
        --features full-backend,vr 2>&1 | tee benchmark-results/gpu-bench.txt || \
    cargo test --manifest-path "{{project_root}}/compositor/Cargo.toml" \
        --features full-backend,vr -- --test-threads=1 benchmark

# ── beyond / remote setup ─────────────────────────────

setup_script := project_root + "/packaging/scripts/exwm-vr-setup"

# Deploy the unified setup script to a remote host, then run a command.
# Usage: just beyond-remote <host> <command>
#   just beyond-remote honey prereqs     — install groups + udev (sudo)
#   just beyond-remote honey verify      — check display, USB, permissions
#   just beyond-remote honey beyond-status
[group('vr')]
beyond-remote host command:
    @echo "=== {{host}}: {{command}} ==="
    scp -q "{{setup_script}}" "{{project_root}}/packaging/udev/99-exwm-vr.rules" "{{project_root}}/packaging/scripts/beyond-power-on" "{{project_root}}/packaging/systemd/exwm-vr-beyond-power.service" "{{project_root}}/packaging/sway/config" "{{project_root}}/packaging/sway/status.sh" "{{project_root}}/patches/wlroots-bigscreen-non-desktop.patch" "{{project_root}}/patches/amd-bsb-dsc-fix.patch" "{{project_root}}/patches/bigscreen-beyond-edid.patch" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/exwm-vr-setup /tmp/beyond-power-on && mv -f /tmp/config /tmp/exwm-sway-config 2>/dev/null; mv -f /tmp/status.sh /tmp/exwm-sway-status.sh 2>/dev/null; /tmp/exwm-vr-setup {{command}}"

# Same as beyond-remote but wraps in sudo (prompts for password).
[group('vr')]
beyond-remote-sudo host command:
    @echo "=== {{host}}: sudo {{command}} ==="
    scp -q "{{setup_script}}" "{{project_root}}/packaging/udev/99-exwm-vr.rules" "{{project_root}}/packaging/scripts/beyond-power-on" "{{project_root}}/packaging/systemd/exwm-vr-beyond-power.service" "{{project_root}}/packaging/sway/config" "{{project_root}}/packaging/sway/status.sh" "{{project_root}}/patches/wlroots-bigscreen-non-desktop.patch" "{{project_root}}/patches/amd-bsb-dsc-fix.patch" "{{project_root}}/patches/bigscreen-beyond-edid.patch" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/exwm-vr-setup /tmp/beyond-power-on && mv -f /tmp/config /tmp/exwm-sway-config 2>/dev/null; mv -f /tmp/status.sh /tmp/exwm-sway-status.sh 2>/dev/null; echo 'Running with sudo...' && sudo /tmp/exwm-vr-setup {{command}}"

# Shorthand aliases for common operations
[group('vr')]
beyond-status host="honey":
    just beyond-remote {{host}} beyond-status

[group('vr')]
beyond-verify host="honey":
    just beyond-remote {{host}} verify

[group('vr')]
beyond-hid-test host="honey":
    just beyond-remote {{host}} beyond-hid-test

[group('vr')]
beyond-setup host="honey":
    @echo "Full setup on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} full-setup

[group('vr')]
beyond-gpu-tools host="honey":
    @echo "Installing GPU tools on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} gpu-tools

[group('vr')]
beyond-display-init host="honey":
    @echo "Beyond display init on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} beyond-display-init

[group('vr')]
beyond-power-on host="honey" *args="":
    @echo "Sending Beyond power-on on {{host}}..."
    just beyond-remote {{host}} beyond-power-on {{args}}

[group('vr')]
beyond-sway-setup host="honey":
    @echo "Building sway host compositor on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} sway-setup

[group('vr')]
beyond-steam-setup host="honey":
    @echo "Installing native Steam on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} steam-setup

[group('vr')]
beyond-monado-setup host="honey":
    @echo "Building Monado on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} monado-setup

[group('vr')]
beyond-first-frame host="honey":
    @echo "Testing first frame on {{host}}..."
    just beyond-remote {{host}} beyond-first-frame

[group('vr')]
beyond-openxr-build host="honey":
    @echo "Building hello_xr on {{host}}..."
    just beyond-remote {{host}} openxr-build

[group('vr')]
beyond-download-config host="honey":
    @echo "Downloading Beyond calibration config on {{host}}..."
    just beyond-remote {{host}} beyond-download-config

[group('vr')]
beyond-oobe host="honey":
    @echo "Running full OOBE on {{host}}..."
    just beyond-remote {{host}} beyond-oobe

[group('vr')]
beyond-kernel-dsc-fix host="honey":
    @echo "Patching amdgpu DSC QP tables on {{host}} (sudo required)..."
    just beyond-remote-sudo {{host}} kernel-dsc-fix

# Build XR kernel from source with all patches on remote host.
# Optionally pass kernel version: just beyond-kernel-build honey 6.19.5
[group('vr')]
beyond-kernel-build host="honey" *args="":
    @echo "Building XR kernel on {{host}} (sudo required, takes ~30min)..."
    scp -q "{{setup_script}}" "{{project_root}}/patches/bigscreen-beyond-edid.patch" "{{project_root}}/patches/0007-vesa-dsc-bpp.patch" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/exwm-vr-setup && sudo /tmp/exwm-vr-setup kernel-build {{args}}"

# ── deploy ────────────────────────────────────────────

# Deploy all components to a host
# Usage: just deploy honey [components]
# Components: kernel, compositor, sway, monado, all (default: all)
[group('deploy')]
deploy host="honey" components="all":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Deploying to {{host}} ==="

    if [[ "{{components}}" == "all" || "{{components}}" == *"kernel"* ]]; then
        echo ">>> Checking kernel..."
        LATEST=$(gh release view -R tinyland-inc/linux-xr --json tagName -q .tagName 2>/dev/null || echo "none")
        echo "    Latest kernel release: ${LATEST}"
    fi

    if [[ "{{components}}" == "all" || "{{components}}" == *"compositor"* ]]; then
        echo ">>> Building compositor..."
        nix build .#compositor --out-link result-compositor
        echo ">>> Copying to {{host}}..."
        nix copy --to ssh://jess@{{host}} ./result-compositor
    fi

    if [[ "{{components}}" == "all" || "{{components}}" == *"sway"* ]]; then
        echo ">>> Building sway..."
        nix build .#sway-beyond --out-link result-sway
        echo ">>> Copying to {{host}}..."
        nix copy --to ssh://jess@{{host}} ./result-sway
    fi

    echo ">>> Running verification..."
    just deploy-verify {{host}}

# Post-deploy verification
[group('deploy')]
deploy-verify host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Verifying deployment on {{host}} ==="
    ssh jess@{{host}} bash -s <<'VERIFY'
    echo "Kernel: $(uname -r)"
    echo "Sway: $(sway --version 2>/dev/null || echo 'not found')"
    echo "Monado: $(monado-cli version 2>/dev/null || echo 'not found')"
    echo "GPU: $(lspci | grep -i vga | head -1)"
    echo "DRM: $(ls /dev/dri/card* 2>/dev/null | tr '\n' ' ')"
    echo "Beyond USB: $(lsusb -d 35bd: 2>/dev/null || echo 'not connected')"
    echo "non_desktop: $(cat /sys/class/drm/card*/DP-*/non_desktop 2>/dev/null | head -1 || echo 'N/A')"
    VERIFY

# ── kernel (linux-xr) ─────────────────────────────────

linux_xr_repo := "tinyland-inc/linux-xr"

# Download + install latest XR kernel RPM on remote host.
# Usage: just beyond-kernel-install honey v6.19.5-xr3          (generic)
#        just beyond-kernel-install honey v6.19.5-xr3 rt       (RT)
[group('vr')]
beyond-kernel-install host tag variant="generic":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Installing kernel-xr ({{variant}}) {{tag}} on {{host}} ==="
    rm -rf /tmp/kernel-xr-rpms && mkdir -p /tmp/kernel-xr-rpms
    case "{{variant}}" in
        rt)      PATTERN="kernel-xr-rt-*.x86_64.rpm" ;;
        generic) PATTERN="kernel-xr-[0-9]*.x86_64.rpm" ;;
        *)       echo "Unknown variant: {{variant}} (use rt or generic)"; exit 1 ;;
    esac
    gh release download "{{tag}}" -R "{{linux_xr_repo}}" \
        -p "${PATTERN}" -D /tmp/kernel-xr-rpms/ --clobber
    scp /tmp/kernel-xr-rpms/*.rpm jess@{{host}}:/tmp/
    ssh jess@{{host}} "echo 'tinyland' | sudo -S bash -c '
    set -euo pipefail
    echo \">>> Installing RPM...\"
    dnf install -y /tmp/kernel-xr*.x86_64.rpm 2>&1 | tail -5

    # Find the installed kernel version
    KREL=\$(ls /lib/modules/ | grep xr.el10 | sort -V | tail -1)
    echo \">>> Kernel version: \${KREL}\"

    # Generate initramfs if missing (RPM %post does not always do this)
    if [[ ! -f /boot/initramfs-\${KREL}.img ]]; then
        echo \">>> Generating initramfs...\"
        dracut --force /boot/initramfs-\${KREL}.img \${KREL}
    else
        echo \">>> initramfs exists: /boot/initramfs-\${KREL}.img\"
    fi

    # Verify grub entry exists
    if grubby --info /boot/vmlinuz-\${KREL} >/dev/null 2>&1; then
        echo \">>> Grub entry found\"
        grubby --set-default /boot/vmlinuz-\${KREL}
    else
        echo \">>> Creating grub entry...\"
        # Get boot args from current default kernel
        CURRENT_ARGS=\$(grubby --info=DEFAULT | grep ^args= | sed \"s/^args=//;s/^\\\"\(.*\)\\\"$/\1/\")
        grubby --add-kernel=/boot/vmlinuz-\${KREL} \
            --initrd=/boot/initramfs-\${KREL}.img \
            --title=\"XR Kernel (\${KREL})\" \
            --args=\"\${CURRENT_ARGS}\"
        grubby --set-default /boot/vmlinuz-\${KREL}
    fi

    echo \">>> Default kernel: \$(grubby --default-kernel)\"
    echo \">>> Done. Reboot to activate.\"
    '"

# Trigger linux-xr CI rebuild (when patches change).
# Variant: both (default), rt, generic
[group('vr')]
beyond-kernel-trigger kversion="6.19.5" xr_release="1" rt_version="6.19.3-rt1" variant="both":
    gh workflow run build-kernel.yml -R "{{linux_xr_repo}}" \
        -f kernel_version="{{kversion}}" \
        -f xr_release="{{xr_release}}" \
        -f rt_version="{{rt_version}}" \
        -f variant="{{variant}}"
    @echo "Triggered. Watch: gh run list -R {{linux_xr_repo}}"

# Verify XR kernel install on remote host.
[group('vr')]
beyond-kernel-verify host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Kernel verification on {{host}} ==="
    ssh jess@{{host}} "uname -r && zcat /proc/config.gz 2>/dev/null | grep -E 'HZ=|PREEMPT_RT|DRM_AMD_DC_DSC|USB_HIDDEV' || grep -E 'HZ=|PREEMPT_RT|DRM_AMD_DC_DSC|USB_HIDDEV' /boot/config-\$(uname -r)"

# Dump DSC PPS from debugfs and verify QP/RC fix is active.
# Requires Beyond to be connected and display active on DP-2.
[group('vr')]
beyond-kernel-pps host="honey" connector="DP-2":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== DSC PPS dump from {{host}} ({{connector}}) ==="
    PPS=$(ssh jess@{{host}} "sudo cat /sys/kernel/debug/dri/1/{{connector}}/dsc_pic_parameter_set 2>/dev/null || echo 'NOT_FOUND'")
    if [ "$PPS" = "NOT_FOUND" ]; then
        echo "PPS not available — is DSC active on {{connector}}?"
        echo "Try: ssh jess@{{host}} 'ls /sys/kernel/debug/dri/*/'"
        exit 1
    fi
    echo "$PPS"
    echo ""
    echo "=== QP/RC fix verification ==="
    echo "Check rc_range_params bytes 77-87 against expected patched values:"
    echo "  PPS[77]=0x83 PPS[79]=0xC5 PPS[80]=0xA3 PPS[81]=0x05"
    echo "  PPS[82]=0xA3 PPS[83]=0x45 PPS[85]=0x47 PPS[87]=0xCD"

# ── dev ────────────────────────────────────────────────

[group('dev')]
dev:
    @echo "Launching Emacs with EXWM-VR load path..."
    emacs {{load_flags}} --eval '(require (quote exwm))'

[group('dev')]
clean:
    @echo "Cleaning build artifacts..."
    rm -f "{{project_root}}"/lisp/core/*.elc
    rm -f "{{project_root}}"/lisp/vr/*.elc
    rm -f "{{project_root}}"/lisp/ext/*.elc
    rm -rf "{{project_root}}/compositor/target"
    @echo "Done."

[group('dev')]
changelog:
    git-cliff --output "{{project_root}}/CHANGELOG.md"

# ── analysis (Chapel) ──────────────────────────────

[group('analysis')]
chapel-build:
    cd "{{project_root}}/analysis" && mason build

[group('analysis')]
chapel-test *args="--numTests=500":
    cd "{{project_root}}/analysis" && mason test -- {{args}}

[group('analysis')]
chapel-demo:
    cd "{{project_root}}/analysis" && chpl examples/DualSocketDemo.chpl -o /tmp/numa-demo
    @echo "Run on honey: just chapel-numa-demo honey"

[group('analysis')]
chapel-numa-demo host="honey":
    scp "{{project_root}}/analysis/examples/DualSocketDemo.chpl" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chpl /tmp/DualSocketDemo.chpl -o /tmp/numa-demo && /tmp/numa-demo --numChannels=100"

[group('dev')]
changelog-unreleased:
    git-cliff --unreleased

# ── benchmark ──────────────────────────────────────────

[group('benchmark')]
benchmark:
    @echo "Running EWWM benchmark suite..."
    emacs --batch \
        {{load_flags}} \
        -l ewwm-benchmark \
        --eval '(ewwm-benchmark-run-all)'

[group('benchmark')]
benchmark-report:
    @echo "Generating benchmark report..."
    emacs --batch \
        {{load_flags}} \
        -l ewwm-benchmark \
        --eval '(progn (ewwm-benchmark-run-all) (princ (ewwm-benchmark-report)))'

# ── security ──────────────────────────────────────────

[group('security')]
security-check:
    @echo "Running security verification checks..."
    @echo "  Checking IPC socket permissions..."
    @test -z "${XDG_RUNTIME_DIR:-}" || ls -la "${XDG_RUNTIME_DIR}"/ewwm-ipc.sock 2>/dev/null || echo "  IPC socket not found (compositor not running)"
    @echo "  Checking for network listeners..."
    @ss -tlnp 2>/dev/null | grep -E 'ewwm|compositor' || echo "  No network listeners found (good)"
    @echo "  Checking SELinux policy..."
    @test -f "{{project_root}}/packaging/selinux/exwm-vr.te" && echo "  SELinux policy present" || echo "  SELinux policy missing"
    @echo "  Checking FIPS compliance doc..."
    @test -f "{{project_root}}/docs/fips-compliance.md" && echo "  FIPS compliance doc present" || echo "  FIPS compliance doc missing"
    @echo "  Checking secure input module..."
    @test -f "{{project_root}}/lisp/vr/ewwm-vr-secure-input.el" && echo "  Secure input module present" || echo "  Secure input module missing"
    @echo "Security checks complete."

[group('security')]
audit:
    @echo "EXWM-VR Security Audit Report"
    @echo "=============================="
    @cat "{{project_root}}/docs/security-audit-v0.1.0.md"

# ── release ────────────────────────────────────────────

[group('release')]
release-check: test test-compositor
    @echo "Release checks passed."

[group('release')]
release tag="v0.5.0":
    @echo "Preparing release {{tag}}..."
    git-cliff --tag "{{tag}}" --output "{{project_root}}/CHANGELOG.md"
    @echo "CHANGELOG.md updated."
    @echo "Tag with: git tag -a {{tag}} -m 'Release {{tag}}'"
    @echo "Push with: git push origin {{tag}}"

[group('release')]
release-notes:
    @echo "## Release Notes"
    @echo ""
    git-cliff --unreleased --strip header

# ── ci ─────────────────────────────────────────────────

[group('ci')]
ci: lint-elisp build test
    @echo "CI passed."

# ── nix ────────────────────────────────────────────────

[group('nix')]
nix-build:
    @echo "Building compositor via Nix..."
    nix build .#compositor

[group('nix')]
nix-build-headless:
    @echo "Building headless compositor via Nix..."
    nix build .#compositor-headless

[group('nix')]
nix-build-elisp:
    @echo "Building ewwm-elisp package via Nix..."
    nix build .#ewwm-elisp

[group('nix')]
nix-check:
    @echo "Running nix flake check..."
    nix flake check

[group('nix')]
nix-test-boot:
    @echo "Running NixOS boot-test VM..."
    nix build .#checks.x86_64-linux.boot-test -L

[group('nix')]
nix-test-full:
    @echo "Running NixOS full-stack-test VM..."
    nix build .#checks.x86_64-linux.full-stack-test -L

[group('nix')]
nix-fmt:
    @echo "Formatting Nix files..."
    nixpkgs-fmt flake.nix nix/**/*.nix

# ── selinux ───────────────────────────────────────────

selinux_dir := project_root + "/packaging/selinux"
devel_mk := "/usr/share/selinux/devel/Makefile"

[group('selinux')]
selinux-build:
    @echo "Building SELinux policy modules..."
    make -C "{{selinux_dir}}" -f "{{devel_mk}}" exwm_vr.pp
    make -C "{{selinux_dir}}" -f "{{devel_mk}}" exwm_vr_nix.pp

[group('selinux')]
selinux-install:
    @echo "Installing SELinux policy modules..."
    sudo semodule -i "{{selinux_dir}}/exwm_vr.pp"
    sudo semodule -i "{{selinux_dir}}/exwm_vr_nix.pp"

[group('selinux')]
selinux-uninstall:
    @echo "Removing SELinux policy modules..."
    sudo semodule -r exwm_vr 2>/dev/null || true
    sudo semodule -r exwm_vr_nix 2>/dev/null || true

[group('selinux')]
selinux-label-nix:
    @echo "Labeling Nix compositor binary..."
    sudo "{{selinux_dir}}/label-nix-compositor.sh"

[group('selinux')]
selinux-check:
    @echo "Checking SELinux policy syntax..."
    checkmodule -M -m -o /dev/null "{{selinux_dir}}/exwm_vr.te" && echo "  exwm_vr.te: OK"
    checkmodule -M -m -o /dev/null "{{selinux_dir}}/exwm_vr_nix.te" && echo "  exwm_vr_nix.te: OK"

[group('selinux')]
selinux-clean:
    @echo "Cleaning SELinux build artifacts..."
    rm -f "{{selinux_dir}}"/*.pp "{{selinux_dir}}"/*.mod "{{selinux_dir}}"/*.mod.fc
    rm -rf "{{selinux_dir}}/tmp"

# ── bios (Dell T7810) ──────────────────────────────

bios_dir := project_root + "/packaging/bios"
bios_exe := "T7810A34.exe"
bios_url := "https://dl.dell.com/FOLDER06768042M/1/T7810A34.exe"

# Download Dell T7810 BIOS A34 update executable.
[group('bios')]
bios-download:
    #!/usr/bin/env bash
    set -euo pipefail
    mkdir -p "{{bios_dir}}"
    if [[ -f "{{bios_dir}}/{{bios_exe}}" ]]; then
        echo "BIOS file already downloaded: {{bios_dir}}/{{bios_exe}}"
        ls -lh "{{bios_dir}}/{{bios_exe}}"
    else
        echo "Downloading Dell T7810 BIOS A34..."
        curl -fSL -o "{{bios_dir}}/{{bios_exe}}" "{{bios_url}}"
        echo "Downloaded: {{bios_dir}}/{{bios_exe}}"
        ls -lh "{{bios_dir}}/{{bios_exe}}"
    fi

# Prepare FAT32 USB for F12 Boot Menu BIOS flash (primary method).
# Usage: just bios-prepare-usb /dev/sdX
# The T7810 supports F12 > "BIOS Flash Update" — no FreeDOS needed.
[group('bios')]
bios-prepare-usb dev:
    #!/usr/bin/env bash
    set -euo pipefail
    [[ -f "{{bios_dir}}/{{bios_exe}}" ]] || { echo "Run 'just bios-download' first"; exit 1; }
    echo "WARNING: This will FORMAT {{dev}}1 as FAT32."
    echo "Device:"
    lsblk "{{dev}}"
    read -p "Type YES to continue: " confirm
    [[ "$confirm" == "YES" ]] || { echo "Aborted."; exit 1; }
    sudo mkfs.vfat -F 32 -n BIOS "{{dev}}1"
    MNT=$(mktemp -d)
    sudo mount "{{dev}}1" "${MNT}"
    sudo cp "{{bios_dir}}/{{bios_exe}}" "${MNT}/"
    sudo umount "${MNT}"
    rmdir "${MNT}"
    echo ""
    echo "USB ready. Flash procedure:"
    echo "  1. Insert USB into honey"
    echo "  2. Power on, press F12 at Dell logo"
    echo "  3. Select 'BIOS Flash Update'"
    echo "  4. Browse USB, select {{bios_exe}}"
    echo "  5. Click 'Begin Flash Update' (~2-3 min)"

# Create FreeDOS bootable USB for BIOS update (syslinux + memdisk).
# Usage: just bios-create-freedos-usb /dev/sdX
# Requires: syslinux, unzip (dnf install syslinux syslinux-nonlinux)
# Creates a USB with three flash methods:
#   1. FreeDOS boot → run T7810A34.EXE from DOS prompt
#   2. Ctrl+Esc recovery → hold Ctrl+Esc at power-on → auto-flashes BIOS_IMG.rcv
#   3. F12 BIOS Flash (if available on current BIOS revision)
[group('bios')]
bios-create-freedos-usb dev:
    #!/usr/bin/env bash
    set -euo pipefail
    [[ -f "{{bios_dir}}/{{bios_exe}}" ]] || { echo "Run 'just bios-download' first"; exit 1; }

    FDOS_URL="https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.3/official/FD13-FloppyEdition.zip"

    # Download FreeDOS boot floppy if not cached
    if [[ ! -f "{{bios_dir}}/freedos-boot.img" ]]; then
        echo "Downloading FreeDOS 1.3 floppy image..."
        curl -fSL -o "/tmp/freedos-floppy.zip" "${FDOS_URL}"
        unzip -o "/tmp/freedos-floppy.zip" "144m/x86BOOT.img" -d "/tmp/"
        mv "/tmp/144m/x86BOOT.img" "{{bios_dir}}/freedos-boot.img"
        rm -rf "/tmp/144m"
    fi

    echo "WARNING: This will REPARTITION and FORMAT {{dev}}"
    echo "Device:"
    lsblk "{{dev}}"
    read -p "Type YES to continue: " confirm
    [[ "$confirm" == "YES" ]] || { echo "Aborted."; exit 1; }

    # Partition table + FAT32
    sudo parted -s "{{dev}}" mklabel msdos
    sudo parted -s "{{dev}}" mkpart primary fat32 1MiB 100%
    sudo parted -s "{{dev}}" set 1 boot on
    sleep 1  # wait for partition to appear
    sudo mkfs.vfat -F 32 -n BIOSFLASH "{{dev}}1"

    # Install syslinux MBR + bootloader
    sudo dd if=/usr/share/syslinux/mbr.bin of="{{dev}}" bs=440 count=1 conv=notrunc
    sudo syslinux --install "{{dev}}1"

    # Mount and populate
    MNT=$(mktemp -d)
    sudo mount "{{dev}}1" "${MNT}"

    # Syslinux memdisk (boots floppy images from USB)
    sudo cp /usr/share/syslinux/memdisk "${MNT}/"

    # FreeDOS boot floppy
    sudo cp "{{bios_dir}}/freedos-boot.img" "${MNT}/"

    # Dell BIOS update exe (for FreeDOS and F12 methods)
    sudo cp "{{bios_dir}}/{{bios_exe}}" "${MNT}/"

    # Dell recovery file (for Ctrl+Esc method)
    sudo cp "{{bios_dir}}/{{bios_exe}}" "${MNT}/BIOS_IMG.rcv"

    # Syslinux boot menu
    sudo tee "${MNT}/syslinux.cfg" > /dev/null << 'SYSEOF'
    DEFAULT freedos
    PROMPT 1
    TIMEOUT 50

    LABEL freedos
      MENU LABEL Boot FreeDOS (Dell BIOS Update)
      KERNEL memdisk
      APPEND initrd=freedos-boot.img

    LABEL local
      MENU LABEL Boot from hard drive
      LOCALBOOT 0x80
    SYSEOF

    sudo sync
    echo ""
    echo "=== FreeDOS BIOS Update USB Ready ==="
    ls -lh "${MNT}/"
    sudo umount "${MNT}"
    rmdir "${MNT}"

    echo ""
    echo "Flash methods (try in order):"
    echo "  1. FreeDOS:  F12 → USB Storage → syslinux → FreeDOS boots"
    echo "               At A:\\> prompt, switch to C: and run T7810A34.EXE"
    echo "  2. Ctrl+Esc: Power off → hold Ctrl+Esc → power on"
    echo "               Auto-flashes BIOS_IMG.rcv (~2-3 min)"
    echo "  3. F12 BIOS Flash: F12 → BIOS Flash Update → T7810A34.exe"
    echo "               (only available if current BIOS supports it)"

# Create FreeDOS bootable USB on a remote host.
# Usage: just bios-create-freedos-usb-remote honey /dev/sdc
[group('bios')]
bios-create-freedos-usb-remote host dev:
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Creating FreeDOS BIOS USB on {{host}} ({{dev}}) ==="
    [[ -f "{{bios_dir}}/{{bios_exe}}" ]] || { echo "Run 'just bios-download' first"; exit 1; }

    # Copy BIOS exe to remote
    scp "{{bios_dir}}/{{bios_exe}}" jess@{{host}}:/tmp/

    ssh jess@{{host}} "echo 'tinyland' | sudo -S bash -c '
    set -euo pipefail
    FDOS_URL=\"https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.3/official/FD13-FloppyEdition.zip\"

    # Install tools
    dnf install -y syslinux syslinux-nonlinux unzip 2>&1 | tail -3

    # Download FreeDOS
    if [[ ! -f /tmp/freedos-boot.img ]]; then
        curl -fSL -o /tmp/freedos-floppy.zip \"\${FDOS_URL}\"
        cd /tmp && unzip -o freedos-floppy.zip 144m/x86BOOT.img
        mv 144m/x86BOOT.img freedos-boot.img
        rm -rf 144m
    fi

    # Unmount
    umount {{dev}}1 2>/dev/null || true

    # Partition + format
    parted -s {{dev}} mklabel msdos
    parted -s {{dev}} mkpart primary fat32 1MiB 100%
    parted -s {{dev}} set 1 boot on
    sleep 1
    mkfs.vfat -F 32 -n BIOSFLASH {{dev}}1

    # Install syslinux
    dd if=/usr/share/syslinux/mbr.bin of={{dev}} bs=440 count=1 conv=notrunc
    syslinux --install {{dev}}1

    # Populate
    mkdir -p /tmp/bios-usb
    mount {{dev}}1 /tmp/bios-usb
    cp /usr/share/syslinux/memdisk /tmp/bios-usb/
    cp /tmp/freedos-boot.img /tmp/bios-usb/
    cp /tmp/T7810A34.exe /tmp/bios-usb/
    cp /tmp/T7810A34.exe /tmp/bios-usb/BIOS_IMG.rcv

    cat > /tmp/bios-usb/syslinux.cfg << SYSEOF
    DEFAULT freedos
    PROMPT 1
    TIMEOUT 50
    LABEL freedos
      MENU LABEL Boot FreeDOS (Dell BIOS Update)
      KERNEL memdisk
      APPEND initrd=freedos-boot.img
    LABEL local
      MENU LABEL Boot from hard drive
      LOCALBOOT 0x80
    SYSEOF

    sync
    echo \"=== USB Ready ===\"
    ls -lh /tmp/bios-usb/
    umount /tmp/bios-usb
    rmdir /tmp/bios-usb
    '"
    echo ""
    echo "FreeDOS BIOS USB ready on {{host}} at {{dev}}"
    echo "Flash: power off → F12 → USB Storage → FreeDOS → C:\\T7810A34.EXE"

# Extract firmware payload from Dell BIOS exe for analysis.
[group('bios')]
bios-extract:
    #!/usr/bin/env bash
    set -euo pipefail
    [[ -f "{{bios_dir}}/{{bios_exe}}" ]] || { echo "Run 'just bios-download' first"; exit 1; }
    mkdir -p "{{bios_dir}}/extracted"
    echo "Attempting extraction with 7z..."
    if command -v 7z &>/dev/null; then
        7z x -o"{{bios_dir}}/extracted" "{{bios_dir}}/{{bios_exe}}" -y || true
    fi
    echo "Attempting extraction with BIOSUtilities..."
    if python3 -c "import biosutilities" 2>/dev/null; then
        python3 -m biosutilities.Dell_PFS_Extract "{{bios_dir}}/{{bios_exe}}" \
            -o "{{bios_dir}}/extracted/" || true
    else
        echo "  BIOSUtilities not installed. Install: pip install biosutilities"
    fi
    echo "Extracted to: {{bios_dir}}/extracted/"
    ls -la "{{bios_dir}}/extracted/" 2>/dev/null || echo "  (empty)"

# Check BIOS version on remote host.
[group('bios')]
bios-verify host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== BIOS version on {{host}} ==="
    ssh jess@{{host}} "sudo dmidecode -t bios | grep -E 'Vendor|Version|Release|Revision|Date'"

# Deploy tuned profile for BCI/VR workloads to remote host.
[group('bios')]
bios-tuned-deploy host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Deploying xr-bci tuned profile to {{host}} ==="
    scp -r "{{project_root}}/packaging/tuned/xr-bci" jess@{{host}}:/tmp/
    ssh jess@{{host}} "echo 'tinyland' | sudo -S bash -c 'cp -r /tmp/xr-bci /etc/tuned/ && tuned-adm profile xr-bci && echo Done: && tuned-adm active'"

# Run SMI validation on remote host (characterize hardware latency).
[group('bios')]
smi-validate host="honey" *args="":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== SMI Validation on {{host}} ==="
    scp "{{project_root}}/packaging/scripts/smi-validate" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/smi-validate && echo 'tinyland' | sudo -S /tmp/smi-validate {{args}}"

# ── rollout ─────────────────────────────────────────

# Full rollout preflight — validates honey is ready for storage migration + boot IaC.
# Checks: SSH, boot state, storage layout, kernel, BIOS version, BLS entries.
# Non-destructive. Run this before any phase1+ operations.
[group('deploy')]
rollout-preflight host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=========================================="
    echo " Rollout Preflight: {{host}}"
    echo "=========================================="
    FAIL=0
    pass() { echo -e "  \033[0;32m[OK]\033[0m $1"; }
    fail() { echo -e "  \033[0;31m[FAIL]\033[0m $1"; FAIL=1; }
    warn() { echo -e "  \033[0;33m[WARN]\033[0m $1"; }
    info() { echo -e "  \033[0;34m[INFO]\033[0m $1"; }

    # SSH connectivity
    echo ""
    echo "── Connectivity ──"
    if ssh -o ConnectTimeout=5 jess@{{host}} "echo ok" &>/dev/null; then
        pass "SSH to {{host}}"
    else
        fail "Cannot SSH to {{host}}"
        exit 1
    fi

    # Gather remote state in one SSH call
    echo ""
    echo "── Remote State ──"
    # Write preflight script to remote, execute with sudo
    # Gather state with single-quoted values (safe for eval)
    ssh jess@{{host}} "cat > /tmp/_preflight.sh" <<'REMOTE'
    #!/bin/bash
    qv() { local v; v=$("$@" 2>/dev/null) || v="${!#}"; echo "'${v//\'/\'\\\'\'}'"; }
    P="__PF__"
    echo "${P}KERNEL='$(uname -r)'"
    echo "${P}BIOS='$(cat /sys/class/dmi/id/bios_version 2>/dev/null || echo unknown)'"
    echo "${P}ROOTDEV='$(findmnt -no SOURCE / 2>/dev/null || echo unknown)'"
    echo "${P}ROOTFS='$(findmnt -no FSTYPE / 2>/dev/null || echo unknown)'"
    echo "${P}UPTIME='$(uptime -p 2>/dev/null || echo unknown)'"
    echo "${P}BOOT_ENTRIES='$(ls /boot/loader/entries/*.conf 2>/dev/null | wc -l)'"
    echo "${P}DEFAULT_KERNEL='$(grubby --default-kernel 2>/dev/null || echo unknown)'"
    echo "${P}BLS_ENABLED='$(grep -c GRUB_ENABLE_BLSCFG /etc/default/grub 2>/dev/null; true)'"
    echo "${P}VG_RL00='$(vgs --noheadings -o vg_name 2>/dev/null | grep -c rl00; true)'"
    echo "${P}VG_NVME='$(vgs --noheadings -o vg_name 2>/dev/null | grep -c nvme; true)'"
    echo "${P}LV_ATTRS='$(lvs --noheadings -o lv_attr rl00/root 2>/dev/null | tr -d ' ' || echo unknown)'"
    echo "${P}NVME0='$(test -b /dev/nvme0n1 && echo yes || echo no)'"
    echo "${P}NVME1='$(test -b /dev/nvme1n1 && echo yes || echo no)'"
    echo "${P}ROOT_USAGE='$(df --output=pcent / 2>/dev/null | tail -1 | tr -d " %" || echo unknown)'"
    echo "${P}HAS_DHALL='$(command -v dhall &>/dev/null && echo yes || echo no)'"
    echo "${P}HAS_BOOM='$(command -v boom &>/dev/null && echo yes || echo no)'"
    echo "${P}HAS_LMSENSORS='$(command -v sensors &>/dev/null && echo yes || echo no)'"
    echo "${P}GRUB_CMDLINE='$(grep GRUB_CMDLINE_LINUX /etc/default/grub 2>/dev/null | head -1)'"
    REMOTE
    REMOTE_STATE=$(ssh jess@{{host}} "chmod +x /tmp/_preflight.sh && echo 'tinyland' | sudo -S /tmp/_preflight.sh 2>/dev/null; rm -f /tmp/_preflight.sh")

    # Parse remote state — only eval lines with our prefix (ignores MOTD, sudo noise)
    eval "$(echo "$REMOTE_STATE" | grep '^__PF__' | sed 's/^__PF__//')"

    info "Kernel: $KERNEL"
    info "BIOS: $BIOS"
    info "Root: $ROOTDEV ($ROOTFS)"
    info "Uptime: $UPTIME"

    # Boot checks
    echo ""
    echo "── Boot Configuration ──"
    if [ "$BLS_ENABLED" -ge 1 ]; then
        pass "BLS enabled in /etc/default/grub"
    else
        fail "BLS not enabled — required for boot-apply pipeline"
    fi

    if [ "$BOOT_ENTRIES" -ge 2 ]; then
        pass "Multiple BLS entries ($BOOT_ENTRIES) — rollback available"
    elif [ "$BOOT_ENTRIES" -eq 1 ]; then
        warn "Only 1 BLS entry — consider keeping a fallback"
    else
        fail "No BLS entries found"
    fi

    info "Default kernel: $DEFAULT_KERNEL"
    info "GRUB cmdline: $GRUB_CMDLINE"

    # Storage checks
    echo ""
    echo "── Storage ──"
    if [ "$VG_RL00" -ge 1 ]; then
        pass "VG rl00 exists"
    else
        fail "VG rl00 not found"
    fi

    if echo "$LV_ATTRS" | grep -q "^-wi"; then
        pass "rl00/root is thick LVM (attrs: $LV_ATTRS)"
    elif echo "$LV_ATTRS" | grep -q "^V"; then
        fail "rl00/root is THIN LVM — GRUB cannot read this (BZ#1164947)"
    else
        info "rl00/root attrs: $LV_ATTRS"
    fi

    if [ "$VG_NVME" -ge 1 ]; then
        warn "Failed 'nvme' VG still exists — phase1 will clean this"
    else
        pass "No stale 'nvme' VG"
    fi

    if [ "$NVME0" = "yes" ]; then
        pass "nvme0n1 present (migration target)"
    else
        fail "nvme0n1 not found"
    fi

    if [ "$NVME1" = "yes" ]; then
        pass "nvme1n1 present (data thin pool target)"
    else
        warn "nvme1n1 not found (phase2 requires it)"
    fi

    info "Root usage: ${ROOT_USAGE}%"
    if [ "$ROOT_USAGE" != "unknown" ] && [ "$ROOT_USAGE" -gt 90 ]; then
        warn "Root > 90% full — clean up before pvmove"
    fi

    # BIOS check
    echo ""
    echo "── BIOS ──"
    if [ "$BIOS" = "A34" ]; then
        pass "BIOS A34 (RT-ready, TSC errata fixed)"
    elif [ "$BIOS" = "A02" ]; then
        warn "BIOS A02 — flash A34 before RT kernel (just bios-prepare-usb)"
    else
        info "BIOS: $BIOS"
    fi

    # Tool availability
    echo ""
    echo "── Tools ──"
    if [ "$HAS_DHALL" = "yes" ]; then
        pass "dhall available"
    else
        warn "dhall not installed (needed for boot-apply on remote)"
    fi
    if [ "$HAS_BOOM" = "yes" ]; then
        pass "boom-boot available"
    else
        info "boom-boot not installed (phase4 will install it)"
    fi
    if [ "$HAS_LMSENSORS" = "yes" ]; then
        pass "lm_sensors available"
    else
        info "lm_sensors not installed (gpu-monitor will work without it)"
    fi

    # Local Dhall validation
    echo ""
    echo "── Local Dhall ──"
    if just boot-validate >/dev/null 2>&1; then
        pass "All 13 Dhall files validate"
    else
        fail "Dhall validation failed — run 'just boot-validate' for details"
    fi

    # Summary
    echo ""
    echo "=========================================="
    if [ "$FAIL" -eq 0 ]; then
        echo " Preflight PASSED — ready for rollout."
        echo ""
        echo " Execution order:"
        echo "   1. just storage-migrate {{host}} phase1        # pvmove root to NVMe"
        echo "   2. ssh jess@{{host}} sudo reboot               # verify NVMe root"
        echo "   3. just storage-migrate {{host}} phase2        # data thin pool"
        echo "   4. just storage-migrate {{host}} phase3        # HDD archive"
        echo "   5. just storage-migrate {{host}} phase4        # boom-boot"
        echo "   6. just boot-apply {{host}} stock --dry-run    # validate baseline"
        echo "   7. just boot-apply {{host}} xr --dry-run       # preview XR config"
    else
        echo " Preflight FAILED — fix issues above before proceeding."
    fi
    echo "=========================================="
    exit $FAIL

# ── storage ──────────────────────────────────────────

# Run pre-flight checks for storage migration (non-destructive).
[group('storage')]
storage-preflight host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Storage pre-flight on {{host}} ==="
    scp "{{project_root}}/packaging/scripts/honey-storage-migrate" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/honey-storage-migrate && echo 'tinyland' | sudo -S /tmp/honey-storage-migrate phase0"

# Run storage migration phase (pvmove root to NVMe, etc).
# Usage: just storage-migrate honey phase1
#   phase0: pre-flight (safe)
#   phase1: pvmove root SATA→NVMe (live)
#   phase2: data thin pool on second NVMe
#   phase3: HDD archive tier
#   phase4: boom-boot for kernel snapshots
[group('storage')]
storage-migrate host="honey" phase="phase0" *args="":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Storage migration {{phase}} on {{host}} ==="
    scp "{{project_root}}/packaging/scripts/honey-storage-migrate" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/honey-storage-migrate && echo 'tinyland' | sudo -S /tmp/honey-storage-migrate {{phase}} {{args}}"

# Show current storage layout on remote host.
[group('storage')]
storage-status host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Storage status on {{host}} ==="
    ssh jess@{{host}} "echo '── PVs ──' && sudo pvs 2>/dev/null; echo '── VGs ──' && sudo vgs 2>/dev/null; echo '── LVs ──' && sudo lvs 2>/dev/null; echo '── df ──' && df -h / /boot /home /data /archive 2>/dev/null; echo '── lsblk ──' && lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT"

# ── boot (Dhall IaC) ────────────────────────────────

# Type-check all Dhall files (local, no remote access needed).
# Validates types, defaults, assertions, and rendering pipeline.
[group('boot')]
boot-validate:
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Dhall validation ==="
    PASS=0; TOTAL=0
    for f in \
        packaging/dhall/Platform.dhall \
        packaging/dhall/KernelConfig.dhall \
        packaging/dhall/BootParams.dhall \
        packaging/dhall/types/*.dhall \
        packaging/dhall/defaults/*.dhall \
        packaging/dhall/generate-boot.dhall; do
        TOTAL=$((TOTAL + 1))
        printf "  %-55s" "$f"
        if dhall type --file "$f" >/dev/null 2>&1; then
            echo "OK"
            PASS=$((PASS + 1))
        else
            echo "FAIL"
            dhall type --file "$f" 2>&1 | head -5 | sed 's/^/    /'
        fi
    done
    echo ""
    echo "  $PASS/$TOTAL passed"
    [ "$PASS" -eq "$TOTAL" ]

# Render a Dhall boot generation locally (dry-run, no remote access needed).
# Usage: just boot-render [config]
#   config: stock, xr, debug (default: xr)
[group('boot')]
boot-render config="xr":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Rendering boot generation: {{config}} ==="
    cd "{{project_root}}"
    DHALL_FILE="packaging/dhall/defaults/honey-{{config}}.dhall"
    if [[ ! -f "$DHALL_FILE" ]]; then
        echo "Config not found: $DHALL_FILE"
        echo "Available: $(ls packaging/dhall/defaults/ | sed 's/honey-//;s/.dhall//' | tr '\n' ' ')"
        exit 1
    fi
    dhall text <<DHALL
    let BootEntry = ./packaging/dhall/types/BootEntry.dhall
    let GrubDefaults = ./packaging/dhall/types/GrubDefaults.dhall
    let DracutConfig = ./packaging/dhall/types/DracutConfig.dhall
    let FstabTypes = ./packaging/dhall/types/FstabEntry.dhall
    let gen = ./${DHALL_FILE}
    let blsEntry = BootEntry.render gen.bootEntry
    let grubDefaults = GrubDefaults.render gen.grubDefaults
    let dracutConfig = DracutConfig.render gen.dracutConfig
    let fstab =
          List/fold FstabTypes.FstabEntry gen.fstabEntries Text
            (\(entry : FstabTypes.FstabEntry) -> \(acc : Text) ->
              acc ++ FstabTypes.render entry ++ "\n") ""
    in    "# Boot Generation \${Natural/show gen.generation}\n"
      ++  "# \${gen.description}\n#\n"
      ++  "# Root: \${gen.rootDevice} (VG: \${gen.rootVG}, thick LVM)\n"
      ++  "# GRUB cannot read thin LVM -- Red Hat BZ#1164947 (2014, WONTFIX)\n\n"
      ++  "### BLS Entry (/boot/loader/entries/) ###\n" ++ blsEntry ++ "\n"
      ++  "### /etc/default/grub ###\n" ++ grubDefaults ++ "\n"
      ++  "### /etc/dracut.conf.d/ ###\n" ++ dracutConfig ++ "\n"
      ++  "### fstab entries ###\n" ++ fstab
    DHALL

# Apply a Dhall boot generation to remote host.
# Usage: just boot-apply honey [config]
#   config: stock, xr, debug (default: xr)
[group('boot')]
boot-apply host="honey" config="xr" mode="--dry-run":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Boot apply ({{mode}}) {{config}} on {{host}} ==="
    scp -r "{{project_root}}/packaging/dhall" "{{project_root}}/packaging/scripts/boot-apply" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/boot-apply && echo 'tinyland' | sudo -S /tmp/boot-apply {{mode}} {{config}}"

# Verify boot configuration on remote host.
[group('boot')]
boot-verify host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    echo "=== Boot verification on {{host}} ==="
    ssh jess@{{host}} "echo '── Kernel ──' && uname -r; echo '── Default ──' && sudo grubby --default-kernel; echo '── BLS Entries ──' && ls -la /boot/loader/entries/; echo '── Current cmdline ──' && cat /proc/cmdline; echo '── GRUB defaults ──' && cat /etc/default/grub"

# Test a kernel with grub2-reboot (one-shot: auto-reverts to saved default on next reboot).
# Usage: just boot-test-kernel honey /boot/vmlinuz-6.19.5-5.xr.el10
[group('boot')]
boot-test-kernel host="honey" kernel="":
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ -z "{{kernel}}" ]]; then
        echo "Usage: just boot-test-kernel <host> <kernel-path>"
        echo "  e.g.: just boot-test-kernel honey /boot/vmlinuz-6.19.5-5.xr.el10"
        echo ""
        echo "This uses grub2-reboot for a ONE-SHOT boot. If the kernel fails,"
        echo "the next power cycle auto-boots the saved default (ELRepo)."
        echo ""
        ssh jess@{{host}} "echo 'tinyland' | sudo -S grubby --info=ALL 2>/dev/null | grep -E '^(index|kernel|title)='"
        exit 1
    fi
    echo "=== One-shot kernel test on {{host}} ==="
    ssh jess@{{host}} "echo 'tinyland' | sudo -S bash -c '
        SAVED=\$(grubby --default-kernel)
        echo \"  Saved default: \${SAVED}\"
        echo \"  Testing: {{kernel}}\"
        # Get the BLS entry index for the target kernel
        IDX=\$(grubby --info={{kernel}} 2>/dev/null | grep ^index= | cut -d= -f2)
        if [ -z \"\${IDX}\" ]; then
            echo \"FAIL: {{kernel}} not found in grubby entries\"
            exit 1
        fi
        echo \"  Entry index: \${IDX}\"
        # grub2-reboot sets the entry for ONE boot only, then reverts to saved_entry
        grub2-reboot \${IDX}
        echo \"\"
        echo \"  grub2-reboot set. Next boot will use {{kernel}}.\"
        echo \"  If it fails, the FOLLOWING boot auto-reverts to \${SAVED}.\"
        echo \"  Rebooting now...\"
        reboot
    '" 2>/dev/null
    echo "Reboot sent. Monitoring..."
    for i in $(seq 1 24); do
        sleep 10
        KVER=$(ssh -o ConnectTimeout=5 jess@{{host}} "uname -r" 2>/dev/null) && {
            echo "{{host}} booted: ${KVER} (after $((i*10))s)"
            if echo "${KVER}" | grep -q "xr"; then
                echo "SUCCESS: XR kernel is running!"
            else
                echo "FALLBACK: Booted ${KVER} (not XR — kernel may have failed)"
            fi
            exit 0
        }
        echo "Waiting... ($((i*10))s)"
    done
    echo "TIMEOUT: {{host}} did not come back in 4 minutes."
    echo "Check console — if stuck, power cycle to auto-revert to saved default."

# ── gpu ──────────────────────────────────────────────

# Show GPU status (temps, fan, power) on remote host.
[group('gpu')]
gpu-status host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    scp "{{project_root}}/packaging/scripts/gpu-monitor" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/gpu-monitor && /tmp/gpu-monitor status"

# Watch GPU temps in real-time on remote host.
[group('gpu')]
gpu-watch host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    scp "{{project_root}}/packaging/scripts/gpu-monitor" jess@{{host}}:/tmp/
    ssh -t jess@{{host}} "chmod +x /tmp/gpu-monitor && /tmp/gpu-monitor watch"

# Quiet Dell chassis fans (disable third-party GPU detection response).
[group('gpu')]
gpu-dell-quiet host="honey":
    #!/usr/bin/env bash
    set -euo pipefail
    scp "{{project_root}}/packaging/scripts/gpu-monitor" jess@{{host}}:/tmp/
    ssh jess@{{host}} "chmod +x /tmp/gpu-monitor && echo 'tinyland' | sudo -S /tmp/gpu-monitor dell-quiet"