[fix] Rebuild compatible Hyprland dependencies for factory images

THIRD_PARTY_NOTICES.md

@@ -14,6 +14,17 @@ code.
 - **Hyprland** — BSD-3-Clause; the reviewed v0.56.1 source and rounded-border
   coverage backport are pinned in `guest/spec.json`. The guest package retains
   Hyprland's upstream license and dependency metadata.
+- **aquamarine** — BSD-3-Clause; Arch Linux ARM currently publishes only
+  `libaquamarine.so=14`, while the pinned Hyprland still requires `.so=13`. The
+  factory therefore rebuilds `aquamarine 0.14.0-2` from the reviewed Arch
+  PKGBUILD and `hyprwm/aquamarine` v0.14.0 tarball (pinned in `guest/spec.json`)
+  for factory builds. The finished guest holds aquamarine and Hyprtoolkit on
+  `IgnorePkg` with Hyprland so updates cannot mix incompatible ABIs.
+- **Hyprtoolkit** — BSD-3-Clause; the factory rebuilds the reviewed
+  `hyprwm/hyprtoolkit` v0.5.4 source using the Arch 0.5.4-6 recipe adapted for
+  aarch64 and package release 6.1, linked against aquamarine 0.14. Source,
+  recipe, packaging commit, and library hashes are pinned in `guest/spec.json`;
+  the package retains its upstream license.
 - **Glaze** — MIT; the pinned v7.2.0 headers are used by the Hyprland build, and
   their verified upstream license is retained in the rebuilt guest package.
 - **ANGLE, VirGLRenderer, libepoxy, SDL, libslirp, GLib, Pixman, and other QEMU

docs/architecture.md

@@ -165,7 +165,15 @@ creates the account on first boot.
 - The guest normally consumes upstream Arch Linux ARM packages. Hyprland is the
   documented exception: an upstream package is reproducibly rebuilt with a
   guarded rounded-border coverage patch for the VM graphics path, then held in
-  the guest's immutable local repository.
+  the guest's immutable local repository. While that pin still needs
+  `libaquamarine.so=13`, the factory rebuilds `aquamarine 0.14.0-2` from the
+  reviewed Arch PKGBUILD and upstream tarball, then rebuilds Hyprtoolkit
+  against that library. Both packages are provided by the disposable builder
+  repository and held alongside Hyprland on guest `IgnorePkg`; mixing the
+  newer mirror Hyprtoolkit with the older aquamarine cannot resolve. Source
+  and library hashes are verified, and build paths are remapped for repeatable
+  output. The ABI builder must pass from an empty cache before refreshing the
+  transaction lock.
 - The final Arch Linux ARM pacman files live under `/usr/share/try-omarchy/`.
   An Omarchy-supported `pre-refresh-pacman` hook restores them after a channel
   refresh writes its x86_64 templates to `/etc`; the upstream templates remain

guest/Containerfile

@@ -32,7 +32,7 @@ COPY --from=bootstrapper /rootfs/ /
 
 RUN pacman-key --init && pacman-key --populate archlinuxarm && \
     pacman -Syu --noconfirm && \
-    pacman -S --needed --noconfirm arch-install-scripts e2fsprogs git python rust=1:1.98.0-1 zstd && \
+    pacman -S --needed --noconfirm arch-install-scripts e2fsprogs git python rust=1:1.98.1-1 zstd && \
     pacman -Scc --noconfirm
 
 WORKDIR /workspace

guest/build.sh

@@ -91,6 +91,7 @@ fi
 root=$(mktemp -d "$work/rootfs.XXXXXX")
 resolution_db=$(mktemp -d "$work/pacman-db.XXXXXX")
 pinned_repo=""
+abi_pin_repo=""
 chmod 0755 "$resolution_db"
 cleanup() {
   if (( keep_rootfs )); then
@@ -102,6 +103,9 @@ cleanup() {
   if [[ -n $pinned_repo ]]; then
     rm -rf "$pinned_repo"
   fi
+  if [[ -n $abi_pin_repo ]]; then
+    rm -rf "$abi_pin_repo"
+  fi
 }
 trap cleanup EXIT
 
@@ -162,30 +166,35 @@ if ((${#pinned_records[@]})); then
     "$pinned_repo/"*.pkg.tar.zst >/dev/null
 fi
 
-# Preserve the pinned repository configuration exactly, adding only builder
-# options. The generated file is temporary build input; configure-rootfs later
-# installs Omarchy's unmodified pacman configuration into the guest.
-options_sections=0
-pinned_repo_inserted=0
-while IFS= read -r line || [[ -n $line ]]; do
-  if [[ -n $pinned_repo && $line =~ ^\[[^]]+\]$ && $line != "[options]" && $pinned_repo_inserted == 0 ]]; then
-    printf '[try-omarchy-pinned-cache]\n'
-    printf 'SigLevel = Required DatabaseOptional\n'
-    printf 'Server = file://%s\n\n' "$pinned_repo"
-    pinned_repo_inserted=1
-  fi
-  printf '%s\n' "$line"
-  if [[ $line == "[options]" ]]; then
-    printf 'CacheDir = %s\n' "$package_cache"
-    if [[ ${OMARCHY_PACMAN_DISABLE_SANDBOX:-0} == "1" ]]; then
-      printf 'DisableSandbox\n'
-    fi
-    options_sections=$((options_sections + 1))
-  fi
-done <"$upstream_pacman_config" >"$pacman_config"
-(( options_sections == 1 )) || fail "pinned pacman configuration must contain one [options] section"
-(( ${#pinned_records[@]} == 0 || pinned_repo_inserted == 1 )) \
-  || fail "pinned pacman configuration does not contain a repository section"
+# Guest pacman.conf is installed unchanged by configure-rootfs. The builder copy
+# may add reviewed ABI pins (packages mirrors no longer publish) and must drop
+# those names from IgnorePkg so the empty-root transaction can install them once.
+abi_pin_count=$(python3 -c 'import json,sys; print(len(json.load(open(sys.argv[1])).get("inputs", {}).get("abiPackagePins", [])))' "$spec")
+builder_conf_args=(
+  python3 "$guest_dir/scripts/write-builder-pacman-conf.py"
+  --spec "$spec"
+  --guest-dir "$guest_dir"
+  --guest-config "$upstream_pacman_config"
+  --package-lock "$package_lock_file"
+  --output "$pacman_config"
+  --package-cache "$package_cache"
+)
+if [[ ${OMARCHY_PACMAN_DISABLE_SANDBOX:-0} == "1" ]]; then
+  builder_conf_args+=(--disable-sandbox)
+fi
+if (( abi_pin_count > 0 )); then
+  abi_pin_repo=$(mktemp -d "$work/abi-pin-repo.XXXXXX")
+  "$guest_dir/scripts/build-pinned-abi-packages.sh" \
+    --spec "$spec" \
+    --guest-dir "$guest_dir" \
+    --output-repo "$abi_pin_repo" \
+    --work "$work" || fail "could not rebuild the reviewed ABI pins"
+  builder_conf_args+=(--abi-repo "$abi_pin_repo")
+fi
+if [[ -n $pinned_repo ]]; then
+  builder_conf_args+=(--pinned-cache-repo "$pinned_repo")
+fi
+"${builder_conf_args[@]}" || fail "could not derive the factory builder pacman configuration"
 
 # Resolve against an empty target database and require the reviewed transitive
 # version lock before any multi-gigabyte package transaction begins.