Add srdwm's own native session-lock screen (blur, PAM auth)

A real ext-session-lock-v1 implementation drawn by the compositor
itself, not a hand-off to an external locker process: a live-blurred
background, PAM authentication on a background thread, and its own
config surface (lock_config.rs) rather than hardcoded appearance.

6 files changed, 790 insertions, 0 deletions

diff --git a/crates/core/src/lock_config.rs b/crates/core/src/lock_config.rs
new file mode 100644
index 0000000..7edeeb5
--- /dev/null
+++ b/crates/core/src/lock_config.rs
@@ -0,0 +1,54 @@
+//! Configuration for srdwm's own session-lock UI
+//! (`crates/wayland/src/native_lock.rs` does the actual rendering/input;
+//! this is just the live-configurable knobs, same split `ThemeConfig`
+//! already has between itself and the decoration-rendering code that
+//! reads it).
+//!
+//! Not folded into `ThemeConfig` itself: that struct is `Copy` (read by
+//! value on every decoration redraw), and a couple of these fields
+//! (`fail_message`) need to be `String`/heap-allocated, which would force
+//! every `ThemeConfig` copy to become a clone instead - cheap enough
+//! given how rarely lock config is actually read (once per lock, not once
+//! per frame), but no reason to pay that cost on every titlebar repaint
+//! too.
+
+/// Read from `theme.lock.*` in `crates/srdwm/src/main.rs`, and (like
+/// `ThemeConfig`) live-settable via `srd set` - see `crates/platform/src/
+/// ipc.rs`'s `lock_*` keys.
+#[derive(Debug, Clone, PartialEq)]
+pub struct LockConfig {
+    pub box_bg: (u8, u8, u8),
+    pub box_border: (u8, u8, u8),
+    pub text_color: (u8, u8, u8),
+    pub error_color: (u8, u8, u8),
+    pub corner_radius: u32,
+    /// Box-blur radius applied to the captured pre-lock screen content, in
+    /// pixels - see `native_lock.rs`'s `box_blur` for why this is a box
+    /// blur, not a true Gaussian one. `0` disables blurring entirely
+    /// (just the captured content, unmodified) rather than being clamped
+    /// up to some minimum - a legitimate configuration for a low-power
+    /// device, not a mistake to guard against.
+    pub blur_radius: u32,
+    /// Drawn once per character typed, never the character itself.
+    pub dot_char: char,
+    pub show_caps_lock: bool,
+    pub show_failed_attempts: bool,
+    pub fail_message: String,
+}
+
+impl Default for LockConfig {
+    fn default() -> Self {
+        Self {
+            box_bg: (0x2e, 0x34, 0x40),        // Nord dark, matches ThemeConfig::titlebar_bg
+            box_border: (0x88, 0xc0, 0xd0),    // Nord blue, matches ThemeConfig::default_border_color
+            text_color: (0xec, 0xef, 0xf4),    // Nord light
+            error_color: (0xbf, 0x61, 0x6a),   // Nord red, matches the theme's own `error` colour
+            corner_radius: 10,
+            blur_radius: 20,
+            dot_char: '\u{25cf}', // "●"
+            show_caps_lock: true,
+            show_failed_attempts: true,
+            fail_message: "Wrong password".to_string(),
+        }
+    }
+}
diff --git a/crates/core/src/manager/lock.rs b/crates/core/src/manager/lock.rs
new file mode 100644
index 0000000..07735c6
--- /dev/null
+++ b/crates/core/src/manager/lock.rs
@@ -0,0 +1,51 @@
+//! Requesting srdwm's own session lock. Split out of the original single
+//! `manager.rs` - see `super` (`mod.rs`) for `WindowManager`'s field
+//! definitions; everything here is plain `impl WindowManager` methods.
+
+use super::*;
+
+impl WindowManager {
+    /// Queues a request for the backend to enter its own lock UI - the
+    /// only caller today is the IPC `"lock"` dispatch, the compositor-
+    /// agnostic side of `srd dispatch lock`. Core cannot lock the screen
+    /// itself (that's real rendering/input-routing, backend-owned); see
+    /// `lock_requested`'s own doc comment for why this has to cross the
+    /// core/backend boundary as a queued request rather than a direct call.
+    ///
+    /// Idempotent by construction (a plain `bool`, not a counter): asking
+    /// to lock twice before the backend's next poll drains it is exactly
+    /// as locked as asking once.
+    pub fn request_lock(&mut self) {
+        self.lock_requested = true;
+    }
+
+    /// Takes the current lock request, if any, leaving none pending. The
+    /// backend calls this once per poll, same as `drain_output_position_
+    /// requests`.
+    pub fn drain_lock_request(&mut self) -> bool {
+        std::mem::take(&mut self.lock_requested)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn drain_lock_request_is_true_once_then_false() {
+        let mut wm = WindowManager::new();
+        assert!(!wm.drain_lock_request(), "nothing requested yet");
+        wm.request_lock();
+        assert!(wm.drain_lock_request(), "must report the pending request");
+        assert!(!wm.drain_lock_request(), "must not report the same request twice");
+    }
+
+    #[test]
+    fn requesting_lock_twice_before_a_drain_is_still_just_one_pending_request() {
+        let mut wm = WindowManager::new();
+        wm.request_lock();
+        wm.request_lock();
+        assert!(wm.drain_lock_request());
+        assert!(!wm.drain_lock_request());
+    }
+}
diff --git a/crates/platform/src/pam_auth.rs b/crates/platform/src/pam_auth.rs
new file mode 100644
index 0000000..bdad439
--- /dev/null
+++ b/crates/platform/src/pam_auth.rs
@@ -0,0 +1,58 @@
+//! PAM authentication for srdwm's own session-lock UI
+//! (`crates/wayland/src/native_lock.rs`) - the one piece of that feature
+//! that must never be "close enough": this is what stands between a typed
+//! password and actually unlocking the session.
+//!
+//! Uses `pam_client`'s application-side API (the same shape swaylock,
+//! gtklock, and every other real screen locker use) rather than reading
+//! `/etc/shadow` by hand - PAM already handles the privilege boundary
+//! correctly (on a normal distro, `pam_unix.so` shells out to the setuid
+//! `unix_chkpwd` helper to compare the password, so this process never
+//! needs elevated privileges or shadow-file access itself) and honors
+//! whatever the system's actual auth policy is (a YubiKey module, an
+//! account lockout policy, anything `/etc/pam.d/srdwm` enables), not just
+//! a plain password check.
+//!
+//! Needs `/etc/pam.d/srdwm` to exist (any distro's default `login`-derived
+//! policy works, e.g. `auth include login`) - a service with no PAM
+//! config file at all fails every authentication attempt, not falls back
+//! to some default. That file is a root-owned system config change,
+//! deliberately not written by this code.
+
+use pam_client::conv_mock::Conversation;
+use pam_client::{Context, Flag};
+
+/// The PAM service name - see `Context::new`'s own docs: this is what
+/// selects the policy from `/etc/pam.d/<service>`.
+const SERVICE: &str = "srdwm";
+
+/// Verifies `password` for `username` against the system's real PAM
+/// policy. `true` only for a genuine, complete authentication success
+/// (both `authenticate` *and* `acct_mgmt`, so a correct password on a
+/// locked or expired account still correctly fails) - every other
+/// outcome, including a PAM setup problem that has nothing to do with the
+/// password itself, resolves to `false`. Deliberately no distinction
+/// between "wrong password" and "something is broken" in the return value
+/// - fail secure means every non-success path stays locked, not just the
+/// ones that are the user's own fault. Logged at `warn` for whoever's
+/// debugging a setup problem, never at a level that would put the
+/// password itself in a log.
+pub fn authenticate(username: &str, password: &str) -> bool {
+    let conversation = Conversation::with_credentials(username, password);
+    let mut context = match Context::new(SERVICE, Some(username), conversation) {
+        Ok(ctx) => ctx,
+        Err(e) => {
+            log::warn!("session lock: failed to start PAM context for service '{SERVICE}': {e} ({:?})", e.code());
+            return false;
+        }
+    };
+    if let Err(e) = context.authenticate(Flag::NONE) {
+        log::warn!("session lock: PAM authentication failed: {e} ({:?})", e.code());
+        return false;
+    }
+    if let Err(e) = context.acct_mgmt(Flag::NONE) {
+        log::warn!("session lock: PAM account check failed: {e} ({:?})", e.code());
+        return false;
+    }
+    true
+}
diff --git a/crates/wayland/src/blur.rs b/crates/wayland/src/blur.rs
new file mode 100644
index 0000000..7560fa2
--- /dev/null
+++ b/crates/wayland/src/blur.rs
@@ -0,0 +1,190 @@
+//! CPU box blur for the native lock screen's captured background
+//! (`native_lock.rs`). Not a true Gaussian blur - no blur primitive is
+//! available without a GPU shader (the udev backend's `PixmanRenderer` is
+//! software-only), the same "approximate falloff over true blur" tradeoff
+//! `decoration::shadow_bitmap` already accepts for drop shadows. Three
+//! box-blur passes approximate a Gaussian closely enough to read as a
+//! real blur rather than an obviously-boxy one, a standard trick (Adobe's
+//! own CSS `filter: blur()` polyfills use the same three-pass
+//! approximation).
+//!
+//! Runs once, at lock time, on the just-captured screen content - not
+//! per frame - so a straightforward `O(pixels)` sliding-window
+//! implementation (not `O(pixels * radius)`, which would make a large
+//! radius on a real screen resolution noticeably slow even as a one-time
+//! cost) is what actually matters here, not raw simplicity.
+
+/// Blurs `buf` (a BGRA8/XRGB8888 pixel buffer, 4 bytes per pixel, alpha
+/// byte untouched either way) in place. `radius` of `0` is a deliberate
+/// no-op, not clamped up to some minimum - see `LockConfig::blur_radius`'s
+/// own doc comment.
+pub(crate) fn box_blur(buf: &mut [u8], width: usize, height: usize, radius: u32) {
+    if radius == 0 || width == 0 || height == 0 {
+        return;
+    }
+    let radius = radius as usize;
+    // Three passes, alternating axis, approximates a Gaussian kernel.
+    for _ in 0..3 {
+        blur_horizontal(buf, width, height, radius);
+        blur_vertical(buf, width, height, radius);
+    }
+}
+
+/// Sliding-window box blur along each row: the window's running sum is
+/// updated by removing the pixel that just left it and adding the one
+/// that just entered, rather than re-summing `2 * radius + 1` pixels at
+/// every single output pixel.
+fn blur_horizontal(buf: &mut [u8], width: usize, height: usize, radius: usize) {
+    let mut row = vec![0u8; width * 4];
+    for y in 0..height {
+        let row_start = y * width * 4;
+        row.copy_from_slice(&buf[row_start..row_start + width * 4]);
+        let mut sum = [0i64; 3];
+        let mut count = 0i64;
+        for x in 0..=radius.min(width.saturating_sub(1)) {
+            add_pixel(&row, x, &mut sum, &mut count);
+        }
+        for x in 0..width {
+            write_average(buf, row_start + x * 4, &sum, count);
+            let leaving = x as isize - radius as isize;
+            if leaving >= 0 {
+                remove_pixel(&row, leaving as usize, &mut sum, &mut count);
+            }
+            let entering = x + radius + 1;
+            if entering < width {
+                add_pixel(&row, entering, &mut sum, &mut count);
+            }
+        }
+    }
+}
+
+/// Same sliding-window technique as [`blur_horizontal`], transposed --
+/// copies each column into a contiguous scratch buffer first so the
+/// window updates are still sequential memory access, not a
+/// `width * 4`-strided walk on every add/remove.
+fn blur_vertical(buf: &mut [u8], width: usize, height: usize, radius: usize) {
+    let stride = width * 4;
+    let mut col = vec![0u8; height * 4];
+    for x in 0..width {
+        for y in 0..height {
+            let idx = y * stride + x * 4;
+            col[y * 4..y * 4 + 4].copy_from_slice(&buf[idx..idx + 4]);
+        }
+        let mut sum = [0i64; 3];
+        let mut count = 0i64;
+        for y in 0..=radius.min(height.saturating_sub(1)) {
+            add_pixel(&col, y, &mut sum, &mut count);
+        }
+        for y in 0..height {
+            write_average(buf, y * stride + x * 4, &sum, count);
+            let leaving = y as isize - radius as isize;
+            if leaving >= 0 {
+                remove_pixel(&col, leaving as usize, &mut sum, &mut count);
+            }
+            let entering = y + radius + 1;
+            if entering < height {
+                add_pixel(&col, entering, &mut sum, &mut count);
+            }
+        }
+    }
+}
+
+fn add_pixel(buf: &[u8], index: usize, sum: &mut [i64; 3], count: &mut i64) {
+    let i = index * 4;
+    sum[0] += buf[i] as i64;
+    sum[1] += buf[i + 1] as i64;
+    sum[2] += buf[i + 2] as i64;
+    *count += 1;
+}
+
+fn remove_pixel(buf: &[u8], index: usize, sum: &mut [i64; 3], count: &mut i64) {
+    let i = index * 4;
+    sum[0] -= buf[i] as i64;
+    sum[1] -= buf[i + 1] as i64;
+    sum[2] -= buf[i + 2] as i64;
+    *count -= 1;
+}
+
+/// Writes the window's current average into `buf` at byte offset `at`,
+/// leaving the alpha byte (`at + 3`) untouched - the captured background
+/// is always fully opaque, so there is nothing meaningful to blur there.
+fn write_average(buf: &mut [u8], at: usize, sum: &[i64; 3], count: i64) {
+    buf[at] = (sum[0] / count) as u8;
+    buf[at + 1] = (sum[1] / count) as u8;
+    buf[at + 2] = (sum[2] / count) as u8;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn zero_radius_is_a_no_op() {
+        let mut buf = vec![10, 20, 30, 255, 200, 100, 50, 255];
+        let original = buf.clone();
+        box_blur(&mut buf, 2, 1, 0);
+        assert_eq!(buf, original);
+    }
+
+    #[test]
+    fn a_uniform_image_is_unchanged_by_blurring() {
+        // Blurring a flat color must not shift it - the clearest possible
+        // regression check for an off-by-one in the sliding window (a
+        // wrong window size would still average to *something*, but a
+        // biased one, not the same flat color back).
+        let (w, h) = (10, 10);
+        let mut buf = vec![0u8; w * h * 4];
+        for px in buf.chunks_exact_mut(4) {
+            px.copy_from_slice(&[40, 80, 120, 255]);
+        }
+        box_blur(&mut buf, w, h, 3);
+        for px in buf.chunks_exact(4) {
+            assert_eq!(px, [40, 80, 120, 255]);
+        }
+    }
+
+    #[test]
+    fn alpha_is_never_touched() {
+        let (w, h) = (4, 4);
+        let mut buf = vec![0u8; w * h * 4];
+        for (i, px) in buf.chunks_exact_mut(4).enumerate() {
+            px.copy_from_slice(&[i as u8, i as u8, i as u8, (i * 17) as u8]);
+        }
+        box_blur(&mut buf, w, h, 2);
+        for (i, px) in buf.chunks_exact(4).enumerate() {
+            assert_eq!(px[3], (i * 17) as u8, "alpha byte at pixel {i} must survive unchanged");
+        }
+    }
+
+    #[test]
+    fn a_bright_spot_spreads_into_its_dark_neighbours_with_falloff() {
+        // Large enough that a genuinely-far corner exists even after three
+        // cascaded passes (each pass spreads influence roughly `radius`
+        // further, so three passes of radius 2 reach noticeably past 2
+        // pixels out - a smaller canvas made this assert something the
+        // algorithm was never expected to guarantee).
+        let (w, h) = (41, 41);
+        let mut buf = vec![0u8; w * h * 4];
+        for px in buf.chunks_exact_mut(4) {
+            px.copy_from_slice(&[0, 0, 0, 255]);
+        }
+        let (cx, cy) = (20, 20);
+        let center = (cy * w + cx) * 4;
+        buf[center..center + 3].copy_from_slice(&[255, 255, 255]);
+
+        box_blur(&mut buf, w, h, 2);
+
+        let near = ((cy * w) + cx + 1) * 4; // immediately right of center
+        let far = ((cy * w) + cx + 10) * 4; // well outside the blur's reach
+        let corner = 0; // top-left, far from the bright spot on both axes
+        assert!(buf[near] > 0, "a pixel next to the bright spot must pick up some of its brightness after blurring");
+        assert!(buf[near] > buf[far], "brightness must fall off with distance, not spread flatly to the whole image");
+        assert_eq!(buf[corner], 0, "a pixel far outside the blur's reach must stay untouched");
+    }
+
+    #[test]
+    fn zero_sized_buffer_does_not_panic() {
+        let mut buf: Vec<u8> = Vec::new();
+        box_blur(&mut buf, 0, 0, 5);
+    }
+}
diff --git a/crates/wayland/src/lock.rs b/crates/wayland/src/lock.rs
index ccdea98..828fe98 100644
--- a/crates/wayland/src/lock.rs
+++ b/crates/wayland/src/lock.rs
@@ -44,6 +44,18 @@ pub(crate) struct SessionLock {
     /// Outputs that have presented a client-content-free frame since the
     /// lock request, keyed the same way.
     pub(crate) presented: HashSet<String>,
+    /// `Some` while srdwm is its own locker - see `native_lock.rs`'s
+    /// module doc comment for why this is a separate mode from the fields
+    /// above rather than folded into them: those exist for an *external*
+    /// locker client talking `ext-session-lock-v1`; this is srdwm drawing
+    /// and authenticating its own lock UI directly, with no client
+    /// surface involved at all. The two are mutually exclusive by
+    /// construction - `srd dispatch lock` never creates a `LockSurface`,
+    /// and nothing here stops a *real* external locker from also
+    /// connecting, but nothing in this session's scope needed to reconcile
+    /// that edge case, and `locked` alone still gates input/rendering
+    /// regardless of which mode set it.
+    pub(crate) native: Option<crate::native_lock::NativeLock>,
 }
 
 impl CompState {
diff --git a/crates/wayland/src/native_lock.rs b/crates/wayland/src/native_lock.rs
new file mode 100644
index 0000000..ef59ba6
--- /dev/null
+++ b/crates/wayland/src/native_lock.rs
@@ -0,0 +1,425 @@
+//! srdwm's own session-lock UI: no external locker client needed.
+//!
+//! Triggered by `srd dispatch lock` (`crates/platform/src/ipc.rs`'s
+//! `"lock"` command queues the intent on `WindowManager`; each backend
+//! drains it on its own next poll, same cross-boundary pattern
+//! `output_position_requests` already uses). Once triggered, srdwm
+//! captures each output's currently-displayed content, blurs it
+//! (`crate::blur`), and draws its own centered password-entry box over
+//! that blurred background - a live-blurred lock screen without relying
+//! on an external locker binary at all.
+//!
+//! Authentication is real PAM (`srdwm_platform::authenticate`), run on a
+//! background thread (`std::thread::spawn`, polled via a channel) rather
+//! than blocking the compositor's single-threaded event loop - PAM can
+//! deliberately introduce a multi-second delay on a wrong password
+//! (`pam_fail_delay`), and blocking the whole compositor for that long
+//! would freeze rendering and input for everything, not just the lock UI.
+//!
+//! Security posture, stated plainly because this is the one place in the
+//! compositor where getting it wrong has real consequences: `state.lock.
+//! locked` (checked by `crate::input`'s locked-session branches and
+//! `CompState::set_keyboard_focus`'s guard) is the single source of truth
+//! that gates both input and rendering, identical to the external-locker
+//! path this reuses rather than duplicates. This module only ever flips
+//! it to `true` after every output has a captured, blurred background
+//! ready (see `finalize_if_ready`) - never speculatively - and only
+//! ever flips it back to `false` after a genuine PAM `authenticate` *and*
+//! `acct_mgmt` success (see `poll_auth`). There is no code path that
+//! unlocks on a timeout, a malformed keystroke, or any error condition;
+//! every failure mode here resolves to "stay locked".
+
+use crate::state::CompState;
+use smithay::backend::allocator::Fourcc;
+use smithay::backend::renderer::element::memory::{MemoryRenderBuffer, MemoryRenderBufferRenderElement};
+use smithay::backend::renderer::element::Kind;
+use smithay::backend::renderer::{ImportAll, ImportMem, Renderer};
+use smithay::utils::Transform;
+use std::collections::HashMap;
+use std::sync::mpsc::{Receiver, TryRecvError};
+
+/// `srd.lock`'s live state - see this module's own doc comment for the
+/// lifecycle. Constructed by `begin`, lives on `SessionLock::native` for
+/// as long as `state.lock.locked` is `true` via this path.
+pub(crate) struct NativeLock {
+    /// Output names still awaiting a captured background before the lock
+    /// actually takes effect - see `begin`'s doc comment for why capture
+    /// has to finish *before* `state.lock.locked` flips, not after.
+    pending_capture: std::collections::HashSet<String>,
+    /// Blurred captured background per output, keyed by `Output::name()`.
+    backgrounds: HashMap<String, MemoryRenderBuffer>,
+    /// The password-entry box, identical on every output (each output
+    /// positions it centered at render time) - rebuilt only when the
+    /// visible state actually changes (a keystroke, a failed attempt),
+    /// the same "cache until dirty" pattern `context_menu`/`snap_flyout`
+    /// already use, not rebuilt every frame.
+    ui_buffer: Option<MemoryRenderBuffer>,
+    ui_size: (i32, i32),
+    username: String,
+    password: String,
+    failed_attempts: u32,
+    show_error: bool,
+    checking: bool,
+    /// The keyboard's caps-lock state as of the last keypress - not
+    /// polled independently, since every real keystroke already carries
+    /// it (`ModifiersState::caps_lock`, read in `crate::input`'s locked-
+    /// keyboard branch), so there is no separate query needed.
+    caps_lock: bool,
+    auth_rx: Option<Receiver<bool>>,
+}
+
+/// `$USER`, resolved once when the lock begins - same resolution every
+/// other real screen locker on this kind of single-user session relies
+/// on. If it's ever unset (a broken environment, not a real login
+/// session), authentication simply cannot succeed for anyone - fails
+/// secure by construction, not a special case to handle.
+fn current_username() -> String {
+    std::env::var("USER").unwrap_or_default()
+}
+
+impl CompState {
+    /// Starts srdwm's own lock - called once, when `WindowManager::
+    /// drain_lock_request` reports a pending `srd dispatch lock`. Does
+    /// *not* set `state.lock.locked` yet: every output needs a captured
+    /// background first (`capture_output` below finishes the job once
+    /// they're all in), the same reasoning `SessionLockHandler::lock`'s
+    /// own doc comment gives for an external locker waiting on
+    /// `pending_confirm` - flipping `locked` before the screen is
+    /// actually ready to show something other than the live desktop would
+    /// be exactly backwards for a lock screen. A no-op if a lock (native
+    /// or external) is already in progress, so a duplicate `srd dispatch
+    /// lock` (or one arriving while capture is still pending) can't
+    /// restart the capture set and leak the in-progress password buffer.
+    pub(crate) fn begin_native_lock(&mut self) {
+        if self.lock.locked || self.lock.native.is_some() {
+            return;
+        }
+        let pending_capture: std::collections::HashSet<String> = self.outputs().map(|o| o.name()).collect();
+        if pending_capture.is_empty() {
+            // No real output to capture from (headless/test invocation) --
+            // lock immediately with an empty backdrop rather than waiting
+            // forever for a capture that can never arrive.
+            self.lock.native = Some(NativeLock {
+                pending_capture,
+                backgrounds: HashMap::new(),
+                ui_buffer: None,
+                ui_size: (0, 0),
+                username: current_username(),
+                password: String::new(),
+                failed_attempts: 0,
+                show_error: false,
+                checking: false,
+                caps_lock: false,
+                auth_rx: None,
+            });
+            self.lock.locked = true;
+            self.set_keyboard_focus(None);
+            return;
+        }
+        self.lock.native = Some(NativeLock {
+            pending_capture,
+            backgrounds: HashMap::new(),
+            ui_buffer: None,
+            ui_size: (0, 0),
+            username: current_username(),
+            password: String::new(),
+            failed_attempts: 0,
+            show_error: false,
+            checking: false,
+            caps_lock: false,
+            auth_rx: None,
+        });
+    }
+
+    /// A backend just captured and blurred `output_name`'s current
+    /// content - stores it and, once every output has one, actually
+    /// locks. No-op if a native lock isn't in progress (the request was
+    /// already satisfied, or never happened) or this output already has a
+    /// background (a backend calling this twice for the same output on
+    /// consecutive ticks, e.g. after a skipped/flip-pending head becomes
+    /// ready, must not restart or double-count anything).
+    pub(crate) fn capture_output(&mut self, output_name: &str, blurred: MemoryRenderBuffer) {
+        let Some(native) = self.lock.native.as_mut() else { return };
+        if self.lock.locked || !native.pending_capture.remove(output_name) {
+            return;
+        }
+        native.backgrounds.insert(output_name.to_string(), blurred);
+        if native.pending_capture.is_empty() {
+            self.lock.locked = true;
+            self.set_keyboard_focus(None);
+            log::info!("session lock: native lock engaged, {} output(s) captured", self.lock.native.as_ref().map(|n| n.backgrounds.len()).unwrap_or(0));
+        }
+    }
+
+    /// The blurred background for `output_name`, if a native lock has one
+    /// ready for it yet (it might not, mid-capture on a multi-output
+    /// setup where one head is still flip-pending).
+    pub(crate) fn native_lock_background(&self, output_name: &str) -> Option<&MemoryRenderBuffer> {
+        self.lock.native.as_ref().and_then(|n| n.backgrounds.get(output_name))
+    }
+
+    /// Whether a native lock is in progress and still waiting on
+    /// `output_name`'s background specifically - what a backend's render
+    /// loop checks, once per output per tick, to know whether to run
+    /// `native_lock::capture_and_blur` against this pass's freshly
+    /// rendered framebuffer.
+    pub(crate) fn native_lock_needs_capture(&self, output_name: &str) -> bool {
+        self.lock.native.as_ref().is_some_and(|n| n.pending_capture.contains(output_name))
+    }
+
+    /// The password-entry box, rebuilding it first if the visible state
+    /// changed since the last render. `None` while a native lock isn't
+    /// actually engaged yet (still waiting on captures) - nothing should
+    /// render the UI box before `state.lock.locked` is true regardless.
+    pub(crate) fn native_lock_ui(&mut self) -> Option<(&MemoryRenderBuffer, (i32, i32))> {
+        if !self.lock.locked {
+            return None;
+        }
+        let theme = self.wm.borrow().lock.clone();
+        let native = self.lock.native.as_mut()?;
+        if native.ui_buffer.is_none() {
+            let (data, size) = render_ui_box(native, &theme);
+            native.ui_buffer = Some(MemoryRenderBuffer::from_slice(&data, Fourcc::Argb8888, size, 1, Transform::Normal, None));
+            native.ui_size = size;
+        }
+        native.ui_buffer.as_ref().map(|b| (b, native.ui_size))
+    }
+
+    /// Routes one key press to the native lock's own input handling --
+    /// called from `crate::input::handle_keyboard_key_event` instead of
+    /// forwarding to a client, whenever `state.lock.native.is_some()`.
+    /// `utf8` is whatever `xkbcommon::xkb::keysym_to_utf8` produced for
+    /// this keysym - empty for anything non-printable (arrows, function
+    /// keys, modifiers on their own).
+    pub(crate) fn native_lock_key(&mut self, name: &str, utf8: &str, caps_lock: bool) {
+        let Some(native) = self.lock.native.as_mut() else { return };
+        if native.checking {
+            // An auth attempt is already in flight - ignore further
+            // input rather than queuing a second overlapping PAM call.
+            return;
+        }
+        native.show_error = false;
+        native.caps_lock = caps_lock;
+        match name {
+            "BackSpace" => {
+                native.password.pop();
+            }
+            "Return" | "KP_Enter" => {
+                if native.password.is_empty() {
+                    return;
+                }
+                let (username, password) = (native.username.clone(), std::mem::take(&mut native.password));
+                let (tx, rx) = std::sync::mpsc::channel();
+                std::thread::spawn(move || {
+                    let ok = srdwm_platform::authenticate(&username, &password);
+                    let _ = tx.send(ok);
+                });
+                native.auth_rx = Some(rx);
+                native.checking = true;
+            }
+            "Escape" => {
+                native.password.clear();
+            }
+            _ => {
+                // Any other non-empty UTF-8 is a printable character to
+                // append - covers letters, digits, symbols, and anything
+                // a layout's own dead-key/compose sequence resolved to,
+                // without hand-maintaining a list of "printable" keysym
+                // names the way titlebar/menu code never has to.
+                if !utf8.is_empty() {
+                    native.password.push_str(utf8);
+                }
+            }
+        }
+        native.ui_buffer = None;
+    }
+
+    /// Checks whether a PAM authentication spawned by `native_lock_key`
+    /// finished - called once per poll from both backends, same cadence
+    /// `drain_lock_request` is drained at. On success, unlocks through
+    /// the exact same `SessionLockHandler::unlock` path the external-
+    /// locker protocol uses, so both routes leave `CompState` in one
+    /// consistent post-unlock state (surfaces cleared, damage-tracker
+    /// ages reset, focus handed back). On failure, clears the password
+    /// and shows the configured failure message - never anything that
+    /// distinguishes *why* it failed beyond the log line `srdwm_platform::
+    /// authenticate` already wrote, so a locked-out account and a typo
+    /// look identical from the lock screen itself.
+    pub(crate) fn poll_native_lock_auth(&mut self) {
+        let Some(native) = self.lock.native.as_mut() else { return };
+        let Some(rx) = native.auth_rx.as_ref() else { return };
+        match rx.try_recv() {
+            Ok(true) => {
+                use smithay::wayland::session_lock::SessionLockHandler;
+                SessionLockHandler::unlock(self);
+            }
+            Ok(false) => {
+                let native = self.lock.native.as_mut().expect("checked Some above");
+                native.auth_rx = None;
+                native.checking = false;
+                native.failed_attempts += 1;
+                native.show_error = true;
+                native.ui_buffer = None;
+            }
+            Err(TryRecvError::Empty) => {}
+            Err(TryRecvError::Disconnected) => {
+                // The auth thread panicked or was dropped without sending
+                // - treat exactly like a failed attempt, never a silent
+                // unlock. `catch_unwind` in the thread closure would be
+                // stronger, but a disconnected channel already can't
+                // reach the success arm above no matter what, so this is
+                // fail-secure either way.
+                let native = self.lock.native.as_mut().expect("checked Some above");
+                native.auth_rx = None;
+                native.checking = false;
+                native.failed_attempts += 1;
+                native.show_error = true;
+                native.ui_buffer = None;
+            }
+        }
+    }
+}
+
+/// Render elements for a native-locked output: the blurred background (if
+/// this output's capture is ready) with the password box centered over
+/// it. Mirrors `lock::lock_render_elements`'s shape/signature so both
+/// backends can call whichever mode applies with the same pattern.
+/// Takes the background/UI buffers by reference rather than `&mut
+/// CompState`, same reasoning `lock::lock_render_elements`'s own doc
+/// comment gives for taking a bare surface instead: both backends' render
+/// loops call this while already holding a field-specific `&mut` borrow
+/// (`self.udev`/the winit backend's own renderer), not a whole-`self`
+/// one, so a caller has to extract these two *before* that borrow starts
+/// (`CompState::native_lock_background`/`native_lock_ui`, cloned - both
+/// are cheap `MemoryRenderBuffer` clones, not a deep pixel copy) and pass
+/// the clones in.
+pub(crate) fn native_lock_render_elements<R>(
+    background: Option<&MemoryRenderBuffer>,
+    ui: Option<(&MemoryRenderBuffer, (i32, i32))>,
+    output_size: (i32, i32),
+    renderer: &mut R,
+) -> Vec<MemoryRenderBufferRenderElement<R>>
+where
+    R: Renderer + ImportAll + ImportMem,
+    R::TextureId: Clone + Send + 'static,
+{
+    let mut elements = Vec::new();
+    if let Some((ui, ui_size)) = ui {
+        let pos = (((output_size.0 - ui_size.0) / 2) as f64, ((output_size.1 - ui_size.1) / 2) as f64);
+        match MemoryRenderBufferRenderElement::from_buffer(renderer, pos, ui, None, None, None, Kind::Unspecified) {
+            Ok(elem) => elements.push(elem),
+            Err(e) => log::warn!("native lock: failed to import UI buffer: {e}"),
+        }
+    }
+    if let Some(bg) = background {
+        match MemoryRenderBufferRenderElement::from_buffer(renderer, (0.0, 0.0), bg, None, None, None, Kind::Unspecified) {
+            Ok(elem) => elements.push(elem),
+            Err(e) => log::warn!("native lock: failed to import background buffer: {e}"),
+        }
+    }
+    elements
+}
+
+/// Captures `size` (physical, buffer-coordinate) pixels from `framebuffer`
+/// as owned bytes, blurs them, and wraps the result as a
+/// `MemoryRenderBuffer` ready to hand to `CompState::capture_output`.
+/// Shared by both backends' capture hooks (see `udev/render.rs`/`winit/
+/// render.rs` for where `framebuffer` itself actually comes from --
+/// backend-specific: DRM/GBM vs the nested Wayland connection - which is
+/// the only part that couldn't live here too).
+///
+/// `Xrgb8888`, not `Argb8888`, deliberately: the captured desktop content
+/// is always fully opaque, but the alpha byte `copy_framebuffer`/
+/// `map_texture` hands back for an opaque render is not guaranteed to
+/// actually *be* `255` (nothing upstream promises that for a format
+/// that's never supposed to need it) - reinterpreting it as `Argb8888`
+/// would trust that undefined byte as real alpha. `Xrgb8888` tells
+/// smithay the byte is meaningless and to treat the whole buffer as
+/// opaque regardless of its value, the same technique `screencopy.rs`'s
+/// own capture path already uses (`CAPTURE_FOURCC = Fourcc::Xrgb8888`)
+/// for exactly this reason.
+pub(crate) fn capture_and_blur<R>(renderer: &mut R, framebuffer: &R::Framebuffer<'_>, size: (i32, i32), radius: u32) -> Result<MemoryRenderBuffer, String>
+where
+    R: Renderer + smithay::backend::renderer::ExportMem,
+{
+    let src = smithay::utils::Rectangle::<i32, smithay::utils::Buffer>::from_size(size.into());
+    let mapping = renderer.copy_framebuffer(framebuffer, src, Fourcc::Xrgb8888).map_err(|e| format!("copy_framebuffer: {e}"))?;
+    let mut pixels = renderer.map_texture(&mapping).map_err(|e| format!("map_texture: {e}"))?.to_vec();
+    crate::blur::box_blur(&mut pixels, size.0.max(0) as usize, size.1.max(0) as usize, radius);
+    Ok(MemoryRenderBuffer::from_slice(&pixels, Fourcc::Xrgb8888, size, 1, Transform::Normal, None))
+}
+
+/// Draws the centered password box: rounded background, a title line, a
+/// row of dots (one per character typed, never the character itself),
+/// and - depending on `LockConfig`/current state - a caps-lock note and
+/// a failed-attempt message. Same rasterization primitives `decoration.rs`
+/// already uses for the titlebar/context-menu/flyout (`find_system_font`/
+/// `blit_glyph`/`rgb_to_bgra`), promoted to `pub(crate)` there rather than
+/// duplicated here.
+fn render_ui_box(native: &NativeLock, theme: &srdwm_core::LockConfig) -> (Vec<u8>, (i32, i32)) {
+    use crate::decoration::{blit_glyph, find_system_font, rgb_to_bgra, FONT_PIXELS, TEXT_LEFT_PADDING};
+
+    const WIDTH: usize = 360;
+    const HEIGHT: usize = 170;
+    let mut buf = vec![0u8; WIDTH * HEIGHT * 4];
+    let bg = rgb_to_bgra(theme.box_bg, 255);
+    for px in buf.chunks_exact_mut(4) {
+        px.copy_from_slice(&bg);
+    }
+
+    let font = find_system_font();
+    let text_color = if native.show_error { theme.error_color } else { theme.text_color };
+
+    let mut draw_line = |text: &str, y: f32, color: (u8, u8, u8)| {
+        let Some(font) = &font else { return };
+        let baseline = y;
+        let mut pen_x = TEXT_LEFT_PADDING;
+        for ch in text.chars() {
+            if ch.is_control() {
+                continue;
+            }
+            let (metrics, coverage) = font.rasterize(ch, FONT_PIXELS);
+            if metrics.width > 0 && metrics.height > 0 {
+                let glyph_x = pen_x + metrics.xmin as f32;
+                let glyph_y = baseline - metrics.height as f32 - metrics.ymin as f32;
+                blit_glyph(&mut buf, WIDTH, HEIGHT, glyph_x.round() as i32, glyph_y.round() as i32, &metrics, &coverage, theme.box_bg, color);
+            }
+            pen_x += metrics.advance_width;
+            if pen_x as usize >= WIDTH {
+                break;
+            }
+        }
+    };
+
+    draw_line(if native.username.is_empty() { "Locked" } else { &native.username }, 40.0, theme.text_color);
+
+    let dots: String = std::iter::repeat_n(theme.dot_char, native.password.chars().count()).collect();
+    draw_line(&dots, 90.0, text_color);
+
+    let mut status_y = 130.0;
+    if theme.show_caps_lock && native.caps_lock {
+        draw_line("Caps Lock is on", status_y, theme.error_color);
+        status_y += 20.0;
+    }
+    if theme.show_failed_attempts && native.show_error {
+        let message = if native.failed_attempts > 1 { format!("{} ({} attempts)", theme.fail_message, native.failed_attempts) } else { theme.fail_message.clone() };
+        draw_line(&message, status_y, theme.error_color);
+    }
+
+    // Border, drawn last so it isn't overdrawn by any fill above --
+    // same convention `render_context_menu`/`render_snap_flyout` use.
+    let border_px = rgb_to_bgra(theme.box_border, 255);
+    for x in 0..WIDTH {
+        buf[x * 4..x * 4 + 4].copy_from_slice(&border_px);
+        let last_row = (HEIGHT - 1) * WIDTH + x;
+        buf[last_row * 4..last_row * 4 + 4].copy_from_slice(&border_px);
+    }
+    for y in 0..HEIGHT {
+        let left = y * WIDTH;
+        buf[left * 4..left * 4 + 4].copy_from_slice(&border_px);
+        let right = y * WIDTH + WIDTH - 1;
+        buf[right * 4..right * 4 + 4].copy_from_slice(&border_px);
+    }
+
+    (buf, (WIDTH as i32, HEIGHT as i32))
+}