[hanthor]

Refs #505 (the tunaOS image and tunaos-packages changes come in separate PRs; see below).

Renames Roost to Tuna Desktop everywhere, following the naming table in #505. The rename is a reproducible, idempotent script, so the ~12 in-flight PRs can rename themselves instead of hand-resolving conflicts.

For other PR authors: how to rebase after this lands

git fetch origin
git rebase origin/main          # conflicts: take your side (git checkout --theirs / resolve to your version), the script fixes the names
scripts/rename-to-tuna          # renames your branch's contents and files; a second run is a no-op
git add -A
git rebase --continue           # or commit, if the rebase already finished

If the rebase stops on a conflict, the easiest route is to resolve each file to your branch's version (old names and all), then run scripts/rename-to-tuna and git add -A before continuing. The script also renames untracked files, re-locks Cargo.lock offline and rustfmts the renamed Rust files. If you add a file named roost-* while tuna-* already exists, it reports the clash instead of overwriting. CI now runs scripts/rename-to-tuna --check, which fails until the old name is gone.

Commits

1. scripts/rename-to-tuna + self-test (scripts/lib/rename-to-tuna-tests.py, run in CI). It covers every rule, the keep list, keep markers, --check, untracked files, git-mv, and the run-twice-is-a-no-op property.
2. Compatibility layer, written by hand:
   • crates/shell-control-schema/src/legacy.rs: each binary copies ROOST_X → TUNA_X at startup. An existing TUNA_X wins, the old names are dropped so children stay quiet, and it logs one deprecation line. The compositor also links ~/.config/tuna, ~/.local/share/tuna{,-shell}, ~/.local/state/tuna-shell and ~/.cache/tuna to their roost counterparts when only the old ones exist, so saved monitors, favorites, notifications, prefs and extensions carry over (rollback-safe). Unit tests cover all of this.
   • Packaging (Arch and Debian): replaces/conflicts/provides=roost, plus /usr/bin/roost-* → tuna-* symlinks for the six binaries.
   • PAM: the lock screen calls PAM by service name (pam.rs DEFAULT_SERVICE), so a compat file is needed. During an in-place upgrade a running session keeps the old lock-screen binary, which asks for roost-lock. Without that file PAM falls back to other (deny), and the session could never unlock. share/compat/pam.d/roost-lock ships as /etc/pam.d/roost-lock, and both PAM files are conffiles/backup.
   • Session entry: tuna.desktop (Name=Tuna Desktop) is the visible entry. Decision: keep roost.desktop as a hidden compat entry (share/compat/wayland-sessions/roost.desktop, NoDisplay=true, Exec=tuna-session). GDM remembers each user's session by file name, so without it upgraded users would silently land in GNOME. I checked GDM's source: libgdm's picker skips NoDisplay, but the daemon still launches a remembered session unless it is Hidden. Our greeter now skips NoDisplay/Hidden entries too, with a test. The rationale is documented in packaging/README.md.
   • check-release-package verifies the compat links, entry, PAM file and package relations. Its fixture tests (installed-deb-proof-tests.py) build the compat layout and include a negative test.
3. The generated rename: the output of scripts/rename-to-tuna on main. Not hand-edited.
4. Hand fixes: the status sentences in README.md, docs/architecture.md and ROADMAP.md that said the rename had not landed yet.

Rebased onto main after #511 and #537. Commit 3 was regenerated by the script, not hand-merged. Re-running the script on commit 2 in a clean worktree reproduces commit 3 byte for byte. The script is idempotent over #511's text: there is no "Tuna Desktop Desktop", and "formerly/previously Roost" prose is kept. #511's dual acceptance of Name=Tuna Desktop or old Name=Roost packages (Marlin sed -E 's/^Name=(Tuna Desktop|Roost)$/…/' and tuna-perf-payload.py) is protected, so it survives.

Keep list (never touched)

Dated evidence (docs/perf/20*, docs/niri-parity/*, docs/marlin/*), the recorded capture tests/protocols/marlin-roost-wayland-info.txt and its digest record marlin-gnome51-source.json (renaming would break the recorded sha256), and the dated docs/test-coverage/2026-10-04-initial-baseline.md. Also third-party/ (including roost_transport_bounds and ROOST-PATCH.md references), .spektacular/, share/compat/, historical …/actions/runs/… links, and lines carrying tuna-rename: keep markers. Living docs under docs/perf/ (README, how-tos) are renamed. tests/a11y/gnome51/ is renamed, a deliberate exception: its comparison.md is generated from those trees plus our goldens and CI checks it (tuna-a11y-baseline check), the GNOME trees only name our *-test-* fixture windows, and nothing records their hashes. Keeping it would fail CI, and a fresh capture would produce the new names anyway. Current repo links hanthor/roost-desktop → tuna-os/tuna-desktop.

XDG_CURRENT_DESKTOP is now Tuna:GNOME, so DesktopNames=Tuna;GNOME;. Portal routing follows because the portals config is renamed to tuna-portals.conf, the file xdg-desktop-portal looks up for desktop Tuna. The OnlyShowIn matching code and tests use Tuna. Trace mark names (Roost::… → Tuna::…) change in the mutter-profiler patches and their parser together; no committed fixture contains them.

Residual git grep -ic roost (outside the keep-list trees)

.github/workflows/ci.yml:1                 roost_transport_bounds (third-party test name)
ROADMAP.md:1, README.md:2, docs/architecture.md:1   "previously/formerly Roost" prose; README names the roost-* compat links
packaging/arch/PKGBUILD (comment), packaging/marlin/Containerfile:2, scripts/lib/tuna-perf-payload{,-tests}.py:3   "formerly Roost" comments and #511's dual Name= acceptance
crates/greeter/src/session.rs:1            include_str! of share/compat/…/roost.desktop
crates/shell-control-schema/src/legacy.rs:33   compat layer
docs/{gnome-parity,niri-parity,parity-ledger,portal-screenshot-consent,protocols,remote-desktop,walkthrough/README-media,xwayland-on-demand}.md, docs/perf/README.md, tests/coverage-floors.json
                                           historical run links, ROOST-PATCH.md, marlin-roost-wayland-info.txt
docs/test-coverage/2026-10-04-initial-baseline.md:7   dated baseline
packaging/README.md:11                     compat documentation
packaging/arch/PKGBUILD:7, scripts/tuna-release:5, scripts/check-release-package:8, scripts/lib/installed-deb-proof.py:1   compat packaging
scripts/rename-to-tuna:40, scripts/lib/rename-to-tuna-tests.py:71   the script and its self-test
share/compat/pam.d/roost-lock:2, share/compat/wayland-sessions/roost.desktop:2   compat files
tests/protocols/marlin-roost-wayland-info.txt:4, tests/protocols/marlin-gnome51-source.json:2   recorded capture + digest

Verified locally

• cargo check --workspace --all-targets --locked: OK. cargo fmt --all -- --check: OK.
• cargo test -p tuna-shell-control: 49 + 29 passed, including 6 legacy:: tests for the env fallback and directory adoption. cargo test -p tuna-greeter --lib session: 7 passed, including the new hidden-entry test.
• All scripts/lib/*-tests.py pass, including rename-to-tuna-tests.py. scripts/tuna-a11y-baseline check and scripts/tuna-settings-inventory-check pass. shellcheck passes on the CI-listed scripts.
• Reproducibility: re-ran the script on the compat commit in a clean worktree. The output is byte-identical to commit 3. scripts/rename-to-tuna --check --no-cargo on the result: no changes, so a re-run is a no-op.
• bash -n / py_compile on every script under scripts/, packaging/, tests/ and .github/: no failures.

CI (head 2f9ebb4)

Green: check (clippy, cargo test --workspace, the rename self-test and --check guard), app-content, arch-package, capture, coverage, drm-smoke, gtk-shell, marlin-image, marlin-vm (real greetd/GDM boot of the renamed session, PAM and portals), niri-parity, portal-security, remote-security, scroll-proof, the fuzz decoders, validate, churn.

Two expected failures:

• journey: the known G-IME-CANDIDATES gate (G-IME-CANDIDATES fails on ubuntu-26.04 journey: typing 'ni' shows no candidate window #526, fixed in fix(proof): return focus to the IME field after GTK 4.16+ popdown #527). Before reaching it, the renamed tuna-desktop_0.1.0_amd64.deb passed check-release-package, compat checks included.
• compare (Marlin performance samples): a bootstrap failure. The job downloads the *-arch package from the latest trusted main CI run. Main still publishes the pre-rename roost-arch/roost package, which the renamed validator correctly refuses. It passes once main has run CI with this PR merged. I did not weaken the validator to accept both.

What tunaOS / tunaos-packages need (separate PRs, not here)

• Package: roost → tuna-desktop (with replaces/conflicts/provides=roost; the PKGBUILD here already declares them). Built package file: tuna-desktop-<ver>-<rel>-x86_64.pkg.tar.zst. Debian: tuna-desktop_<ver>_amd64.deb.
• Source URL: https://github.com/tuna-os/tuna-desktop. Build stamp env: TUNA_VERSION (was ROOST_VERSION; it is read at compile time, so there is no runtime fallback). Local-source env: TUNA_LOCAL_SRC.
• Cargo packages to build: -p tuna-compositor -p tuna-shell-host -p tuna-shell-gtk -p tuna-greeter.
• Binaries: tuna-compositor, tuna-session, tuna-shell-host, tuna-shell-gtk, tuna-ibus-bridge, tuna-greeter, plus roost-* compat symlinks for one release.
• Session file: /usr/share/wayland-sessions/tuna.desktop (Name=Tuna Desktop, Exec=tuna-session, DesktopNames=Tuna;GNOME;), plus the hidden compat roost.desktop. GDM DefaultSession=tuna.desktop; greetd environments tuna-session.
• PAM: /etc/pam.d/tuna-lock (+ compat /etc/pam.d/roost-lock), both backup/conffiles.
• systemd user target: tuna-session.target (was roost-session.target; no compat alias).
• Portals: /usr/share/xdg-desktop-portal/tuna-portals.conf (desktop Tuna).
• Marlin flavor/image: this repo now publishes ghcr.io/tuna-os/tuna-desktop/marlin-tuna-preview (was …/marlin-roost-preview). The nested launcher is tuna-nested-preview.desktop, and the libexec helpers are tuna-image-kernels and tuna-pinned-baseline. Any tunaOS flavor roost → tuna and its manifests/install script should follow.
• The perf workflow's input artifact is now tuna-arch. Selecting a pre-rename main run (artifact roost-arch) will not work.

Not merging: the coordinator lands this after the current wave.

🤖 Generated with Claude Code

https://claude.ai/code/session_016YpFGeYYmfpLzk2LMr8ebX

[hanthor]

Merging after check passed on the regenerated head (c1b9d6a). The full suite passed on the previous base except the known G-IME-CANDIDATES (#526), and compare (it fetches main's last package, which still has the old name; this clears after main's next CI run). The regenerated commit is mechanical: re-running the script reproduces it byte for byte. Main is in a merge freeze until this lands, so other PRs can rebase onto it by running scripts/rename-to-tuna.