rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/tests/c/harness.c

@@ -0,0 +1,109 @@
+/*
+ * punktfunk-core C ABI harness — M1 acceptance.
+ *
+ * Proves the core links from C and round-trips encoded access units through the full
+ * packetize -> FEC -> in-process loopback (with deterministic packet loss) -> FEC
+ * recover -> reassemble path, recovering every byte exactly.
+ *
+ * Build/run: see tests/c/run.sh (also driven by `cargo test --test c_abi`).
+ */
+#include "punktfunk_core.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static PunktfunkConfig make_config(uint32_t role, uint32_t drop_period) {
+    PunktfunkConfig c;
+    memset(&c, 0, sizeof(c));
+    c.struct_size = (uint32_t)sizeof(PunktfunkConfig);
+    c.role = role;                 /* 0 = host, 1 = client */
+    c.phase = 1;                   /* P1, GameStream-compatible */
+    c.fec_scheme = 0;              /* GF(2^8) */
+    c.fec_percent = 25;
+    c.max_data_per_block = 64;
+    c.shard_payload = 1024;
+    c.max_frame_bytes = 8 * 1024 * 1024;
+    c.encrypt = 0;
+    c.loopback_drop_period = drop_period;
+    return c;
+}
+
+int main(void) {
+    printf("punktfunk-core C ABI harness (abi_version=%u)\n", punktfunk_abi_version());
+
+    const uint32_t DROP_PERIOD = 8;   /* drop 1 of every 8 packets */
+    PunktfunkConfig host_cfg = make_config(0, DROP_PERIOD);
+    PunktfunkConfig client_cfg = make_config(1, DROP_PERIOD);
+
+    PunktfunkSession *host = NULL;
+    PunktfunkSession *client = NULL;
+    PunktfunkStatus rc = punktfunk_test_loopback_pair(&host_cfg, &client_cfg, &host, &client);
+    if (rc != PUNKTFUNK_STATUS_OK || !host || !client) {
+        fprintf(stderr, "FAIL: loopback_pair rc=%d\n", (int)rc);
+        return 1;
+    }
+
+    const size_t FRAME_LEN = 200000;  /* ~196 shards across 4 FEC blocks */
+    const int FRAMES = 4;
+    uint8_t *buf = (uint8_t *)malloc(FRAME_LEN);
+    if (!buf) { fprintf(stderr, "FAIL: oom\n"); return 1; }
+
+    int failures = 0;
+    for (int f = 0; f < FRAMES; f++) {
+        for (size_t i = 0; i < FRAME_LEN; i++) {
+            buf[i] = (uint8_t)((i * 131u) + (unsigned)f * 17u);
+        }
+
+        rc = punktfunk_host_submit_frame(host, buf, FRAME_LEN, (uint64_t)f * 1000000u, 0);
+        if (rc != PUNKTFUNK_STATUS_OK) {
+            fprintf(stderr, "FAIL: submit frame %d rc=%d\n", f, (int)rc);
+            failures++;
+            continue;
+        }
+
+        PunktfunkFrame out;
+        memset(&out, 0, sizeof(out));
+        rc = punktfunk_client_poll_frame(client, &out);
+        if (rc != PUNKTFUNK_STATUS_OK) {
+            fprintf(stderr, "FAIL: poll frame %d rc=%d (expected recovery)\n", f, (int)rc);
+            failures++;
+            continue;
+        }
+        if (out.len != FRAME_LEN || memcmp(out.data, buf, FRAME_LEN) != 0) {
+            fprintf(stderr, "FAIL: frame %d mismatch (len=%zu want=%zu)\n",
+                    f, (size_t)out.len, FRAME_LEN);
+            failures++;
+            continue;
+        }
+        if (out.frame_index != (uint32_t)f) {
+            fprintf(stderr, "FAIL: frame %d wrong index %u\n", f, out.frame_index);
+            failures++;
+        }
+    }
+
+    PunktfunkStats st;
+    memset(&st, 0, sizeof(st));
+    punktfunk_get_stats(client, &st);
+    printf("client stats: completed=%llu recovered_shards=%llu dropped_pkts=%llu rx_pkts=%llu\n",
+           (unsigned long long)st.frames_completed,
+           (unsigned long long)st.fec_recovered_shards,
+           (unsigned long long)st.packets_dropped,
+           (unsigned long long)st.packets_received);
+
+    if (st.fec_recovered_shards == 0) {
+        fprintf(stderr, "FAIL: expected FEC to recover lost shards, but recovered 0\n");
+        failures++;
+    }
+
+    free(buf);
+    punktfunk_session_free(host);
+    punktfunk_session_free(client);
+
+    if (failures == 0) {
+        printf("PASS: %d frames round-tripped byte-exact through lossy loopback\n", FRAMES);
+        return 0;
+    }
+    fprintf(stderr, "FAILED with %d errors\n", failures);
+    return 1;
+}

crates/punktfunk-core/tests/c/run.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Build punktfunk-core's staticlib, then compile + link + run the C ABI harness against it.
+# Proves the core links from C. Works on Linux and macOS (link flags come from rustc).
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ws="$(cd "$here/../../../.." && pwd)"   # tests/c -> crates/punktfunk-core -> crates -> ws
+cd "$ws"
+
+profile="${1:-debug}"
+build_flag=""
+[ "$profile" = "release" ] && build_flag="--release"
+
+echo ">> building punktfunk-core staticlib ($profile)"
+cargo build -p punktfunk-core $build_flag >/dev/null
+
+staticlib="$ws/target/$profile/libpunktfunk_core.a"
+header_dir="$ws/include"
+[ -f "$staticlib" ] || { echo "missing $staticlib"; exit 1; }
+[ -f "$header_dir/punktfunk_core.h" ] || { echo "missing generated header"; exit 1; }
+
+# Ask rustc what native libs the staticlib needs to link into a C program.
+native_libs="$(cargo rustc -p punktfunk-core --lib --crate-type staticlib $build_flag -- \
+    --print native-static-libs 2>&1 | sed -n 's/.*native-static-libs: //p' | tail -1)"
+echo ">> native libs: ${native_libs:-<none>}"
+
+out="$(mktemp -d)/punktfunk_harness"
+cc="${CC:-cc}"
+echo ">> compiling + linking harness"
+$cc -std=c11 -Wall -Wextra -O2 -I "$header_dir" \
+    "$here/harness.c" "$staticlib" $native_libs -o "$out"
+
+echo ">> running"
+"$out"

crates/punktfunk-core/tests/c_abi.rs

@@ -0,0 +1,85 @@
+//! Runs the C ABI harness under `cargo test`: compiles `tests/c/harness.c`, links it
+//! against the freshly built `libpunktfunk_core.a`, and asserts it round-trips frames
+//! through the lossy loopback. The cross-platform canonical path (querying rustc for
+//! link flags) is `tests/c/run.sh`; this mirrors it so `cargo test` alone covers the
+//! C boundary.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+/// Native libs the Rust staticlib needs, minus the ones `cc` already links by default
+/// (`-lSystem`/`-lc`), to avoid duplicate-library linker warnings. See
+/// `rustc --print native-static-libs`.
+fn native_libs() -> &'static [&'static str] {
+    if cfg!(target_os = "macos") {
+        &["-liconv", "-lm"]
+    } else if cfg!(target_os = "linux") {
+        &["-lgcc_s", "-lutil", "-lrt", "-lpthread", "-lm", "-ldl"]
+    } else {
+        &[]
+    }
+}
+
+fn ensure_staticlib(profile_dir: &Path) -> PathBuf {
+    let staticlib = profile_dir.join("libpunktfunk_core.a");
+    if !staticlib.exists() {
+        // `cargo test` doesn't always emit the standalone staticlib; build it. The
+        // outer cargo's build lock is released during test execution, so this is safe.
+        let cargo = std::env::var("CARGO").unwrap_or_else(|_| "cargo".into());
+        let _ = Command::new(cargo)
+            .args(["build", "-p", "punktfunk-core"])
+            .status();
+    }
+    staticlib
+}
+
+#[test]
+fn c_abi_harness_round_trips() {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR")); // crates/punktfunk-core
+    let harness = manifest.join("tests/c/harness.c");
+    let include = manifest.join("../../include");
+
+    let exe = std::env::current_exe().expect("current_exe");
+    // .../target/<profile>/deps/c_abi-<hash> -> target/<profile>
+    let profile_dir = exe
+        .parent()
+        .and_then(Path::parent)
+        .expect("profile dir")
+        .to_path_buf();
+
+    let staticlib = ensure_staticlib(&profile_dir);
+    assert!(
+        staticlib.exists(),
+        "staticlib not found at {} (run `cargo build -p punktfunk-core`)",
+        staticlib.display()
+    );
+    assert!(
+        include.join("punktfunk_core.h").exists(),
+        "generated header missing; build punktfunk-core to regenerate it"
+    );
+
+    let cc = std::env::var("CC").unwrap_or_else(|_| "cc".into());
+    let out = profile_dir.join("punktfunk_c_harness");
+
+    let mut compile = Command::new(&cc);
+    compile
+        .args(["-std=c11", "-Wall", "-Wextra", "-O2", "-I"])
+        .arg(&include)
+        .arg(&harness)
+        .arg(&staticlib)
+        .args(native_libs())
+        .arg("-o")
+        .arg(&out);
+
+    match compile.status() {
+        Ok(s) => assert!(s.success(), "C harness failed to compile/link"),
+        Err(e) => {
+            // No C toolchain (unusual) — don't fail the whole suite; run.sh covers CI.
+            eprintln!("skipping C ABI test: cannot invoke `{cc}`: {e}");
+            return;
+        }
+    }
+
+    let run = Command::new(&out).status().expect("run C harness");
+    assert!(run.success(), "C harness reported a round-trip failure");
+}

crates/punktfunk-core/tests/loopback.rs

@@ -0,0 +1,185 @@
+//! M1 acceptance: round-trip access units through the full host→client path
+//! (packetize → FEC → loopback with simulated loss → recover → reassemble) and assert
+//! byte-exact recovery, for both FEC schemes, with and without encryption. Plus
+//! property tests over the FEC layer's loss patterns.
+
+use proptest::prelude::*;
+use punktfunk_core::config::{Config, FecConfig, FecScheme, ProtocolPhase, Role};
+use punktfunk_core::fec::coder_for;
+use punktfunk_core::input::{InputEvent, InputKind};
+use punktfunk_core::session::Session;
+use punktfunk_core::transport::loopback_pair;
+
+fn config(role: Role, scheme: FecScheme, encrypt: bool, drop_period: u32) -> Config {
+    Config {
+        role,
+        phase: match scheme {
+            FecScheme::Gf8 => ProtocolPhase::P1GameStream,
+            FecScheme::Gf16 => ProtocolPhase::P2Punktfunk,
+        },
+        fec: FecConfig {
+            scheme,
+            fec_percent: 25,
+            max_data_per_block: 32,
+        },
+        shard_payload: 1024,
+        max_frame_bytes: 8 * 1024 * 1024,
+        encrypt,
+        key: [7u8; 16],
+        salt: [1, 2, 3, 4],
+        loopback_drop_period: drop_period,
+    }
+}
+
+/// Drive `frames` access units host→client over a lossy loopback and assert each one
+/// comes back byte-identical. Returns the client's final stats.
+fn run_stream(
+    scheme: FecScheme,
+    encrypt: bool,
+    drop_period: u32,
+    frames: &[Vec<u8>],
+) -> punktfunk_core::Stats {
+    let (host_tp, client_tp) = loopback_pair(drop_period, 0);
+    let mut host = Session::new(
+        config(Role::Host, scheme, encrypt, drop_period),
+        Box::new(host_tp),
+    )
+    .unwrap();
+    let mut client = Session::new(
+        config(Role::Client, scheme, encrypt, drop_period),
+        Box::new(client_tp),
+    )
+    .unwrap();
+
+    for (i, frame) in frames.iter().enumerate() {
+        host.submit_frame(frame, i as u64 * 1_000_000, 0).unwrap();
+        let got = client
+            .poll_frame()
+            .expect("frame should recover despite loss");
+        assert_eq!(&got.data, frame, "frame {i} mismatched after recovery");
+        assert_eq!(got.frame_index, i as u32);
+        assert_eq!(got.pts_ns, i as u64 * 1_000_000);
+    }
+    client.stats()
+}
+
+fn sample_frames() -> Vec<Vec<u8>> {
+    (0..5usize)
+        .map(|f| {
+            let len = 1 + f * 40_000; // 1, 40k, 80k, 120k, 160k → single- and multi-block
+            (0..len)
+                .map(|b| (b.wrapping_mul(31).wrapping_add(f * 7)) as u8)
+                .collect()
+        })
+        .collect()
+}
+
+#[test]
+fn gf8_stream_recovers_under_loss() {
+    let frames = sample_frames();
+    // drop_period 8 deletes the 1st of every 8 packets → real data-shard loss.
+    let stats = run_stream(FecScheme::Gf8, false, 8, &frames);
+    assert_eq!(stats.frames_completed, frames.len() as u64);
+    assert!(
+        stats.fec_recovered_shards > 0,
+        "loss should have forced FEC recovery"
+    );
+}
+
+#[test]
+fn gf16_stream_recovers_under_loss() {
+    let frames = sample_frames();
+    let stats = run_stream(FecScheme::Gf16, false, 8, &frames);
+    assert_eq!(stats.frames_completed, frames.len() as u64);
+    assert!(stats.fec_recovered_shards > 0);
+}
+
+#[test]
+fn encrypted_stream_recovers_under_loss() {
+    let frames = sample_frames();
+    let stats = run_stream(FecScheme::Gf8, true, 8, &frames);
+    assert_eq!(stats.frames_completed, frames.len() as u64);
+}
+
+#[test]
+fn lossless_stream_is_exact() {
+    let frames = sample_frames();
+    let stats = run_stream(FecScheme::Gf16, false, 0, &frames);
+    assert_eq!(stats.frames_completed, frames.len() as u64);
+    assert_eq!(
+        stats.fec_recovered_shards, 0,
+        "no loss → nothing to recover"
+    );
+}
+
+#[test]
+fn input_round_trips_client_to_host() {
+    let (host_tp, client_tp) = loopback_pair(0, 0);
+    let mut host = Session::new(
+        config(Role::Host, FecScheme::Gf8, false, 0),
+        Box::new(host_tp),
+    )
+    .unwrap();
+    let mut client = Session::new(
+        config(Role::Client, FecScheme::Gf8, false, 0),
+        Box::new(client_tp),
+    )
+    .unwrap();
+
+    let sent = InputEvent {
+        kind: InputKind::MouseMove,
+        _pad: [0; 3],
+        code: 0,
+        x: -7,
+        y: 13,
+        flags: 0,
+    };
+    client.send_input(&sent).unwrap();
+    let got = host
+        .poll_input()
+        .unwrap()
+        .expect("host should receive the input event");
+    assert_eq!(got, sent);
+}
+
+// ---- property tests over the FEC layer --------------------------------------
+
+proptest! {
+    /// For random shard counts and an erasure set within the recovery budget, every
+    /// original shard is reconstructed byte-identically — for both backends.
+    #[test]
+    fn fec_recovers_any_loss_within_budget(
+        k in 1usize..40,
+        extra in 0usize..16,        // recovery beyond the bare minimum
+        shard_half in 1usize..64,   // shard_len = 2*shard_half (even)
+        seed in any::<u64>(),
+    ) {
+        let m = (extra + 1).min(40);
+        let shard_len = shard_half * 2;
+        for coder in [coder_for(FecScheme::Gf8), coder_for(FecScheme::Gf16)] {
+            // Gf8 ceiling: data + recovery <= 255.
+            if matches!(coder.scheme(), FecScheme::Gf8) && k + m > 255 { continue; }
+
+            let data: Vec<Vec<u8>> = (0..k)
+                .map(|i| (0..shard_len).map(|b| (i ^ b).wrapping_add(seed as usize) as u8).collect())
+                .collect();
+            let recovery = coder.encode(&data, m).unwrap();
+
+            let mut received: Vec<Option<Vec<u8>>> =
+                data.iter().cloned().map(Some).chain(recovery.into_iter().map(Some)).collect();
+
+            // Erase up to `m` shards chosen by a cheap PRNG over the seed.
+            let total = k + m;
+            let lose = (seed as usize % (m + 1)).min(m);
+            let mut s = seed | 1;
+            for _ in 0..lose {
+                s = s.wrapping_mul(6364136223846793005).wrapping_add(1);
+                let idx = (s >> 33) as usize % total;
+                received[idx] = None;
+            }
+
+            let restored = coder.reconstruct(k, m, &mut received).unwrap();
+            prop_assert_eq!(restored, data);
+        }
+    }
+}