Your desktop.
Your preferences.

A larger launcher.
A size you can change.

Open the launcher with Super+Space, choose the palette icon (Themes), then pick Small, Default or Large under Launcher size. Arrow keys select both palette rows and size presets; Enter applies the selected control. Tab cycles launcher sections.

The default fits up to ten app rows on a sufficiently tall display. The panel still shrinks when there are fewer results, and each section keeps its own content height. Size changes animate without bouncing past their target. The default wallpaper carousel has its own wider layout; an explicit width preference also constrains that carousel.

For an exact preference, open a terminal inside the desktop session:

lucent-cli launcher size 800 720
lucent-cli launcher open

# Open the preset controls directly
lucent-cli themes open

# Restore design defaults without changing your other preferences
lucent-cli launcher size reset

Changes apply live and save in the background. Width rounds down to a 32-pixel step; maximum height rounds down to a 16-pixel step. Both are constrained by the usable screen. The command accepts widths of at least 320 and heights of at least 224. Logical pixels keep the layout consistent at 1× and 2× output scale; these controls do not enlarge font or icon sizes.

For example, a preference of 777 × 699 becomes at most 768 × 688 before screen constraints. Searching for one application may produce a shorter panel. A smaller display limits the visible rows, while arrows and scrolling keep the selected result reachable.

Lucent owns the launcher morph. A targeted Hyprland layer rule disables the compositor animation for the Lucent dock namespace, avoiding a second slide over the native animation. Normal window animation, spacing and tiling remain compositor preferences. The closed dock retains a short native buffer containing its shape, shadow and bottom spacing. Opening expands it for the launcher and outside-click capture; closing finishes its morph before returning to the short buffer. Screen position, grid, colors and keyboard shortcuts use the same settings. Inspection distinguishes desktop_viewport, dock_surface_expanded and launcher_opening from each surface's native dimensions. The background surface supplies the display viewport; a short dock buffer must not resize the whole desktop.

Keep Omarchy's window workflow.

Super+K opens the native keybinding menu. It reads the installed Omarchy bindings, including user overrides, so it is the place to check terminal, splitting, tiling, monitor and workspace shortcuts on your current system. Search a shortcut or action, then press Enter to run it.

Lucent's launcher uses typing to filter, arrows to select, Enter to launch, Escape or an outside click to close, and Tab / Shift+Tab to change sections. Dock clicks focus a matching running application or launch it. Top-bar workspace buttons ask Hyprland to change workspace. The center date, clock and weather capsule is informational and does not open a menu.

Window tiling and focus rules belong to Hyprland. Edit your user configuration under ~/.config/hypr/, preserving the marked Lucent integration blocks. The generated appearance block gives normal windows the shared corner radius and 16-pixel outside margins. Internal split gaps use 8 pixels per side, leaving 16 pixels between windows. Fullscreen, gapless layouts and explicit application rules can override these defaults.

The top bar reserves only its 16-pixel top inset and 32-pixel capsule height. Hyprland adds the single 16-pixel gap below it, so a tiled window's outside border starts at y=64 and aligns with the bar's side inset. These measurements are logical pixels; the shell and compositor each own their part of the layout.

For root and nested Omarchy menus, Lucent renders the picker while Omarchy's definitions supply the actions. Known utility shortcuts route to native selectors through compatibility adapters; unsupported stock plugins are not started. See the complete ownership map.

Lucent tokens.
Shared application colors.

Themes offers named color sets: Moonstone, Pearl, Ocean, Forest and Ember, plus saved wallpaper palettes. Each row previews its surface, text, accent and status colors. Arrow keys or scrolling reach the full list; Enter applies the selected palette. The active row says Applied. There is no separate light/dark switch: brightness is a property of the selected palette.

Super+Ctrl+Space opens Wallpapers. Choose Local, Wallhaven or Alpha Coders for images; Live opens the video picker. Enter a query and press Search or Enter. Select a thumbnail; scroll or use Up/Down to reach further results. The page arrows fetch another provider page. Wallpaper only retains your colors; Wallpaper + colors downloads the original, extracts a dominant color and builds a readable semantic palette before applying it. After search, Enter applies the selected wallpaper with its colors.

The Use current wallpaper colors row in Themes does the same extraction for your existing local wallpaper. Generated sets remain in the palette list after choosing another preset; Lucent retains the latest 24 distinct wallpaper palettes. This is deterministic dominant-color extraction with contrast checks, not a full image editor or an imported community-theme catalog.

Live wallpaper controls use the same native components and theme tokens. Select Default or a display before importing; pause and frame-rate policy affect that profile. Pause all is independent and survives another import. The panel also controls automatic battery and fullscreen pauses; its status explains the selected display’s pause reason. A monitor override can return to the default. Failed playback retains its last image and offers Retry; save progress and failures remain visible separately. The CLI pause/resume/off/retry commands target Default, while pause-all/resume-all explicitly affect all profiles. See the live wallpaper guide for architecture, limits and measured VM acceptance.

Local images are discovered in ~/Pictures/Wallpapers and ~/.config/lucent/wallpapers. Downloads go to ~/Pictures/Wallpapers/Lucent, with a source-page metadata file; previews are cached under ~/.cache/lucent/wallpapers. Restart Lucent to discover files added outside its browser. Local previews load as you browse, including beyond the first 64 files. An unreadable image shows Preview unavailable; after fixing the file, reopen the section or run lucent-cli wallpapers retry. Search is explicit and needs no account or API key. Wallhaven uses its SFW API; Alpha Coders uses public page metadata and may need an adapter update if its markup changes.

Large RGB/grayscale JPEGs use scaled decoding for previews, palette extraction and desktop/lock/login backgrounds; the downloaded original is retained. Images are limited to 32 MiB, 16384 pixels per side and 100 megapixels. Other raster formats retain the 128 MiB decoding budget. A decoding or size-limit error leaves the current wallpaper unchanged. Lucent decodes a private snapshot before changing its selected link; later edits to the source file do not change the committed background. New choices supersede older preparation, including slow downloads. An accepted commit finishes before the latest queued choice starts.

The desktop prepares one shared static image large enough for connected outputs' physical targets, including their integer or fractional rendering density. Each named output has its own background surface. A resize prepares the latest target on the asset worker while the last good image stays visible; it does not change the wallpaper source, palette or preferences. Preparation failures stop automatic retries for that target. After fixing the cause, run lucent-cli wallpaper retry and inspect wallpaper_presentation. This reduces retained desktop pixels, not decoder scratch memory, framebuffer allocations or lock/login background storage. Static wallpaper selection remains shared; live media supports per-monitor overrides. A separate 16-check native run on unchanged 8e passes two simultaneous outputs, one owned headless, with real panel input at 1×/2×/1.25×, removal/recreation and restoration. It does not establish physical displays/cable hotplug, secure-output behavior, cross-output clipboard, static-image pixel quality or presentation FPS.

An explicit palette choice made during a download takes precedence over that download’s automatic colors. Lucent owns the resulting palette and exports those same semantic colors to supported terminal, browser and GTK configurations. Menus, permission prompts and lock/login use the selected palette too. Omarchy supplies headless application templates only. Failed downloads preserve the active wallpaper; provider and export failures are shown in the UI. No third-party wallpaper images are bundled with this repository. Private source snapshots live under $XDG_STATE_HOME/lucent/wallpaper-assets (normally ~/.local/state/lucent/wallpaper-assets); cleanup retains eight snapshots and never deletes the selected one or your originals. The source limit is 32 MiB per snapshot. SVG wallpapers must be self-contained; relative external assets are not copied. Application and login exports synchronize after a successful selection.

lucent-cli wallpapers open
lucent-cli wallpapers search wallhaven mountains
lucent-cli wallpapers search alpha-coders landscape
lucent-cli palette ocean
lucent-cli palette wallpaper
lucent-cli inspect

The Widgets section toggles calendar, clock, weather, media, system monitor, notes and focus timer. Drag a widget background to move it. A spacing grid appears during the drag; releasing snaps to the grid and saves. Choose Edit layout to reveal resize grips and size buttons. Drag a bottom-right grip to change the card bounds, or focus the −/+ buttons and press Enter for grid-sized adjustments. Escape from a widget exits editing. Other settings changes during a gesture cannot save its unfinished position or size. Buttons and inputs inside widgets remain interactive. Reset layout clears saved placements and sizes without changing visibility or notes.

lucent-cli widgets edit on
lucent-cli widgets size notes 400 240
lucent-cli widgets edit off

Card sizes preserve the existing typography. Notes expands its editor; other widgets center their original content. Editing adds a footer for controls below it; saved dimensions exclude that footer. Minimum dimensions come from the design system, and presentation is constrained for the active viewport. A smaller display does not overwrite your saved preference. Visibility, positions and preferred sizes persist independently for named monitors; richer content reflow and simultaneous native display/input acceptance remain unfinished. The widget sizing guide explains preview ownership, grid policy and native buffers, while the monitor guide covers saved profiles.

Notes uses the space you give it.

The Notes widget uses Lucent’s controlled multiline editor. Enter adds a line; Shift with arrows selects across lines; Page Up/Down and Home/End move through visual rows. Resize the widget to grow the editing area. Its colors, rounded insets, caret and scrollbar use the shared design recipes. Scrolling and selection remain transient; only changed text requests the normal settings save. The text limit remains 8192 UTF-8 bytes.

The implementation and verification guide separates the reusable library control from Notes state and persistence. Single-output native Notes checks pass 17 functional and nine restoration checks, including editing, clipboard exchange with wl-copy/wl-paste and restart persistence. The later real Chromium/Notes keyboard flow passes both directions with nine interaction and twelve restoration checks on unchanged 8e, one virtual output, preserving multiline Unicode and replacing selections. Native pixel-level caret/selection checks, scrollbar dragging, delayed clipboard/focus races, rich content and other GUI applications remain open.

Settled widgets use bounded native buffers, with overlapping cards grouped to preserve their painting order. During dragging, source geometry stays fixed while a temporary click-through preview shows the cards and grid. Releasing commits the snapped placement and removes that preview. An output resize cancels the gesture rather than saving coordinates from the old display size. These buffer details do not change the saved preference format.

Launcher search, native menu search, notes, wallpaper search and hidden-network names support Ctrl+C/X/V. Select with Shift+arrows or by dragging. Paste applies to the current selection and retains the previous value if the transfer fails or the field changes. Wallpaper typing waits for Search/Enter to run a provider request. Hidden-network names have a 32-byte limit; their password field stays separate. Native compositor/app interoperability is still awaiting acceptance; lock and authentication fields do not use clipboard transfer.

Notifications are rendered by Lucent. Open history through its notification control or lucent-cli notifications show. Application groups combine active and saved entries; click a group to browse it, then use Previous/Next and wheel, thumb or keyboard scrolling. DND suppresses ordinary toasts while keeping history; critical toasts remain visible. History and DND survive a desktop restart, with restored entries shown as saved content. Bodies support bold, italic, underline and native wrapped links; selecting a link opens its URI through the desktop handler. Saved links remain content links and never invoke a retired sender. Local body images, raw image hints and application icons use native prepared artwork. Images show loading/error states and offer Retry images; bounded scrolling keeps lower content and actions reachable on small outputs. Old raw pictures may be omitted by retention budgets while text remains. The image guide explains support and resource scope. Loading/saving states report background archive work while delivery remains live. Retry and Clear handle storage failures; Clear preserves active notices, explicitly discards saved history and retires older recovery replies. The notification guide documents private storage and remaining richer content/native acceptance.

Weather provides Weather and location in Commands and an explicit action on the weather widget. Enter a label and numeric latitude/longitude, choose °C or °F, then Apply and enable. Typing performs no network requests. Applying a location, explicitly refreshing or the configured forecast subscription sends the chosen coordinates to Open-Meteo. The center clock/weather bar stays informational.

The panel shows current model conditions and three daily forecasts. Refresh failures retain the last good report with its age; ~ marks stale/failed data in the bar. Turn weather off to stop requests and save explicit disabled authority. Preferences live in private desktop.json; an old weather.json is imported only while weather preferences are absent. No automatic location detection or disk offline cache is included. Setup and limits explain configuration and startup, validated local/scoped native opening and focus, and one observed production forecast. Form changes and failure/retry still need separate acceptance; the current resource sample and unmet RSS target are tracked separately. IPC supports weather open|close|refresh|off.

The separate 120-second Display-binary live-video sample on software Vulkan records 384.82 MiB mean / 403.88 MiB peak RSS and 101.466% of one core, exceeding the 300 MiB target. The Display report identifies the exact binary and preserved source-rate workload. The earlier Weather sample retains its 424.12/424.15 MiB result; these different cohorts establish no isolated improvement or actual FPS.

One desktop preference file.

Lucent stores preferences at $XDG_STATE_HOME/lucent/desktop.json, falling back to ~/.local/state/lucent/desktop.json. It contains version 1 settings: widget positions, preferred sizes and visibility, notes, pinned application IDs, dock preferences, the selected semantic palette, saved wallpaper palettes and launcher dimensions. Legacy light mode remains a migration fallback for files without a palette. A size is stored as "widget_sizes": {"notes": {"width": 400, "height": 240}}; missing sizes use the catalog defaults.

{
  "launcher": {
    "width": 800,
    "max_height": 720
  }
}

Use the live controls or CLI for launcher changes. If editing the file by hand, stop lucent.service first, preserve unrelated keys, then start it again. The desktop reads settings at startup; it does not watch this file for edits. Missing values or null restore design defaults. Invalid settings are reported and are not overwritten by automatic saves.

Notes show Saving… while a write is pending and Saved after it succeeds. Save failed · Retry keeps your edit in memory; fix the filesystem problem, then click Retry. During that attempt the caption says Retrying save…. Later edits supersede pending saves, while an already started write finishes in order. An invalid settings file disables saving and shows Settings unavailable. Notes allow 8,192 UTF-8 bytes. Settings must be an ordinary file no larger than 4 MiB; malformed, oversized or linked files are preserved for recovery. Successful replacements keep notes private with owner-only file permissions. Read the storage and recovery guide for the limits and write lifecycle.

lucent-cli settings retry
lucent-cli inspect

Wait for Saved before restarting or stopping the desktop if you need your latest edits retained. The command response acknowledges receipt; disk writes complete afterwards. Unsaved edits remain in process memory and are lost if that process is terminated.

Idle locking defaults to 300 seconds. Set lock_after_seconds in ~/.config/lucent/session.json (30–86400), then restart lucent-idle.service. Omarchy’s stay-awake shortcut still works and leaves sleep/explicit lock protection enabled.

Appearance constants belong to the design system, not this preference file. Changing fonts, semantic colors or component recipes in source requires rebuilding. See the design system if you are developing a theme.

Each monitor keeps its own widgets.

Every uniquely named output gets its own bar, background, widget groups and drag grid. Compositor focus selects its connected host; enter its top bar, use a widget or explicitly select a name to choose it. Unrelated metadata does not undo an explicit selection. The launcher selector, dock and shared control panels use that active monitor. Visibility, preferred size, drag release and Reset update only its saved layout; notes, theme and services remain shared.

lucent-cli monitor select DP-2
lucent-cli widgets open
lucent-cli widgets edit on
lucent-cli widgets size notes 384 240
lucent-cli widgets edit off

System statistics update only the widget groups that display them on connected monitors; drag and resize previews keep updating. The native VM check observes System submissions while Calendar and Clock remain still. Read the observation and redraw path for domain, adapter, client and framework responsibilities. CPU/RSS savings and broader native display behavior are not inferred from this check.

Each named bar now indicates its own observed workspace. Focus and native output discovery remain separate: an exact pending name waits until its host exists. Read the focus and workspace guide for port/adapters, event framing, recovery and pending versus active selection.

monitor_layouts in desktop.json maps names to positions, widget_sizes and visible_widgets. Missing profiles borrow the original top-level defaults; disconnected profiles remain saved. Discovery and clock ticks do not save preferences. Reflow constrains presentation and cancels capture while retaining preferred positions. Read the monitor configuration and architecture guide for the JSON example and complete registration/input/persistence path. Sixteen scoped native checks pass density/input/removal/recreation across two simultaneous outputs, one owned headless; physical monitors and secure-output changes remain pending. The later four-flow two-output Displays run separately verifies draft/Apply/Revert/timeout/Keep on unchanged 35ed with one owned headless peer and exact restoration. All its panel input stays on the original 1× output; fractional-panel input, hotplug, suspend and pacing remain unverified. Fractional rendering density follows native feedback, and wallpaper preparation uses its actual physical extents. The live display-fit report verifies one-output video resizing, integer/fractional density and rapid target changes in the compositor. That result does not cover simultaneous monitor placement/input, hotplug or suspend/resume.

Backgrounds that move.

Open Wallpapers → Live, Style → Live wallpapers, or run lucent-cli wallpaper live open. The live and regular selectors share Lucent’s carousel composition. Click a local clip from ~/Videos/Wallpapers, or use Previous/Next, to preview it; the separate Apply wallpaper button saves the chosen default/display target. Card clicks only select, including the active card. The selected preview loops at source timing; up to two neighbors show still frames. Browsing creates no imported media, poster or preference write. Refresh reloads the bounded library list. A scroll area keeps path import, target, FPS, pause policies and save/retry controls reachable below the preview. The preview build passes 769 Rust tests, 104 Python tests and the full 796-case Vulkan CI suite. Native testing on one 1× VM output passes changing GIF preview pixels, card/Previous/Next selection without saving, Tab/wheel navigation, same-path Retry/Refresh and rapid close/reopen. Explicit monitor Apply created import 33 beyond the former 32-asset quota; the test restored exact original settings and wallpaper and removed only its own fixtures. This does not establish preview FPS, smoothness, decoder counts or resource use.

A single serial preview worker owns decoder calls and waits for retirement before starting another selection. Its five-entry transient cache clears on close. Physical contain bounds are checked up to 1024 pixels per edge without upscaling; source-sized decoder/alpha scratch can still use more memory. Import is separate: Apply or Import wallpaper reuses an owned immutable asset only when its descriptor and streamed source bytes match, otherwise it decodes a fresh copy and poster before saving. The old 32-import quota is removed. Reuse checks at most 1024 entries, while new imports remain possible after a miss; historical media is preserved with no automatic deletion. The 32-item discovery result limit remains. Refresh clears preview caches and failures, then waits for fresh discovery and retiring decoder completion before rereading the same path.

Source frame rate is the saved playback default: it follows the video’s timestamps, including fractional and variable rates. Optional 15/30/60 FPS limits reduce work; they do not add frames to slower clips. Existing numeric caps are preserved. Install the bundled Moonlit Lake and Amber Lake pixel landscapes with python3 scripts/install-live-wallpaper-samples.py; both have subtly moving water and matching decoded endpoint frames. A path field supports other local MP4, WebM and animated GIF files. Pause freezes the last frame and stops its producer; disconnected outputs acquire no decoder. The selector opens and closes with a diagonal cut. Switching wallpaper sources reveals prepared pixels with the same diagonal cut; successive frames from the same video update directly. A failed decode keeps the last good wallpaper.

Rust owns playback and the native UI. FFmpeg libraries decode; the existing Vulkan renderer reuses stream textures on background Wayland surfaces. There is no external player or embedded browser. Read formats, sources, commands, architecture, resource limits and current acceptance. Wallpaper Engine video files are compatible media; its Scene/Web projects require other engines. Battery and per-output fullscreen pauses are configurable and preserve manual pause. A covered display freezes independently while a visible peer can keep their shared decoder running. Native single-output fullscreen, workspace visibility, manual pause and saved policy controls pass. Live playback also pauses on an observed secure session lock. The VM passes actual lock, desktop restart while locked, authenticated unlock/resume and manual-pause preservation. Physical battery/session transitions, multi-output behavior and physical-GPU/RSS targets remain open.

Lucent draws.
System services do the work.

Accepted main supports standard desktop-service activation without Exec, fresh input-bound intent and explicit file/URI opening. These APIs and applications open shipped in the coherent 8e6d074b release. A real Chromium run with the independent d1 consumer passes nine local-file feature and eight restoration checks, including observed focus and fresh Open/action/socket/CLI. A later native HTTP URI run passes eleven feature and nine restoration checks on the coherent 9b5420b7 trial: pointer, socket and CLI Open each load both fresh owned HTTP pages. A later singular HTTP %u run with the version-controlled 4c9a4739 harness on coherent 35ed passes twelve feature and nine restoration checks: pointer, socket and CLI Open each load exactly one fresh owned HTTP page, while the declared Action still loads two local documents. Both trial sources remain unmerged performance candidates; application acceptance does not accept their memory or FPS. Other applications, default handlers, external navigation and direct token consumption remain unverified. Native D-Bus calls have a bounded lifetime and conservative fallback; see the activation guide. The top bar observes audio through a native libpulse adapter connected to the system audio service (normally PipeWire). Its Rust volume actions use the same adapter. Click the volume number or run lucent-cli audio open for the native audio panel. Its Outputs, Inputs and Apps tabs provide volume, mute, defaults and stream-device selection through framework controls. Existing distribution media-key helpers can still invoke wpctl; external changes arrive through the native subscription. The panel is deployed to the prepared VM; output/input controls and silent virtual playback/capture routing have been tested. Physical hardware behavior remains unverified. Click the media capsule or run lucent-cli media open to choose an observed player, use playback controls and seek a known-length track. The bar, widget and native panel share the same selection. Controls act on the player they display; application changes cannot silently redirect a queued seek. Artwork loads separately with a fallback/retry. See the media guide for current limits and acceptance. Network state comes from a native NetworkManager D-Bus subscription. Click the network icon or run lucent-cli network open for the Wi-Fi, Saved and Active tabs. Notifications are rendered by Lucent and received through the standard desktop D-Bus interface. Notification history uses bounded native persistence and Lucent renders grouping, rich content, images and actions.

Audio failures keep the observed device state and show an explicit action. Retry repeats a failed command while its control is still available. After removal or reconnection changes that control’s identity, Dismiss clears the error and you select the current control again. The service reconnects automatically. Escape closes the panel; its native surface is removed after the exit animation.

The display shortcut or lucent-cli displays open opens Lucent’s native Displays panel. Select an output and edit its advertised resolution/refresh rate, position, scale, rotation or enabled state as a draft. Apply starts a verified preview; Keep saves a guarded tail in your user monitor configuration, while Revert, closing the panel or the independent 15-second deadline restores the captured layout. At least one output must remain enabled. Reset draft obtains a fresh complete layout; ordinary reopening preserves an unsaved draft. The prepared single-output VM passes real-input mode, scale, position, Keep/Revert, timeout and crash recovery checks. The historical four-flow two-output run, harness 86df4e5b on 35ed, covers draft-only peer position, Apply/explicit Revert, scale-1.25 timeout and position Keep. Its input stayed on the original 1× panel. The later nine-flow Display run, harness 1774fa87 on runtime 26d03adf, also passes rotation/Revert, disable/Keep, re-enable through the actual controls/Keep, fractional scale/Keep and native pointer/keyboard Apply/Revert on the fractional peer panel. That panel is 1024×768 logical units at density 1.25, backed by a 1280×960 buffer. Five positive preservation checks, one ctime/link-count scope marker and three cursor checks pass; an independent later read-only normal-OFF observation verifies the same desktop lifetime, original 1920×1080/60 Hz/1× output and unchanged 14 source/43 security entries. Only the owned peer is removed. Monitor ctime, link count and parent entry timestamps are not claimed unchanged. These virtual-output results establish no physical display, cable hotplug, suspend/resume, compositor restart, secure-output, resource-target or pacing acceptance. The initial helper attempt failed before any checks and its separate guarded recovery remains historical. Read display configuration, startup, recovery and current limits. Clipboard and emoji still use native selectors with headless adapters. Audio, network, Bluetooth and power entrypoints target desktop panels. The power panel shows battery state, supported profiles, built-in brightness and session actions; Escape clears confirmation before closing. Sleep/restart/shutdown require confirmation, and native authorization remains separate. Brightness input keeps the latest desired value while a write is pending. Unavailable VM/hardware tests are deferred. The network panel scans, joins visible/hidden networks, activates saved profiles, disconnects individual connections and asks for confirmation before Forget. Enter submits a masked password, Tab moves focus and Escape cancels a form before closing. Request acceptance is separate from observed connection state. If a saved personal Wi-Fi password is missing or rejected, NetworkManager opens Lucent’s masked repair form. Continue answers that exact request and retains the same saved profile; Escape or Back cancels the exchange. The original system-owned or not-saved storage policy remains authoritative. Incorrect-password cancellation, same-profile repair, DHCP and saved-password reconnection pass on owned simulated WPA2 radios in the prepared VM. Enterprise/WEP provisioning, agent-owned vaults and physical-hardware acceptance remain open. Bluetooth uses the native Rust panel for discovery, explicit pairing prompts, device controls and radio settings. Decline cancels our matching attempt; Disconnect is also available for unpaired connected devices. Connecting now shows Cancel connection while ordinary controls are busy. Cancelling or closing records intent even before admission returns, then waits for the observed result. Pending-profile, incoming and physical-controller acceptance remain open. Permission dialogs are rendered by Lucent over libpolkit-agent. Screenshot capture tools remain installed; a full control center remains unfinished. The native tray panel passes owned SNI/DBusMenu fixture checks through actual VM pointer and keyboard input, including actions, overflow and owner retirement. One genuine wired-only NetworkManager Applet run passes five native bar/menu/Connection Information checks and four cleanup checks on unchanged 8e, one virtual output. Thirteen independent post-removal checks restore the original 964 packages/reasons and user state, with all five signed test packages absent; controlled directory sizes/timestamps may advance. Other tray apps, wireless/secret-agent workflows, nested menus, physical hardware, icon pixels and performance remain unverified. The ownership map lists each responsibility and its implementation.

Lock shortcuts use the installed native lock wrapper, which requests a secure session lock and authenticates through PAM. An independent hyprlock configuration generated from Lucent tokens provides emergency recovery if the native locker fails; it never launches the stock shell. Login is a separate greetd-backed client; restarting the desktop service does not replace the login manager.

In login, Ctrl + U or Escape clears the username before an attempt, including after a failed sign-in. Enter continues to the authentication prompt. At a password or other response prompt, Ctrl + U clears that response while preserving the account. Input is disabled while connecting or verifying. Escape cancels a permission dialog; clearing a password never unlocks a session.

For the prepared, unlocked test VM, python3 vm/test-authorization-cancel.py checks two real permission-dialog cancellations from the host. It verifies denied policy results, surface removal and a surviving agent without supplying a password or performing the privileged action.

Inspect the running session.

systemctl --user status lucent.service
lucent-cli inspect
journalctl --user -u lucent.service -n 60
systemctl --user restart lucent.service

inspect reports saved size preferences, target panel size, surfaces, frame counts and errors. Its command response acknowledges receipt; a background save can still fail and report an error afterwards. A shell restart retains saved preferences.

Stopping the service stops Lucent; crashes restart the native service. To return to the stock shell and restore managed startup, application appearance and shortcut settings, run the explicit rollback command. It preserves binaries and preferences:

python3 scripts/lucent-setup.py rollback

Login-manager rollback is separate: use scripts/lucent-login.py and its documented rollback action only when that integration was installed. Read installation and rollback before changing session setup. Development and VM testing instructions are in the lucent-desktop repository skill.

Edit, rebuild,
restart Lucent.

Preferences already apply live through the UI and lucent-cli. For Rust, artwork or design-token changes, the opt-in developer command builds lucent-desktop, lucent-cli and lucent-menu, validates their bundle with seven theme support files and restarts the installed Lucent service. Run it as your desktop user on the machine running Lucent:

python3 scripts/lucent-dev.py doctor
python3 scripts/lucent-dev.py once
python3 scripts/lucent-dev.py watch

Hyprland and your applications keep running. Open shell panels, launcher queries and other transient UI state start fresh; saved preferences reload. Compile errors leave the current desktop running. A build can finish while locked; the watcher retains its pending bundle and waits for a safe session before applying. Apply checks readiness and can restore its original files after failure. Ctrl+C stops the watcher; normal login does not start it.

The reload excludes secure clients, login/PAM, the session supervisor and integration rules. Those changes still use a reviewed manual install. Read the development reload guide for separate build/apply commands, token generation, bounded builds and rollback. A real bounded build and VM reload/failed-start recovery passed separately; a combined source-save/build/reload watcher run on a physical installed desktop remains to be tested. The validation record identifies the tested tool and bundle revisions.