Screens answers a list that cannot be empty and has one primary

[tannevaled]

Screens returned []Screen, so two rules lived as conventions rather than as the type — and one of them cost somebody their desk.

Never empty

Nothing stopped an empty slice arriving, and the darwin back-end sent one: liveDisplays answered (nil, nil) when the window server counted zero. go-xrkit/desk looks its display up by name, found none, and quit — twice on 2026-09-08, on a headset somebody was wearing:

desk: "VITURE Beast" is not attached any more; there is  -- stopping

Nothing after there is: the message names every attached display, and it named none. Three of the four back-ends already refused to say it; the fourth was the one that shipped.

Exactly one primary, first

primaryFirst walked the slice unsetting duplicate flags — "only one may claim it" — and every caller that wanted the main display then scanned for the flag again. It is a property of the list, not something to go looking for.

type ScreenList struct{ all []Screen }

func (l ScreenList) Primary() Screen
func (l ScreenList) All() []Screen
func (l ScreenList) Len() int
func (l ScreenList) ByName(string) (Screen, bool)

newScreenList is the only way a populated one comes into being, and it is where both rules live.

ErrNoScreens is deliberately not ErrScreensUnsupported: that one means this build cannot enumerate at all, which no retry will change; this one means the enumeration ran and came back empty, which a second later may not.

ByName is here because every caller wrote it — looking a display up by name is what survives the desktop being rearranged, and three separate loops were doing it.

What goes away

Two hand-written guards: VisibleScreenSize's len(screens) == 0 on both Linux and Windows, and its screens[0], which is Primary() said properly. The platform messages that name a reason are kept and wrapped around ErrNoScreens, so a caller can test one sentinel without losing "the Wayland compositor advertises no output".

Callers

The back-end tests are about the geometry a protocol reports rather than about the list, so they take a one-word adapter (allOf) and are otherwise unchanged. Downstream: 9 non-test call sites across go-xrkit/desk and go-xrkit/player, updated in follow-ups.

Proved by sabotage: with the empty check disabled, the new test names both cases.

🤖 Generated with Claude Code