fix(fmt) + feat(gamepad): CI-matching rustfmt everywhere, enforced by repo git hooks; N4 spike flips to GO via MI_02

Three things that belong together:

1. rustfmt the gamepad-new-types host files ci.yml's `cargo fmt --all
   --check` gate flags (the .21/.133 verify recipes ran clippy+tests
   but never fmt — the same class of miss as 69f30f30).

2. Enforce it at the source: scripts/git-hooks/{pre-commit,pre-push}
   run the exact CI fmt gates (main workspace + the shipped-driver
   crates of the UMDF workspace); CONTRIBUTING documents the one-time
   `git config core.hooksPath scripts/git-hooks`. pre-push is the
   enforcement point (plumbing commits bypass pre-commit).

3. N4 follow-up — the spike verdict FLIPS TO GO: SwDeviceProfile grows
   `usb_mi`, synthesizing `&MI_02` into the Deck spike's USB hardware
   ids. hidclass mirrors the parent's USB tokens into the HID child's
   hardware ids, and hidapi/SDL/Steam parse `MI_` as bInterfaceNumber
   (defaulting to 0 when absent — the exact gate the first run hit:
   Steam wants the Deck controller on interface 2). Re-run live on
   .173: Steam logs `Interface: 2`, then `!! Steam controller device
   opened`, `Steam Controller reserving XInput slot 0`, and activates
   a mapping — full Steam Input promotion of the software-devnode
   Deck, no driver change needed. The PS identities pass
   `usb_mi: None` (real single-interface devices carry no MI_ token).
   A proper Windows-Deck backend phase is now justified; planned
   separately.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -30,6 +30,16 @@ file with `scripts/gen-third-party-notices.sh` when the dependency tree changes.
 
 ## Before you push
 
+Enable the repo git hooks once per clone — they run the exact rustfmt gates CI runs (main
+workspace + the UMDF driver workspace) on every commit and push, so a push can never fail CI
+on formatting alone:
+
+```sh
+git config core.hooksPath scripts/git-hooks
+```
+
+Then the usual full pass:
+
 ```sh
 cargo fmt --all --check
 cargo clippy --workspace --all-targets -- -D warnings

crates/pf-console-ui/src/glyphs.rs

@@ -22,9 +22,9 @@ pub(crate) enum GlyphStyle {
 impl GlyphStyle {
     pub(crate) fn from_pref(pref: Option<GamepadPref>) -> GlyphStyle {
         match pref {
-            Some(
-                GamepadPref::DualSense | GamepadPref::DualSenseEdge | GamepadPref::DualShock4,
-            ) => GlyphStyle::Shapes,
+            Some(GamepadPref::DualSense | GamepadPref::DualSenseEdge | GamepadPref::DualShock4) => {
+                GlyphStyle::Shapes
+            }
             Some(_) => GlyphStyle::Letters,
             None => GlyphStyle::Keyboard,
         }

crates/punktfunk-host/src/inject.rs

@@ -473,6 +473,11 @@ fn gs_button_to_evdev(b: u32) -> Option<u32> {
 #[cfg(target_os = "linux")]
 #[path = "inject/linux/dualsense.rs"]
 pub mod dualsense;
+/// Windows: virtual DualSense **Edge** via the same UMDF minidriver + shared-memory channel
+/// (device-type 2) — the wire back grips land on the Edge's native back/Fn buttons.
+#[cfg(target_os = "windows")]
+#[path = "inject/windows/dualsense_edge_windows.rs"]
+pub mod dualsense_edge_windows;
 /// Transport-independent DualSense HID contract, shared by the Linux UHID backend ([`dualsense`])
 /// and the Windows UMDF-driver backend ([`dualsense_windows`]).
 #[cfg(any(target_os = "linux", target_os = "windows"))]
@@ -482,11 +487,6 @@ pub mod dualsense_proto;
 #[cfg(target_os = "windows")]
 #[path = "inject/windows/dualsense_windows.rs"]
 pub mod dualsense_windows;
-/// Windows: virtual DualSense **Edge** via the same UMDF minidriver + shared-memory channel
-/// (device-type 2) — the wire back grips land on the Edge's native back/Fn buttons.
-#[cfg(target_os = "windows")]
-#[path = "inject/windows/dualsense_edge_windows.rs"]
-pub mod dualsense_edge_windows;
 #[cfg(target_os = "linux")]
 #[path = "inject/linux/dualshock4.rs"]
 pub mod dualshock4;
@@ -527,15 +527,6 @@ pub mod pad_slots;
 #[cfg(target_os = "linux")]
 #[path = "inject/linux/steam_controller.rs"]
 pub mod steam_controller;
-/// Linux: virtual Nintendo Switch Pro Controller via UHID (kernel `hid-nintendo`).
-#[cfg(target_os = "linux")]
-#[path = "inject/linux/switch_pro.rs"]
-pub mod switch_pro;
-/// Transport-independent Switch Pro Controller codec + the canned `hid-nintendo` handshake
-/// replies, used by the Linux UHID backend ([`switch_pro`]).
-#[cfg(target_os = "linux")]
-#[path = "inject/proto/switch_proto.rs"]
-pub mod switch_proto;
 /// Linux: virtual Steam Deck via the USB gadget subsystem (`raw_gadget` + `dummy_hcd`) — the only
 /// virtual-Deck transport Steam Input promotes (presents the controller on USB interface 2).
 /// SteamOS-host only (needs `dummy_hcd` + `raw_gadget`).
@@ -559,6 +550,15 @@ pub mod steam_remap;
 #[cfg(target_os = "linux")]
 #[path = "inject/linux/steam_usbip.rs"]
 pub mod steam_usbip;
+/// Linux: virtual Nintendo Switch Pro Controller via UHID (kernel `hid-nintendo`).
+#[cfg(target_os = "linux")]
+#[path = "inject/linux/switch_pro.rs"]
+pub mod switch_pro;
+/// Transport-independent Switch Pro Controller codec + the canned `hid-nintendo` handshake
+/// replies, used by the Linux UHID backend ([`switch_pro`]).
+#[cfg(target_os = "linux")]
+#[path = "inject/proto/switch_proto.rs"]
+pub mod switch_proto;
 /// The generic stateful virtual-pad manager ([`uhid_manager::UhidManager`]) — event routing, frame
 /// merge, heartbeat, and feedback pump shared by the five UHID/UMDF backends; each supplies only
 /// its per-controller protocol via [`uhid_manager::PadProto`] (G12).

crates/punktfunk-host/src/inject/linux/dualsense.rs

@@ -13,10 +13,9 @@
 //! UMDF-driver backend; this module is just the `/dev/uhid` plumbing around it.
 
 use super::dualsense_proto::{
-    edge_paddle_bits, parse_ds_output, serialize_state, DsFeedback, DsState,
-    DS_EDGE_PRODUCT, DS_FEATURE_CALIBRATION, DS_FEATURE_FIRMWARE, DS_FEATURE_PAIRING,
-    DS_INPUT_REPORT_LEN, DS_PRODUCT, DS_TOUCH_H, DS_TOUCH_W, DS_VENDOR, DUALSENSE_EDGE_RDESC,
-    DUALSENSE_RDESC,
+    edge_paddle_bits, parse_ds_output, serialize_state, DsFeedback, DsState, DS_EDGE_PRODUCT,
+    DS_FEATURE_CALIBRATION, DS_FEATURE_FIRMWARE, DS_FEATURE_PAIRING, DS_INPUT_REPORT_LEN,
+    DS_PRODUCT, DS_TOUCH_H, DS_TOUCH_W, DS_VENDOR, DUALSENSE_EDGE_RDESC, DUALSENSE_RDESC,
 };
 use crate::inject::uhid_manager::{PadFeedback, PadProto, UhidManager};
 use anyhow::{Context, Result};
@@ -102,7 +101,8 @@ impl DualSensePad {
                 format!("open {UHID_PATH} (is the 60-punktfunk.rules uhid rule installed + are you in 'input'?)")
             })?;
         let mut ds = DualSensePad { fd, seq: 0, ts: 0 };
-        ds.send_create2(index, id).context("UHID_CREATE2 DualSense")?;
+        ds.send_create2(index, id)
+            .context("UHID_CREATE2 DualSense")?;
         Ok(ds)
     }
 

crates/punktfunk-host/src/inject/linux/switch_pro.rs

@@ -84,7 +84,12 @@ impl SwitchProPad {
         let mut ev = [0u8; UHID_EVENT_SIZE];
         ev[0..4].copy_from_slice(&UHID_CREATE2.to_ne_bytes());
         // union (uhid_create2_req) starts at byte 4.
-        put_cstr(&mut ev, 4, 128, &format!("Punktfunk Switch Pro Controller {index}")); // name[128]
+        put_cstr(
+            &mut ev,
+            4,
+            128,
+            &format!("Punktfunk Switch Pro Controller {index}"),
+        ); // name[128]
         put_cstr(&mut ev, 132, 64, &format!("punktfunk/switchpro/{index}")); // phys[64]
         put_cstr(&mut ev, 196, 64, &format!("punktfunk-swpro-{index}")); // uniq[64]
         ev[260..262].copy_from_slice(&(PROCON_RDESC.len() as u16).to_ne_bytes()); // rd_size
@@ -123,7 +128,13 @@ impl SwitchProPad {
         let reply = match id {
             // Device info — the fatal one (probe aborts without it): type = Pro Controller +
             // this pad's virtual MAC. Real hardware acks it with 0x82.
-            0x02 => build_subcmd_reply(&st, self.timer, 0x82, id, &device_info_payload(&switch_mac(self.index))),
+            0x02 => build_subcmd_reply(
+                &st,
+                self.timer,
+                0x82,
+                id,
+                &device_info_payload(&switch_mac(self.index)),
+            ),
             // SPI flash read: echoed addr + len + the canned calibration bytes. An unmapped
             // range answers zeroes (echoed header, zero data) — the driver then warns and uses
             // its defaults instead of stalling through 2 × 1 s timeouts.
@@ -134,7 +145,11 @@ impl SwitchProPad {
                     .unwrap_or(0);
                 let len = args.get(4).copied().unwrap_or(0);
                 let payload = spi_flash_read(addr, len).unwrap_or_else(|| {
-                    tracing::debug!(addr = format!("{addr:#x}"), len, "unmapped SPI read — zero fill");
+                    tracing::debug!(
+                        addr = format!("{addr:#x}"),
+                        len,
+                        "unmapped SPI read — zero fill"
+                    );
                     let mut p = Vec::with_capacity(5 + len as usize);
                     p.extend_from_slice(&addr.to_le_bytes());
                     p.push(len);

crates/punktfunk-host/src/inject/proto/steam_proto.rs

@@ -824,11 +824,7 @@ mod tests {
     fn sc_serialize_and_mapping() {
         // Full mapping: face + grips + clicks + a deflected right stick.
         let s = sc_from_gamepad(
-            gs::BTN_A
-                | gs::BTN_PADDLE1
-                | gs::BTN_PADDLE2
-                | gs::BTN_LS_CLICK
-                | gs::BTN_RS_CLICK,
+            gs::BTN_A | gs::BTN_PADDLE1 | gs::BTN_PADDLE2 | gs::BTN_LS_CLICK | gs::BTN_RS_CLICK,
             1000,
             -2000,
             3000,

crates/punktfunk-host/src/inject/windows/dualsense_windows.rs

@@ -88,6 +88,11 @@ pub(super) struct SwDeviceProfile<'a> {
     pub hwid: &'a str,
     /// The USB VID&PID token (`VID_054C&PID_0CE6`) used to synthesize the USB hardware/compatible ids.
     pub usb_vid_pid: &'a str,
+    /// USB composite interface number to synthesize (`&MI_xx` appended to the USB hardware ids).
+    /// hidclass mirrors the parent's `USB\VID…` tokens into the HID child's hardware ids, and
+    /// hidapi/SDL/Steam parse the child's `MI_` token as `bInterfaceNumber` (defaulting to 0 when
+    /// absent) — the Steam Deck's controller lives on interface 2, the gate the N4 spike hit.
+    pub usb_mi: Option<u8>,
     /// Device description shown in Device Manager.
     pub description: &'a str,
 }
@@ -126,8 +131,9 @@ pub(super) fn create_swdevice(p: &SwDeviceProfile) -> Result<(HSWDEVICE, Option<
             .chain(std::iter::once(0))
             .collect()
     };
-    let usb_rev = format!("USB\\{}&REV_0100", p.usb_vid_pid);
-    let usb = format!("USB\\{}", p.usb_vid_pid);
+    let mi = p.usb_mi.map(|n| format!("&MI_{n:02}")).unwrap_or_default();
+    let usb_rev = format!("USB\\{}&REV_0100{mi}", p.usb_vid_pid);
+    let usb = format!("USB\\{}{mi}", p.usb_vid_pid);
     let hwids = multi_sz(&[
         p.hwid, // FIRST → the INF binds our UMDF driver on this id
         usb_rev.as_str(),
@@ -297,6 +303,7 @@ impl DsWinPad {
             container_index: index,
             hwid: id.hwid,
             usb_vid_pid: id.usb_vid_pid,
+            usb_mi: None, // single-interface USB devices (real DS/Edge have no MI_ token)
             description: id.description,
         }) {
             Ok((h, i)) => (Some(h), i),
@@ -498,6 +505,9 @@ pub fn deck_spike_hold(index: u8, secs: u64) -> Result<()> {
         container_index: index,
         hwid: "pf_steamdeck",
         usb_vid_pid: "VID_28DE&PID_1205",
+        // The Deck's controller interface — the promotion gate the first spike run hit
+        // (hidapi parses MI_ from the child hwids; absent = interface 0, Steam wants 2).
+        usb_mi: Some(2),
         description: "punktfunk Virtual Steam Deck (spike)",
     })?;
     let _sw = super::gamepad_raii::SwDevice::new(hsw);
@@ -515,9 +525,8 @@ pub fn deck_spike_hold(index: u8, secs: u64) -> Result<()> {
         channel.pump();
         // Log any feature/output traffic Steam sends — each one is spike evidence.
         // SAFETY: base points at SHM_SIZE bytes; OFF_OUT_SEQ is in range.
-        let seq = unsafe {
-            std::ptr::read_unaligned(channel.data_base().add(OFF_OUT_SEQ) as *const u32)
-        };
+        let seq =
+            unsafe { std::ptr::read_unaligned(channel.data_base().add(OFF_OUT_SEQ) as *const u32) };
         if seq != last_out_seq {
             last_out_seq = seq;
             let mut out = [0u8; 16];

crates/punktfunk-host/src/inject/windows/dualshock4_windows.rs

@@ -64,6 +64,7 @@ impl Ds4WinPad {
             container_index: index,
             hwid: "pf_dualshock4",
             usb_vid_pid: "VID_054C&PID_09CC",
+            usb_mi: None,
             description: "punktfunk Virtual DualShock 4",
         }) {
             Ok((h, id)) => (Some(h), id),

crates/punktfunk-host/src/main.rs

@@ -432,7 +432,8 @@ fn real_main() -> Result<()> {
             // report byte 10 (0x80|0x40) next to Cross.
             let edge = args.iter().any(|a| a == "--edge");
             let extra_buttons: u32 = if edge {
-                punktfunk_core::input::gamepad::BTN_PADDLE1 | punktfunk_core::input::gamepad::BTN_PADDLE2
+                punktfunk_core::input::gamepad::BTN_PADDLE1
+                    | punktfunk_core::input::gamepad::BTN_PADDLE2
             } else {
                 0
             };

crates/punktfunk-host/src/punktfunk1.rs

@@ -5400,14 +5400,14 @@ mod tests {
             pick_gamepad(DualSenseEdge, None, false, true),
             DualSenseEdge
         );
-        assert_eq!(
-            pick_gamepad(Auto, Some("edge"), true, false),
-            DualSenseEdge
-        );
+        assert_eq!(pick_gamepad(Auto, Some("edge"), true, false), DualSenseEdge);
         assert_eq!(pick_gamepad(DualSenseEdge, None, false, false), Xbox360);
         // Switch Pro: native on Linux (UHID hid-nintendo); Xbox360 on Windows and elsewhere.
         assert_eq!(pick_gamepad(SwitchPro, None, true, false), SwitchPro);
-        assert_eq!(pick_gamepad(Auto, Some("switchpro"), true, false), SwitchPro);
+        assert_eq!(
+            pick_gamepad(Auto, Some("switchpro"), true, false),
+            SwitchPro
+        );
         assert_eq!(pick_gamepad(Auto, Some("switch"), true, false), SwitchPro);
         assert_eq!(pick_gamepad(SwitchPro, None, false, true), Xbox360);
         assert_eq!(pick_gamepad(SwitchPro, None, false, false), Xbox360);

scripts/git-hooks/pre-commit

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Repo pre-commit hook: the same rustfmt gates as pre-push, but at commit time for faster
+# feedback. Enable once per clone:
+#
+#     git config core.hooksPath scripts/git-hooks
+#
+# NOTE this is the convenience layer only — plumbing commits (commit-tree) bypass pre-commit,
+# which is why pre-push re-runs the identical checks and is the actual enforcement point.
+exec "$(git rev-parse --show-toplevel)/scripts/git-hooks/pre-push"

scripts/git-hooks/pre-push

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Repo pre-push hook: run the exact rustfmt gates CI runs, so a push can never fail on
+# formatting alone. Enable once per clone:
+#
+#     git config core.hooksPath scripts/git-hooks
+#
+# Kept to the CHEAP checks on purpose (rustfmt only parses — a couple of seconds): clippy/tests
+# stay in CI and the per-box verify recipes. Runs regardless of how the commits were made
+# (plain `git commit`, amends, or plumbing like commit-tree — pre-push sees them all).
+#
+# Escape hatch for a genuine emergency: `git push --no-verify`.
+
+set -eu
+root=$(git rev-parse --show-toplevel)
+
+fail() {
+    echo "pre-push: $1" >&2
+    echo "pre-push: fix with: $2" >&2
+    echo "pre-push: (bypass in an emergency with: git push --no-verify)" >&2
+    exit 1
+}
+
+# 1. Main workspace — mirrors ci.yml "Format": cargo fmt --all --check.
+if ! (cd "$root" && cargo fmt --all --check >/dev/null 2>&1); then
+    fail "main workspace is not rustfmt-clean (ci.yml would fail)" \
+         "cargo fmt --all"
+fi
+
+# 2. UMDF driver workspace — mirrors windows-drivers.yml's gate (the shipped drivers + the
+# audited safe layer; pf-vdisplay is deliberately NOT gated there, so not here either).
+if ! (cd "$root/packaging/windows/drivers" \
+      && cargo fmt -p pf-umdf-util -p pf-xusb -p pf-dualsense --check >/dev/null 2>&1); then
+    fail "driver workspace is not rustfmt-clean (windows-drivers.yml would fail)" \
+         "(cd packaging/windows/drivers && cargo fmt -p pf-umdf-util -p pf-xusb -p pf-dualsense)"
+fi
+
+exit 0