refactor: drop milestone names + consolidate clients; loss-recovery & rumble fixes

Two bodies of work in one commit (the rename moved files the fixes also touched).

Naming/structure cleanup (pre-launch):
- Host modules m3.rs->punktfunk1.rs, m0.rs->spike.rs; CLI m3-host->punktfunk1-host,
  m0->spike; bare `punktfunk-host` now prints help. Types M3Options/M3Source->
  Punktfunk1Options/Punktfunk1Source.
- Clients consolidated out of crates/ into clients/: punktfunk-client-rs->
  clients/probe (crate punktfunk-probe), client-linux->clients/linux,
  client-windows->clients/windows, punktfunk-android->clients/android/native
  (crate punktfunk-client-android; kept [lib] name=punktfunk_android so the JNI
  contract is unchanged). crates/ now holds only core + host.
- Milestone codes M0-M4 purged from code/CLI/CLAUDE.md/README/docs/docs-site,
  kept only in docs/implementation-plan.md. docs/m2-plan.md->
  docs/gamestream-host-plan.md. CI/gradle/flatpak paths updated.

Client loss-recovery (video froze and never recovered after a brief drop):
- Export punktfunk_connection_frames_dropped through the C ABI (the core already
  tracked it for the client keyframe-recovery loop; it was never reachable from
  the ABI clients). Regenerated punktfunk_core.h.
- Apple (StreamPump + Stage2Pipeline) and Android (decode.rs) now poll
  frames_dropped and request a keyframe when it climbs -- the same loss-driven
  recovery Linux/Windows already had. Under infinite GOP the decoder silently
  conceals reference-missing frames, so the decode-error trigger rarely fires.

Apple rumble robustness (worked then went spotty -- DualSense + Xbox):
- Add CHHapticEngine stopped/reset handlers (rebuild on app background / audio
  interruption / server reset) and drop the permanent `broken` latch on a
  transient drive failure; latch only when the controller truly has no haptics.
- Surface swallowed SDL set_rumble errors on Linux/Windows + diagnostic logging.

Verified: cargo build/clippy/fmt --workspace, C-ABI harness, header drift.
Not runnable on this box (verify in CI): Gitea workflows, gradle/Android,
flatpak, Swift/decky.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/Cargo.toml

@@ -10,7 +10,7 @@ repository.workspace = true
 
 [lib]
 name = "punktfunk_core"
-# `lib`       — so punktfunk-host / punktfunk-client-rs / tools link it as a normal Rust crate.
+# `lib`       — so punktfunk-host / punktfunk-probe / tools link it as a normal Rust crate.
 # `staticlib` — `libpunktfunk_core.a` for the C test harness and static embedding.
 # `cdylib`    — `libpunktfunk_core.{so,dylib}` for Swift/Kotlin clients via the C ABI.
 crate-type = ["lib", "cdylib", "staticlib"]

crates/punktfunk-core/src/abi.rs

@@ -1494,6 +1494,35 @@ pub unsafe extern "C" fn punktfunk_connection_request_keyframe(
     })
 }
 
+/// Cumulative access units the host→client reassembler dropped as unrecoverable (FEC couldn't
+/// rebuild them). A video loop polls this and calls [`punktfunk_connection_request_keyframe`]
+/// when it climbs — the correct loss trigger under the host's infinite GOP, where unrecoverable
+/// loss yields reference-missing delta frames the decoder *silently conceals* (frozen / garbage
+/// picture, no decode error), so a decode-error trigger rarely fires. Monotonic for the session;
+/// compare against the last observed value. Writes 0 to `out` on a NULL connection.
+///
+/// # Safety
+/// `c` is a valid connection handle; `out` is writable (NULL is skipped).
+#[cfg(feature = "quic")]
+#[no_mangle]
+pub unsafe extern "C" fn punktfunk_connection_frames_dropped(
+    c: *const PunktfunkConnection,
+    out: *mut u64,
+) -> PunktfunkStatus {
+    guard(|| {
+        let c = match unsafe { c.as_ref() } {
+            Some(c) => c,
+            None => return PunktfunkStatus::NullPointer,
+        };
+        unsafe {
+            if !out.is_null() {
+                *out = c.inner.frames_dropped();
+            }
+        }
+        PunktfunkStatus::Ok
+    })
+}
+
 /// A speed-test measurement, filled by [`punktfunk_connection_probe_result`]. `done` is 0 until
 /// the host's end-of-burst report lands, then 1 (the numbers are final). `throughput_kbps` is the
 /// measured goodput to drive a bitrate choice from; `loss_pct` is the delivery loss at that rate.

crates/punktfunk-core/src/client.rs

@@ -1,10 +1,10 @@
-//! The embeddable `punktfunk/1` client connector (M4 groundwork), behind the `quic` feature.
+//! The embeddable `punktfunk/1` client connector, behind the `quic` feature.
 //!
 //! [`NativeClient::connect`] runs the full client side of the protocol — QUIC handshake
 //! ([`crate::quic`]), UDP data plane ([`crate::session::Session`] on a native thread), input
 //! datagrams — and hands the embedder a dead-simple surface: *pull reassembled access units,
 //! push input events*. This is what the platform clients (SwiftUI/VideoToolbox, Android, …)
-//! link via the C ABI (`punktfunk_connect` & co. in [`crate::abi`]); `punktfunk-client-rs` is the
+//! link via the C ABI (`punktfunk_connect` & co. in [`crate::abi`]); `punktfunk-probe` is the
 //! Rust-native consumer of the same flow.
 //!
 //! Threading: one worker thread owns a tokio runtime (QUIC control plane only — design
@@ -166,7 +166,7 @@ pub struct NativeClient {
 /// kernel sees a high-QoS thread parked waiting on a lower-QoS one and the Thread Performance
 /// Checker flags a priority inversion. Matching the producers to the consumers' QoS removes
 /// the inversion without slowing the Swift side. No-op off Apple (the Linux client/host don't
-/// run a QoS scheduler, and `punktfunk-client-rs` doesn't care).
+/// run a QoS scheduler, and `punktfunk-probe` doesn't care).
 #[cfg(target_vendor = "apple")]
 fn pin_thread_user_interactive() {
     // SAFETY: sets only the current thread's QoS class — always valid to call.

crates/punktfunk-core/src/packet.rs

@@ -12,7 +12,7 @@
 //! `frame_index`↔`frameIndex`, `stream_seq`↔`streamPacketIndex`,
 //! (`block_index`,`block_count`)↔the `multiFecBlocks` nibbles, and
 //! (`data_shards`,`recovery_shards`,`shard_index`)↔the `fecInfo` bitfield. We carry them
-//! as explicit fields rather than bit-packing; full GameStream wire-exactness is an M2
+//! as explicit fields rather than bit-packing; full GameStream wire-exactness is a GameStream-host
 //! concern (it also needs RTP framing + RTSP), this is the coherent internal format.
 
 use crate::config::Config;

crates/punktfunk-core/src/quic.rs

@@ -1,4 +1,4 @@
-//! `punktfunk/1` — the native control plane (M3), gated behind the `quic` feature.
+//! `punktfunk/1` — the native control plane, gated behind the `quic` feature.
 //!
 //! GameStream is punktfunk's compatibility layer; this is the start of its own protocol. A QUIC
 //! connection (quinn, tokio — control plane only, never the per-frame path) carries a
@@ -12,9 +12,9 @@
 //!
 //! after which both sides bring up a [`crate::session::Session`] over a plain
 //! [`UdpTransport`](crate::transport::udp) (native threads, no async) and the host streams.
-//! The Welcome carries everything the M1 core negotiates — FEC scheme (including GF(2¹⁶)
+//! The Welcome carries everything the core negotiates — FEC scheme (including GF(2¹⁶)
 //! Leopard, which GameStream can't express), shard sizing, crypto key/salt — so the data
-//! plane is exactly the hardened M1 `Session`.
+//! plane is exactly the hardened core `Session`.
 //!
 //! Transport security: the host presents a long-lived self-signed certificate
 //! ([`endpoint::server_with_identity`]) and the client pins its SHA-256 fingerprint

crates/punktfunk-core/src/session.rs

@@ -31,7 +31,7 @@ pub struct Frame {
 /// Note: the AEAD layer authenticates each datagram but does **not** provide anti-replay.
 /// Video replays are largely absorbed by the reassembler's per-frame dedup, but replayed
 /// input events are not yet filtered. A sliding-window replay filter keyed on the
-/// authenticated sequence belongs with the pairing/handshake layer (M2); until then,
+/// authenticated sequence belongs with the pairing/handshake layer (the GameStream host); until then,
 /// rely on the LAN/VPN transport assumption (plan §1).
 pub struct Session {
     config: Config,

crates/punktfunk-core/src/transport/udp.rs

@@ -3,7 +3,7 @@
 //! Send is batched via `sendmmsg` ([`Transport::send_batch`], ≤64/syscall) and recv via `recvmmsg`
 //! ([`Transport::recv_batch`], ≤32/syscall into a reused ring) — the 1 Gbps+ syscall lever
 //! (~125k → a few-k syscalls/sec at line rate). The host additionally paces each frame's send
-//! across the frame interval (see `m3.rs::paced_submit`) so a real NIC doesn't drop a line-rate
+//! across the frame interval (see `punktfunk1.rs::paced_submit`) so a real NIC doesn't drop a line-rate
 //! burst. All three layer on this same [`Transport`] seam (scalar fallbacks for loopback/non-Linux).
 
 use super::Transport;
@@ -397,7 +397,7 @@ impl UdpTransport {
     /// Sized for 1 Gbps+: at ~1.2 Gbps on the wire an 8 MB buffer is only ~49 ms of steady state,
     /// and a single multi-MB IDR keyframe (~4 MB ≈ 3300 packets) instantly fills most of it. 32 MB
     /// gives ~200 ms of headroom and absorbs a keyframe burst without EAGAIN drops. (Paced sending
-    /// — `m3.rs::paced_submit` — now spreads a big frame's overflow, so this buffer mostly absorbs
+    /// — `punktfunk1.rs::paced_submit` — now spreads a big frame's overflow, so this buffer mostly absorbs
     /// the immediate microburst rather than a whole unpaced frame.)
     const TARGET_SOCKBUF: usize = 32 * 1024 * 1024;
 

crates/punktfunk-core/tests/loopback.rs

@@ -1,4 +1,4 @@
-//! M1 acceptance: round-trip access units through the full host→client path
+//! Core acceptance: round-trip access units through the full host→client path
 //! (packetize → FEC → loopback with simulated loss → recover → reassemble) and assert
 //! byte-exact recovery, for both FEC schemes, with and without encryption. Plus
 //! property tests over the FEC layer's loss patterns.