refactor: drop milestone names + consolidate clients; loss-recovery & rumble fixes

Two bodies of work in one commit (the rename moved files the fixes also touched).

Naming/structure cleanup (pre-launch):
- Host modules m3.rs->punktfunk1.rs, m0.rs->spike.rs; CLI m3-host->punktfunk1-host,
  m0->spike; bare `punktfunk-host` now prints help. Types M3Options/M3Source->
  Punktfunk1Options/Punktfunk1Source.
- Clients consolidated out of crates/ into clients/: punktfunk-client-rs->
  clients/probe (crate punktfunk-probe), client-linux->clients/linux,
  client-windows->clients/windows, punktfunk-android->clients/android/native
  (crate punktfunk-client-android; kept [lib] name=punktfunk_android so the JNI
  contract is unchanged). crates/ now holds only core + host.
- Milestone codes M0-M4 purged from code/CLI/CLAUDE.md/README/docs/docs-site,
  kept only in docs/implementation-plan.md. docs/m2-plan.md->
  docs/gamestream-host-plan.md. CI/gradle/flatpak paths updated.

Client loss-recovery (video froze and never recovered after a brief drop):
- Export punktfunk_connection_frames_dropped through the C ABI (the core already
  tracked it for the client keyframe-recovery loop; it was never reachable from
  the ABI clients). Regenerated punktfunk_core.h.
- Apple (StreamPump + Stage2Pipeline) and Android (decode.rs) now poll
  frames_dropped and request a keyframe when it climbs -- the same loss-driven
  recovery Linux/Windows already had. Under infinite GOP the decoder silently
  conceals reference-missing frames, so the decode-error trigger rarely fires.

Apple rumble robustness (worked then went spotty -- DualSense + Xbox):
- Add CHHapticEngine stopped/reset handlers (rebuild on app background / audio
  interruption / server reset) and drop the permanent `broken` latch on a
  transient drive failure; latch only when the controller truly has no haptics.
- Surface swallowed SDL set_rumble errors on Linux/Windows + diagnostic logging.

Verified: cargo build/clippy/fmt --workspace, C-ABI harness, header drift.
Not runnable on this box (verify in CI): Gitea workflows, gradle/Android,
flatpak, Swift/decky.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/apple-stage2-presenter.md

@@ -102,10 +102,10 @@ same-host-only, as today.
 - `swift test`: add a decode-output test (decode a known IDR built like
   `VideoToolboxRoundTripTests` → assert a `CVPixelBuffer` of the right dimensions + the
   decode callback fires). Present is display-bound — validate it **live** via the HUD number.
-- Live: connect to a Linux host (`m3-host --source virtual` on the GNOME box; see
+- Live: connect to a Linux host (`punktfunk1-host --source virtual` on the GNOME box; see
   [Ubuntu — GNOME](/docs/ubuntu-gnome)), confirm `capture→present` is a few ms over `capture→client`
   and that `decode→present` shrank vs. an `AVSampleBufferDisplayLayer` baseline.
-- Compare against the headless reference number: `punktfunk-client-rs` reports skew-corrected
+- Compare against the headless reference number: `punktfunk-probe` reports skew-corrected
   capture→reassembled (~1.3 ms p50 GNOME box → dev box); capture→present should be that **+ decode +
   present**.
 

docs-site/content/docs/clients.md

@@ -56,7 +56,7 @@ punktfunk-client --connect <host>:9777   # skip the picker, start a session imme
 
 ## Windows desktop client (in development)
 
-`punktfunk-client` for Windows (`crates/punktfunk-client-windows`) is the native graphical client
+`punktfunk-client` for Windows (`clients/windows`) is the native graphical client
 for Windows — pure Rust, the same `punktfunk/1` core as the Apple and Linux apps, with a **WinUI 3**
 UI (host list, settings, PIN pairing) and the video on a `SwapChainPanel`, plus WASAPI audio, FFmpeg
 decode, SDL3 controllers, network discovery, and PIN pairing. Launch it and pick a host from the
@@ -74,13 +74,13 @@ Until it ships, **Moonlight** remains the recommended way to stream to Windows (
 
 ## Linux reference client (headless)
 
-`punktfunk-client-rs` (in the repo) is a command-line client for the native protocol, used for
+`punktfunk-probe` (in the repo) is a command-line client for the native protocol, used for
 testing, development, and latency measurement — not an everyday client. It connects, streams to a
 file, runs the speed test, and can discover hosts:
 
 ```sh
-punktfunk-client-rs --discover                        # list hosts on the network
-punktfunk-client-rs --connect <host>:9777 --pin <fp>  # connect to one
+punktfunk-probe --discover                        # list hosts on the network
+punktfunk-probe --connect <host>:9777 --pin <fp>  # connect to one
 ```
 
 ## Which should I use?
@@ -90,6 +90,6 @@ punktfunk-client-rs --connect <host>:9777 --pin <fp>  # connect to one
 | A Mac, iPhone, iPad, or Apple TV | The **Apple app** |
 | A Linux desktop or laptop, or a Steam Deck | **`punktfunk-client`** (GTK4) |
 | Windows, Android, a browser, a TV | **Moonlight** |
-| Automated tests / latency measurement | **`punktfunk-client-rs`** (headless) |
+| Automated tests / latency measurement | **`punktfunk-probe`** (headless) |
 
 Whichever you choose, the first connection needs a one-time [pairing](/docs/pairing).

docs-site/content/docs/configuration.md

@@ -47,7 +47,7 @@ Today the native `punktfunk/1` host (`serve --native`) streams **one session at
 clients wait in the accept queue until the active session ends. Each session gets its own virtual
 display at the client's exact resolution; concurrent native sessions are on the roadmap.
 
-(`m3-host`, the standalone test host, has a `--max-concurrent N` knob, default 4, bounded by your
+(`punktfunk1-host`, the standalone test host, has a `--max-concurrent N` knob, default 4, bounded by your
 GPU's encoder — see the [Host CLI](/docs/host-cli) reference — but `serve --native` does **not** take
 that flag.)
 

docs-site/content/docs/gamescope-multiuser.md

@@ -29,7 +29,7 @@ Each gamescope **process is per-session** (`vdisplay/gamescope.rs::create()` spa
 - **EIS input socket — single global file.** gamescope exports `LIBEI_SOCKET` for its children; a
   shell wrapper relays it to the fixed path `/tmp/punktfunk-gamescope-ei` (`EI_SOCKET_FILE`).
   **Two concurrent instances overwrite each other's socket name** in that one file.
-- **Injector — one host-lifetime `!Send` service.** `m3.rs::InjectorService` opens **one**
+- **Injector — one host-lifetime `!Send` service.** `punktfunk1.rs::InjectorService` opens **one**
   `inject::open(backend)` for the whole run and forwards events over an mpsc channel. It was made
   shared deliberately (the portal `CreateSession` churn wedged KWin's EIS — "EIS setup timed out").
   For gamescope it reads the one global socket file, so all sessions' input lands in whichever

docs-site/content/docs/gamestream-host-plan.md

@@ -1,5 +1,5 @@
 ---
-title: "M2 — Moonlight Host"
+title: "GameStream Host"
 description: "Stream to a stock Moonlight client on a client-sized virtual display."
 ---
 
@@ -72,13 +72,13 @@ Ground-truth protocol reference: [`research/gamestream-protocol-research.json`](
   handshake, negotiate `Config`, create a wlroots virtual output sized to the client.
   *Acceptance: Moonlight completes RTSP and the host stands up the UDP streams.*
 - **P1.3 — Video (punktfunk-core P1 codec), plaintext, clean-LAN.** RTP+NV framing + FEC shard
-  layout in punktfunk-core; wire M0's NVENC AUs → UDP 47998. *Acceptance: Moonlight DISPLAYS video.*
+  layout in punktfunk-core; wire the spike's NVENC AUs → UDP 47998. *Acceptance: Moonlight DISPLAYS video.*
 - **P1.4 — Control + input.** ENet (`rusty_enet`) control stream; decode input → `inject.rs`
   (uinput/reis); request-IDR → force NVENC keyframe. *Acceptance: mouse/keyboard work.*
 - **P1.5 — Robustness: FEC recovery + encryption.** nanors-exact FEC; per-shard AES-GCM.
   *Acceptance: stable under `tc netem` loss; encrypted streams.*
 - **P1.6 — Audio + polish.** Opus + audio RTP/FEC/CBC (UDP 47999); disconnect teardown; KWin
-  backend for the user's KDE box. *Acceptance: full game stream with sound — the M2 goal.*
+  backend for the user's KDE box. *Acceptance: full game stream with sound — the GameStream-host goal.*
 
 ## Crates (verified available)
 

docs-site/content/docs/host-cli.md

@@ -32,15 +32,15 @@ token is **required** when you bind the API off loopback with `--mgmt-bind`.
 By default the host **requires pairing** — see [Pairing & Trust](/docs/pairing). On `serve --native` you
 **arm pairing from the web console** (or mgmt API); the host then displays a 4-digit PIN. Pass `--open` to
 turn off the mandatory-pairing default and serve any device on the network (trusted single-user setups
-only). The pairing flags below are `m3-host`-only and do **not** apply to `serve`.
+only). The pairing flags below are `punktfunk1-host`-only and do **not** apply to `serve`.
 
-## `m3-host`
+## `punktfunk1-host`
 
 A standalone native-only host, mainly for testing the `punktfunk/1` path without the GameStream server
 or web console.
 
 ```sh
-punktfunk-host m3-host --source virtual
+punktfunk-host punktfunk1-host --source virtual
 ```
 
 | Flag | Meaning |
@@ -53,12 +53,12 @@ punktfunk-host m3-host --source virtual
 | `--allow-pairing` | Accept PIN pairing; the host prints a PIN when a client pairs. |
 | `--require-pairing` | Only serve paired devices (implies `--allow-pairing`). |
 
-`--max-concurrent`, `--allow-pairing`, and `--require-pairing` are **`m3-host`-only** — `serve` does not
+`--max-concurrent`, `--allow-pairing`, and `--require-pairing` are **`punktfunk1-host`-only** — `serve` does not
 accept them. On `serve --native` you arm pairing from the web console instead, and concurrency is not
 yet capped from the command line.
 
-Both `serve --native` and `m3-host` advertise the host on the network so clients can discover it. List
-hosts from another machine with `punktfunk-client-rs --discover`.
+Both `serve --native` and `punktfunk1-host` advertise the host on the network so clients can discover it. List
+hosts from another machine with `punktfunk-probe --discover`.
 
 ## Environment
 

docs-site/content/docs/implementation-plan.md

@@ -276,7 +276,7 @@ punktfunk/
 │   │   ├── src/vdisplay/     # trait + kwin/wlroots/mutter impls
 │   │   ├── src/input/        # reis + uinput
 │   │   └── src/web/          # axum config/pairing API
-│   └── punktfunk-client-rs/      # reference Rust client (M4)
+│   └── punktfunk-probe/      # reference Rust client (M4)
 ├── clients/
 │   ├── apple/                # Swift package, imports punktfunk_core.h (M5)
 │   └── android/              # Kotlin + JNI (later)

docs-site/content/docs/pairing.md

@@ -45,7 +45,7 @@ host's management console, click to arm pairing, and the host displays a 4-digit
 list of paired devices. This works on a headless host over the network — there is no command-line flag
 to arm pairing on `serve`.
 
-(The standalone headless test host, `m3-host`, takes `--allow-pairing`/`--require-pairing` on its
+(The standalone headless test host, `punktfunk1-host`, takes `--allow-pairing`/`--require-pairing` on its
 command line instead; the production `serve --native` host arms pairing from the console.)
 
 Then, on the client:
@@ -60,13 +60,13 @@ the right setting on a shared network: a device has to complete the PIN ceremony
 connect.
 
 If you're on a fully trusted single-user network and want to skip pairing, run the host open with
-`serve --native --open` (or `m3-host --allow-tofu` for the standalone host) — it then advertises
+`serve --native --open` (or `punktfunk1-host --allow-tofu` for the standalone host) — it then advertises
 `pair=optional` and accepts unpaired clients. Requiring pairing is strongly recommended.
 
 ## Trust-on-first-use (host opt-in)
 
 Trust-on-first-use (TOFU) is **off by default** and is an explicit *host* opt-in for fully trusted
-networks. A host enables it by running open — `m3-host --allow-tofu` or `serve --open` — which makes
+networks. A host enables it by running open — `punktfunk1-host --allow-tofu` or `serve --open` — which makes
 it advertise `pair=optional` over mDNS and accept unpaired clients. Only then does a client offer the
 TOFU path: connecting to such a host for the first time shows the host's fingerprint and asks you to
 confirm it (compare it with the one the host logged at startup), then pins it. The client presents

docs-site/content/docs/roadmap.md

@@ -20,7 +20,7 @@ Steam session at the **client's exact resolution + refresh** — games see it (v
 change, reused (no Steam restart) on the same mode. Plus macOS/iPad input fixes (NSEvent motion +
 iPad pointer-lock) and a 4K/5K one-frame-freeze fix (grow the UDP socket buffers).
 
-**Next:** **§8 pairing & trust hardening** (mandatory PIN by default + delegated approval), the M4
+**Next:** **§8 pairing & trust hardening** (mandatory PIN by default + delegated approval), the native
 client presenter + iOS (§6), and a Windows host (§7 — now **de-risked via SudoVDA**, no custom
 signed driver needed). **§10 HDR/10-bit is parked — blocked upstream at the compositor** (no
 gamescope/KWin PipeWire 10-bit producer yet).
@@ -88,7 +88,7 @@ select = a `pw_stream` with `Direction::Output` + `media.class=Audio/Source`.
 - **Touch — implemented (host path), pending a backend that lands it.** `TouchDown/Move/Up`
   InputKinds (reuse the abs-pointer `flags=(w<<16)|h` mapping, `code`=touch id); host
   `inject/libei.rs` requests the `Touchscreen` device type + binds the `Touch` capability and
-  injects `ei_touchscreen` down/motion/up; `punktfunk-client-rs --touch-test` drags a finger.
+  injects `ei_touchscreen` down/motion/up; `punktfunk-probe --touch-test` drags a finger.
   **Validated:** KWin's RemoteDesktop portal *grants* the Touchscreen device type, but its EIS
   server creates **no touchscreen device** (headless KWin) — so touch currently no-ops on KWin
   (now logged once). The code is correct; it needs a backend that exposes `ei_touchscreen`
@@ -102,14 +102,14 @@ select = a `pw_stream` with `Direction::Output` + `media.class=Audio/Source`.
   trigger effects (L2/R2)**. Protocol carries new side-planes: rich-input `0xCC`
   (touchpad/motion) + HID-output `0xCD` (LED/triggers). `/dev/uhid` udev rule shipped.
 - **Rich DualSense — Phase C/D/E end-to-end, validated live.** `PUNKTFUNK_GAMEPAD=dualsense`
-  selects a per-session `DualSenseManager` (the `PadBackend` enum in `m3.rs`): client gamepad frames
+  selects a per-session `DualSenseManager` (the `PadBackend` enum in `punktfunk1.rs`): client gamepad frames
   build the DualSense report; the kernel's feedback comes back as `HidOutput` on the **0xCD** plane
   (lightbar / player LEDs / adaptive triggers) while **rumble stays on the universal 0xCA plane**
   (so non-DualSense clients still feel it); touchpad + motion ride the **0xCC** rich-input plane
   (`DualSenseManager::apply_rich`, merged with button state). The connector + C ABI gained
   `punktfunk_connection_next_hidout` (→ `PunktfunkHidOutput`) and `punktfunk_connection_send_rich_input`
-  (← `PunktfunkRichInput`); header regenerated. Validated on-box: a synthetic-source `m3-host` +
-  `punktfunk-client-rs --rich-input-test` created the real kernel DualSense, drove 0xCC, and decoded
+  (← `PunktfunkRichInput`); header regenerated. Validated on-box: a synthetic-source `punktfunk1-host` +
+  `punktfunk-probe --rich-input-test` created the real kernel DualSense, drove 0xCC, and decoded
   12 live 0xCD events (the kernel's actual lightbar/trigger init reports) — data plane unaffected
   (600/600 frames). *Remaining:* the Apple client renders adaptive triggers + rumble on a real
   DualSense (`GCDualSenseAdaptiveTrigger`) — handed off to the client agent for the real playtest.
@@ -192,7 +192,7 @@ value) instead of guesswork that ends in a stuttering stream.
   and exposes it (`punktfunk_connection_speed_test()` + `punktfunk_connection_probe_result()` →
   `PunktfunkProbeResult{throughput_kbps, loss_pct, …}`). Probe filler is diverted from the decoder.
   Validated on loopback (synthetic source): a 20 Mbps/2 s probe measured 20050 kbps at 0% loss,
-  interleaved probe AUs excluded from frame verification. `punktfunk-client-rs` gains `--bitrate` +
+  interleaved probe AUs excluded from frame verification. `punktfunk-probe` gains `--bitrate` +
   `--speed-test KBPS:MS` as the reference/loopback driver.
 
 **Done (Apple client UI):** Settings grows a Bitrate control (Automatic = host default; manual is
@@ -244,7 +244,7 @@ the GF(2⁸)/Moonlight ~1 Gbps wall). A 6-way subagent investigation (2026-06-11
 **Verdict: ~halfway, and it's mostly clamps + ONE real piece of work.** Already 1 Gbps-ready and
 untouched: the integer/type path (u32 kbps → u64 → int64_t, no truncation); FEC (a 1 Gbps frame is
 only ~434–874 data shards = a single GF(2¹⁶) block, two orders under the 65535 ceiling); AES-GCM
-(RustCrypto auto AES-NI, ~10–25× headroom on x86_64); the u64 sequence/nonce space; and the **M1
+(RustCrypto auto AES-NI, ~10–25× headroom on x86_64); the u64 sequence/nonce space; and the **core
 `ReassemblerLimits`** — fully *derived* from the negotiated `FecConfig`, so they already admit every
 legit high-bitrate frame with nothing to relax. Security invariant to keep: every allocation size
 must trace to a host-negotiated parameter clamped to a scheme ceiling — scale via the negotiated
@@ -271,7 +271,7 @@ params (`max_data_per_block`, `shard_payload`), never by widening a bound by han
 - **DoS hygiene (last):** derive the one hardcoded reassembler field (`max_frame_bytes` = 64 MiB,
   never set by `session_config`) from the negotiated mode/bitrate — strictly *tightens* the surface.
 - **Validate with the speed-test probe** (it reuses the real `submit_frame`→FEC+crypto+send path):
-  `punktfunk-client-rs --speed-test KBPS:MS`, RELEASE build (debug is CPU-bound ~30 Mbps), watching
+  `punktfunk-probe --speed-test KBPS:MS`, RELEASE build (debug is CPU-bound ~30 Mbps), watching
   `packets_send_dropped`. Open Qs: NVENC CBR rate-tracking at 0.5–1 Gbps (no explicit
   `rc_buffer_size`); LAN/QEMU-NIC jumbo/GSO support; any `web/` bitrate slider hardcoding 500 Mbps.
 
@@ -344,7 +344,7 @@ buffer; `sendmmsg`/`recvmmsg` batching; the capture-timestamp anchor placement.
 
 The native protocol had no discovery — clients connected by `--connect HOST:PORT` only, while
 GameStream already auto-discovered via mDNS (`_nvstream._tcp`). Now both the unified host
-(`serve --native`) and standalone `m3-host` advertise the native service over mDNS:
+(`serve --native`) and standalone `punktfunk1-host` advertise the native service over mDNS:
 
 - **Service**: `_punktfunk._udp.local.` (UDP — punktfunk/1 is QUIC; the advertised port is the QUIC
   control/data port). Host side: `crate::discovery::advertise_native`, wired into `m3::serve` so
@@ -353,7 +353,7 @@ GameStream already auto-discovered via mDNS (`_nvstream._tcp`). Now both the uni
 - **TXT records**: `proto=punktfunk/1`, `fp=<host cert SHA-256>` (the value a client pins — advisory
   over unauthenticated mDNS, TOFU/pinning still verifies on connect), `pair=required|optional`
   (so a picker knows up front whether the PIN ceremony is needed), `id=<host uniqueid>` (dedup).
-- **Client**: `punktfunk-client-rs --discover [SECS]` browses and prints each host (name, addr:port,
+- **Client**: `punktfunk-probe --discover [SECS]` browses and prints each host (name, addr:port,
   pairing, fingerprint), then exits. Apple clients browse the same service natively via NWBrowser
   (Bonjour) — no Rust-connector dependency; this section's service type + TXT keys are the contract.
 - **Validated**: cross-LAN — dev box discovered the GNOME-box appliance

docs-site/content/docs/running-as-a-service.md

@@ -82,7 +82,7 @@ session unit — see [Bazzite](/docs/bazzite).
 After a reboot, from another machine on the network:
 
 ```sh
-punktfunk-client-rs --discover     # or just look for the host in the Apple app / Moonlight
+punktfunk-probe --discover     # or just look for the host in the Apple app / Moonlight
 ```
 
 If the host is listed, it's up. If not, check `journalctl --user -u punktfunk-host` on the host.

docs-site/content/docs/status.md

@@ -11,10 +11,10 @@ and the design in the [Implementation Plan](/docs/implementation-plan); this pag
 
 | Milestone | State |
 |---|---|
-| **M1** — `punktfunk-core` + C ABI (protocol · FEC · crypto) | ✅ complete & hardened |
-| **M2** — GameStream host (Moonlight-compatible) | ✅ working end-to-end; HDR/surround-audio polish open |
-| **M3** — `punktfunk/1` native protocol (QUIC control + UDP data) | ✅ full session planes, validated live |
-| **M4** — native client decode + present (Apple first) | 🟡 macOS stage 1 live; stage-2 presenter built + decode-tested (opt-in, present needs live validation). **Linux GTK client stage 1 live** (2026-06-12) |
+| **Core** — `punktfunk-core` + C ABI (protocol · FEC · crypto) | ✅ complete & hardened |
+| **GameStream host** (Moonlight-compatible) | ✅ working end-to-end; HDR/surround-audio polish open |
+| **Native protocol** — `punktfunk/1` (QUIC control + UDP data) | ✅ full session planes, validated live |
+| **Native clients** — decode + present (Apple first) | 🟡 macOS stage 1 live; stage-2 presenter built + decode-tested (opt-in, present needs live validation). **Linux GTK client stage 1 live** (2026-06-12) |
 
 ## Live on the boxes
 
@@ -29,7 +29,7 @@ All three appliances advertise over mDNS (`_punktfunk._udp`) and require PIN pai
 ## Progress log
 
 ### 2026-06-12
-- **Native Linux client — stage 1, first light** (`crates/punktfunk-client-linux`, binary
+- **Native Linux client — stage 1, first light** (`clients/linux`, binary
   `punktfunk-client`). GTK4/libadwaita app on the **Option A** architecture picked after a
   six-angle research pass (toolkits / hw decode / Wayland presentation / input capture /
   prior art / codebase): links `punktfunk-core` directly as a crate (no C ABI;
@@ -81,7 +81,7 @@ All three appliances advertise over mDNS (`_punktfunk._udp`) and require PIN pai
   client's capture→reassembled latency valid **cross-machine**. Validated GNOME box → dev box:
   offset −1.57 ms removed, **p50 1.30 ms** skew-corrected. (`05bc9ab`)
 - **Native LAN auto-discovery** — host advertises `_punktfunk._udp` (TXT: fingerprint, pairing,
-  proto); `punktfunk-client-rs --discover` lists hosts. Validated cross-LAN. (`4fff464`)
+  proto); `punktfunk-probe --discover` lists hosts. Validated cross-LAN. (`4fff464`)
 - **Third test box stood up** — home-worker-3 (Ubuntu 26.04, RTX 4090, GNOME 50): first GNOME/Mutter
   zero-copy streaming on a real desktop; **1 Gbps probe clean** (625 MB/5 s, `send_dropped=0`).
   Two physical-NVIDIA gotchas documented in [Ubuntu — GNOME](/docs/ubuntu-gnome).

docs-site/content/docs/windows-host.md

@@ -25,7 +25,7 @@ punktfunk is cleanly layered. **~95% of the codebase is platform-agnostic and re
 | QUIC control plane (`quic.rs`, pairing, mode negotiation) | quinn + tokio are portable |
 | GameStream P1.1 (mDNS, serverinfo, pairing, RTSP, ENet) — *except* `stream.rs`/`audio.rs` | pure wire logic |
 | Management REST API (`mgmt.rs`) + OpenAPI | axum/tokio, portable |
-| Pipeline + `m3.rs` orchestration | trait-generic — calls `capturer.next_frame()`, `encoder.submit/poll()`; **needs zero changes** |
+| Pipeline + `punktfunk1.rs` orchestration | trait-generic — calls `capturer.next_frame()`, `encoder.submit/poll()`; **needs zero changes** |
 | The **trait boundaries** themselves: `Capturer`, `Encoder`, `VirtualDisplay`, `InputInjector`, `AudioCapturer`, `VirtualMic` | platform-neutral signatures; Linux deps are already isolated under `[target.'cfg(target_os="linux")'.dependencies]` |
 
 So a Windows host is **new `#[cfg(target_os = "windows")]` backend modules behind the existing