3048 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	5d8682d7b7	feat(vdisplay): explain a cinnamon/muffin compositor pin instead of listing backends ... PUNKTFUNK_COMPOSITOR=cinnamon is the first thing a Mint or LMDE user reaches for, and the bare list of accepted values invites the next-closest guess — 'mutter', since Muffin is a Mutter fork — which starts a session that fails deep inside an org.gnome.Mutter.ScreenCast call Muffin does not serve. No value of the variable can work, so say that and name headless gamescope, which needs no desktop compositor.	2026-08-13 11:50:05 +02:00
enricobuehler	030bc8a1c2	docs(debian): use deb822 sources for non-free, not apt-add-repository ... software-properties-common is not available in Debian 13, so the apt-add-repository line could not have worked. Debian 13 keeps its sources in deb822 format; edit Components there instead (verified in a trixie container — the NVIDIA driver it then offers is 550, above our 535 floor).	2026-08-13 11:47:20 +02:00
enricobuehler	346385bad8	fix(deb): ship punktfunk-gamescope on apt at last, and support Debian 13 ... `punktfunk-gamescope` had never been published to the apt registry — not in any release. It was built inside the host job's Ubuntu 24.04 image, where it cannot build: our pin vendors wlroots 0.19.3, which floors `wayland-server` at 1.23.1, and noble ships 1.22.0 (it also lacks libxcb-errors-dev and has only libdisplay-info 0.1.1). Every rung of that path was a `::warning::` returning 0 and the one hard gate ran last by design, so v0.26.0 and v0.27.0 both released with the package missing while docs-site told apt users to install it. The same tags shipped it fine for Arch, Fedora 44 and Bazzite. It now builds in its own job on Debian 13 (ci/gamescope-trixie.Dockerfile), the oldest apt base the tree configures on. One package serves Debian 13 AND Ubuntu 26.04 — measured by installing and running it on both — because the build also vendors libdisplay-info via the new `--extra-fallback` option: linked against the distro copy it demands `libdisplay-info2` on trixie, which Ubuntu 26.04 does not have (it carries libdisplay-info3). The option is opt-in, so the Arch/Fedora/nix outputs are byte-for-byte unchanged. Ubuntu 24.04 gets no gamescope package and cannot — its wayland is too old to run one however built. Debian 13 is now a documented host target. That needed no packaging change at all: the host .deb's glibc-2.39 floor and bundled FFmpeg already made it installable, and it had been working for a long time while docs-site said Debian was unsupported and unverified. Verified by installing: host, web console and plugin runner install, resolve every soname and run. The desktop client stays Ubuntu-26.04-only (built there, floors at `libc6 >= 2.43`; Debian 13 has 2.41). Compositor detection now answers Cinnamon (Mint, LMDE) with the route that works instead of advice that cannot help. Muffin forked from Mutter 3.36: `org.cinnamon.Muffin.ScreenCast` has only RecordMonitor/RecordWindow, never RecordVirtual, and xdg-desktop-portal-xapp implements no ScreenCast — so no value of PUNKTFUNK_COMPOSITOR makes a Cinnamon desktop host a virtual display. The error names headless gamescope, which needs no desktop compositor. The XDG sniff moved into a pure function so those branches are testable; Cinnamon is matched before GNOME, since it is a GNOME derivative and the generic arm would otherwise hand it the Mutter backend (caught by the new test). New `smoke-install` job installs every published package from the registry in pristine ubuntu:24.04, ubuntu:26.04 and debian:trixie images, asserts each binary resolves its libraries and runs, and insists the version served is the one this run built. Nothing in deb.yml had ever installed a package it produced, which is how both of the above survived unnoticed. ⚠ Bootstrap: seed `punktfunk-gamescope-trixie:latest` into the LAN registry once (docker.yml builds it thereafter) or the new job cannot start.	2026-08-13 11:43:54 +02:00
enricobuehler	124cb66324	Merge pull request 'Wake-on-LAN: support WoWLAN so Wi-Fi hosts wake like wired ones' (#187) from worktree-wowlan-support into main	2026-08-12 22:51:57 +00:00
enricobuehler	6774c4e7a2	feat(wol): support WoWLAN so Wi-Fi hosts wake like wired ones ... The host's arming check asked `ethtool` about every NIC, which is the wrong question for Wi-Fi: the magic-packet trigger lives in nl80211's WoWLAN state, and most wireless drivers print `Wake-on: d` whether or not it is armed. An armed Wi-Fi host was therefore told it was NOT armed, and handed an `ethtool -s wlan0 wol g` its driver rejects. A NIC with an nl80211 phy (`/sys/class/net/<i>/phy80211`) is now asked `iw phy <phy> wowlan show` instead, and the warning carries WoWLAN-correct guidance — `iw ... wowlan enable magic-packet`, plus the NetworkManager `802-11-wireless.wake-on-wlan magic` that survives a reconnect. Two fallbacks for when `iw` can't answer (missing binary, driver without the command, or privilege the user-level host service lacks): a POSITIVE ethtool reading counts (brcmfmac & co do report there), a negative one never does, and sysfs `device/power/wakeup` reading `disabled` is conclusive in the negative. The client sender now emits from a socket bound to EACH non-loopback interface's own address rather than leaving the path to the routing table. A station in WoWLAN sleep stays associated and its AP buffers broadcast frames for it until the next DTIM beacon — but only if the datagram reaches the wireless segment at all, and with a VPN or mesh interface holding the default route `255.255.255.255` never did. A failed bind falls back to the routed socket, so no segment is lost. Tests: `iw`/`ethtool` output parsing split from the commands so both are unit- tested on any platform, and a new end-to-end test asserts a real listener receives the 102 magic-packet bytes. Verified on Linux (Ubuntu 26.04, 12 interfaces): `cargo fmt --all --check`, `cargo clippy -p punktfunk-core -p punktfunk-host --all-targets --locked -- -D warnings`, and both wol test sets green. NOT yet exercised against real Wi-Fi hardware — no Wi-Fi Linux box was reachable.	2026-08-13 00:49:21 +02:00
enricobuehler	f06b84be63	Merge pull request 'plugin-kit 0.4.1 — publish the icon field, without which no plugin can name its mark' (#186) from worktree-launcher-icon-kit-release into main plugin-kit-v0.4.1	2026-08-12 22:30:11 +00:00
enricobuehler	d6dbb391d6	chore(plugin-kit): 0.4.1 — publish the icon field, without which no plugin can name its mark ... `ProviderEntry.icon` landed in f62a48d4 along with the token's whole supporting cast: the host-side shape guard, the seven masters, six client renderers, the SDK and the OpenAPI. What it did not get was a version bump, and the kit had cut 0.4.0 the day before. So the registry's 0.4.0 is the tarball WITHOUT the field, and it is the newest thing any plugin can resolve. A plugin that emits `icon` on a launcher entry therefore fails `tsc --noEmit` — "Object literal may only specify known properties, and 'icon' does not exist" — which is a CI gate in every plugin repo. That is why the three plugins that were supposed to carry the token never shipped it: the edits could not be committed against a kit that had no field to fill. Nothing but the version moves here. The only plugin-kit change since 0.4.0 was published is f62a48d4 itself, so 0.4.1 is exactly that commit's kit surface — one optional string on an existing struct, additive, and inert for a plugin that never sets it.	2026-08-13 00:29:26 +02:00
enricobuehler	907080f92b	Merge pull request 'The Windows host could tank a local game's 1% lows — mint retries broadcast PnP device changes at the whole box, and session tuning never reverted' (#185) from worktree-audio-stutter-fixes into main ... Reviewed-on: #185	2026-08-12 22:03:47 +00:00
enricobuehler	9425c6d40a	docs(changelog): audio no longer costs local-game frame time on Windows hosts	2026-08-12 22:38:35 +02:00
enricobuehler	ab8c7ec37c	fix(audio/windows): stop the mint retry path from broadcasting PnP device changes at the whole box, and revert session tuning when streaming ends ... Field report (2026-08-12): Punktfunk's audio devices tank Helldivers 2 to 1% lows of 2-5 FPS; uninstalling restores performance. Two host-side mechanisms can plausibly do that, both fixed here. The mint retry storm: minted::ensure_blocking() ran a FULL provisioning pass on every mic-pump open with no cooldown, no in-flight guard, and no give-up - and ensure_role() reached UpdateDriverForPlugAndPlayDevicesW even when the devnode already existed. On a box where minting never latches, the pump's reopen backoff (capped 60 s) turned that into a PnP driver rebind + system-wide device-change broadcast roughly once a minute, forever - and games rebuild their audio graph on each broadcast. Now: * ensure_role() gets a steady-state fast path: a marker devnode whose endpoints are all live resolves without touching PnP or the default-device policy. * ensure_blocking() waits on an in-flight pass instead of racing a second SetupAPI sweep against it (the dead-mic-air deploy race), honours RETRY_COOLDOWN after a failed pass (first-ever resolve still blocks, per the cold-boot mint contract), and * five unlatched passes stop minting for the host lifetime (a service restart re-arms) - counted across the worker and the blocking path. The never-reverted session tuning: pf-frame's tune_process_once() put the whole host at HIGH_PRIORITY_CLASS with timeBeginPeriod(1) and DWM MMCSS on the first hot stream thread and documented 'reverts at process exit' - but the host is a 24/7 service, so after one stream it competed at HIGH class with a 1 ms global timer against whatever the user played locally, forever. The process-wide tuning is now refcounted across the hot threads via a TLS guard: the first hot thread applies it, the last one's exit reverts it (timeEndPeriod, DwmEnableMMCSS(0), NORMAL class) - the same thread-exit lifetime the MMCSS and execution-state effects already ride. Every on_hot_thread() call site is a session-scoped thread (capture/encode, packetizer, send, NVENC retrieve), so the revert lands at session teardown.	2026-08-12 22:29:54 +02:00
enricobuehler	64e2af17c5	Merge pull request 'fix(decky): duplicate shortcut minted every boot + toast noise cut' (#184) from worktree-decky-shortcut-dup into main	2026-08-12 20:25:57 +00:00
enricobuehler	72189b29ec	Merge branch 'main' into worktree-decky-shortcut-dup	2026-08-12 22:24:34 +02:00
enricobuehler	339a1d70f9	fix(decky): stop toasting on every launch and every failed panel refresh ... Field complaint: the plugin toasts too much. Inventory of all 14 toast sites says almost all are rare, explicit-tap feedback (pairing, update buttons, recovery actions) — but two were routine-volume offenders: * startStream toasted "Starting stream — <host>" on EVERY successful launch, i.e. the overwhelming majority of all toasts the plugin ever shows. It repeats the button the user just pressed, and lands ON TOP of the starting stream after the QAM closes. Gone; launch FAILURES still toast (the QAM may already be closed, so inline state would go unseen). * useHosts.refresh() toasted "Couldn't list hosts" from its catch — and the panel remounts (and refreshes) on every QAM open, so a broken backend nagged on each open. It's now a third inline `problem` row ("Couldn't scan for hosts"), sitting next to the Refresh button that retries it, like the client-unavailable/client-outdated states already did. The update-flow, pairing, trust and recovery toasts stay: each is a rare, single, information-carrying response to an explicit tap (or, for the request-access hint, the only warning that the connect is about to park). Verified: tsc --noEmit and the rollup bundle pass.	2026-08-12 22:05:16 +02:00
enricobuehler	79dba7f95a	fix(decky): a boot race minted a new library shortcut on every plugin load ... Field report: each Steam start added another visible "Punktfunk" entry (spotted in the desktop client, where the pile is plain to see). Mechanism: db063792 made shortcutStillExists() actually answer for the first time — and its callers treat a null overview as "the user deleted the shortcut" and AddShortcut a replacement. But the plugin mounts while Steam is still starting up, BEFORE appStore has registered its overviews, so the remembered (perfectly live) appId looks up as null on every boot: mint a duplicate, remember the new id, orphan yesterday's. One new entry per load, forever. The deleted verdict now has to be earned, and creation is a last resort: * shortcutStillExists() only believes "absent" once the store is demonstrably hydrated: wait out App.WaitForServicesInitialized (raced against the poll budget so a wedged signal can't hang the guard), poll until allApps is non-empty, then one grace recheck — overview registration can trail the bulk hydration. Unverifiable within budget answers true: a false "alive" merely no-ops until the next ask, a false "dead" duplicates forever. * On a genuinely lost id, both ensure paths first ADOPT an existing same-named shortcut (excluding the other role's) instead of minting an N+1th — which also heals installs the old builds already littered. * Both ensures are single-flight: mount's fire-and-forget can now be mid-wait when a QAM press arrives, and two ensures racing past the liveness check would each AddShortcut. * "Recreate library shortcut" additionally sweeps surplus "Punktfunk" shortcuts (RemoveShortcut) and toasts the count — cleanup for piles already minted. Deliberately button-only, never mount: automatic library deletion at boot is a bigger hazard than the mess. Verified: tsc --noEmit and the rollup bundle both pass; the launch paths (launchStream / launchGamepadUi) hit the fast path unchanged — a live overview answers the first query and nothing waits.	2026-08-12 21:54:06 +02:00
enricobuehler	d7430fe2bd	Merge pull request 'fix(ci): gate C counts comments, and a comment named the env mutators verbatim' (#183) from fix/gate-c-comment-token into main	2026-08-12 16:57:38 +00:00
enricobuehler	6f81ec24ba	fix(ci): gate C counts comments, and a comment named the env mutators verbatim ... 55a3d8b9 (#181) added the edition-2024 lint-level rationale to the session bin's header naming std::env::set_var/remove_var — gate C's grep counts comments by contract, so main went red at 5 mentions against the 4-call-site baseline. Reword the comment instead of raising the baseline: a baseline of 5 with one comment inside would hide the next real call site. Verified: scripts/ci/check-unsafe-hygiene.sh clean, cargo fmt clean.	2026-08-12 18:57:07 +02:00
enricobuehler	539236de91	Merge pull request 'feat(pad-audio): Linux hosts stream pad audio — the per-pad PipeWire sink (WP3)' (#182) from worktree-linux-pad-audio into main	2026-08-12 16:55:06 +00:00
enricobuehler	118758ff0b	fix(pad-audio): the Linux pad sink speaks GE-Proton's AUX0-3 channel shape ... A field report (GE-Proton 11-5, real DualSense on-host) surfaced the missing constraint: haptics only work when the pad's card runs the Pro Audio profile — because GE's route opens the node through its bundled pipewire-alsa plugin with aux_channels=1, and its pulse fallback forces a PA AUX0..3 map with stream.dont-remix (proton-ds5-haptic patches 0013/0115/0116: "the hidden PipeWire parent for a DualSense output exposes AUX0 through AUX3"). A positioned FL FR RL RR sink puts those writers through position channelmix instead of index passthrough. The sink now advertises AUX0..AUX3. Proven on the box: an AUX-mapped rear-pair-only tone captures index-exact (speaker pair 0.0000, coil pair 0.3662); a positioned stray stream folds into the speaker pair and never excites the coils. The devtest reports per-pair peaks so exactly this class of remix bug is visible. Also confirmed from the GE patch set while here: device matching is device.bus/vendor.id/product.id + the Sony/Wireless_Controller name substrings (both of which the sink carries), and the MMDevice container is now synthesized from the wine-side HID USB parent (patch 0112) — the old pure-PW-node GUID_NULL concern no longer applies on GE >= 11-4.	2026-08-12 18:53:35 +02:00
enricobuehler	dcde856178	feat(pad-audio): Linux hosts stream pad audio — the per-pad PipeWire sink (WP3) ... The 0xD1 plane was Windows-host-only: host_cap() answered false and spawn() was a stub everywhere else, so an Android tier-A client against a Linux host negotiated the cap off and stayed on wire rumble. The whole downstream machinery (framer, silence gate, lanes, 0xD1 send) was already capture- agnostic — only the capturer was WASAPI. - audio/linux/pad_sink.rs: one Audio/Sink stream node per DualSense-family pad, minted with the identity the matchers read (ALSA-style node.name with the pad's pairing MAC, description "Wireless Controller", bus/vendor/ product/form-factor proplist, per-pad serial), 4-ch F32 48 kHz FL FR RL RR, no default-sink claim, priority.session 50. The process() callback IS the capture. PUNKTFUNK_PAD_SINK_NAME/_DESC override the strings for field debugging ({pad}/{mac} expand). - native/pad_audio.rs: the shared logic and lanes compile on Linux; pad_audio_thread is generic over the capturer (open-with-backoff kept); host_cap() Linux arm = client asked + PUNKTFUNK_PAD_AUDIO + a reachable PipeWire socket; spawn() Linux arm mints the sink lazily in the streamer thread. spawn() gains an edge flag (Edge identity; ignored on Windows). - devtest pad-sink-test: mint one sink and capture from it, no client — the WP3 on-glass gate. Verified on a Bazzite 44 host: identity served through pipewire-pulse, rear-pair (voice-coil) tone captured bit-exact over both the native and pulse legs. - docs: PUNKTFUNK_PAD_AUDIO{,_SLOTS} are no longer (Windows); the roadmap non-goal narrows to Bluetooth client pads. Gates (fedora:44 container, natively on the .41 box): cargo build --release --locked (nvenc+vulkan-encode), clippy --all-targets -D warnings, cargo test pad_audio+pad_sink 11/11, cargo fmt.	2026-08-12 18:53:35 +02:00
enricobuehler	77918674c3	Merge pull request 'An over-declared HEVC level no longer demotes native Vulkan decode, and the Windows client legs build again' (#181) from worktree-vk-level-gate-clamp into main	2026-08-12 16:48:56 +00:00
enricobuehler	faefbae830	fix(pf-presenter): spell MAKEINTRESOURCE(1) as ptr::without_provenance — clippy 1.96's manual_dangling_ptr reads the integer-ordinal cast as a dangling pointer and fails the Windows -D warnings gate (masked on main by the client bins failing to build first)	2026-08-12 18:47:45 +02:00
enricobuehler	44fa12a298	test(pf-vkdecode): bind the PTL level reads so the SAFETY comments precede their unsafe blocks (clippy::undocumented_unsafe_blocks counts nothing inside macro arguments)	2026-08-12 18:47:45 +02:00
enricobuehler	55a3d8b919	fix(clients/session): the edition-2024 session bin cannot build on Windows ... The half of the #177 fallout #180's follow-up could not reach: WP20 wrapped the session bin's single-threaded-startup env writes in the `unsafe {}` blocks edition 2024 requires — under `#![forbid(unsafe_code)]`, which no inner attribute can override, so `punktfunk-client-session` fails with two hard errors on every Windows leg (main push runs 17615/17616 red at Build; verified on .173). Same resolution as #180 gave the GTK shell: `forbid` becomes `deny`, and the three documented SAFETY sites carry the localized `#[allow(unsafe_code)]` pf-update models.	2026-08-12 18:47:45 +02:00
enricobuehler	a02014ec19	fix(pf-vkdecode): treat an over-declared stream level as a clamp, not a refusal ... A 2026-08-12 field report (RTX 5060 client): every HEVC session demoted to D3D11VA with 81 "outside device caps: stream level (Std code point 12) above the device's maxLevelIdc (H.265 Std level 11)" refusals — the host's AMF encoder stamps general_level_idc 6.2 (the codec maximum) on a 4K120 stream that needs 5.2, and NVIDIA's driver caps H.265 decode at 6.1. The hardware decodes the actual stream trivially; only the declaration was oversized. AV1 passed the same gate, which is why "native-vulkan runs only with AV1". The declared level is a claim, and the stream's real demands are enforced where they are physical facts — coded extent and DPB depth, both checked at session build. So the up-front level gate (H.264 + H.265) now warns once and proceeds, and every SPS/VPS handed to the Vulkan parameters object has its level clamped to the device ceiling (a set above maxLevelIdc is invalid usage). AV1's gate is untouched: its code space is the bitstream's own and no over-declaration has been seen in the field. Verified on .173 (RTX 4090, driver 610.88): HEVC and AV1 both decode on the native Vulkan rung at 60 fps against an NVENC host; unit tests pin the clamp (lowers, only lowers, mutates the driver-visible block in place).	2026-08-12 18:46:57 +02:00
enricobuehler	5f55b820bc	Merge pull request 'Edition-2024 follow-up: the three gates only the PR's own CI could reach' (#180) from worktree-edition-2024 into main	2026-08-12 16:34:13 +00:00
enricobuehler	57703fe31c	Merge remote-tracking branch 'origin/main' into worktree-edition-2024	2026-08-12 18:30:50 +02:00
enricobuehler	90a3304c2b	Merge pull request 'The Windows host no longer blocks system sleep while idle' (#179) from worktree-win-sleep-blockers into main ... Reviewed-on: #179	2026-08-12 16:30:11 +00:00
enricobuehler	017867f211	fix(ci): the gates the PR run reaches and the boxes could not ... - adl_emul.rs adl_malloc: panic-free (a reachable expect in an extern fn is an abort — gate B; the Err arm is unreachable, ADL treats null as failure) - punktfunk-host main.rs: reword the carve-out comments so gate C's textual count stays at its baseline (comments count) - clients/linux: forbid(unsafe_code) -> deny with two named allows — the SDL device-filter clear and the spawn test's HOME scoping are unsafe calls in edition 2024 (caught by the aarch64 leg, the only one with glib)	2026-08-12 17:44:15 +02:00
enricobuehler	ef0af3b558	docs(changelog): the Windows host no longer blocks system sleep while idle	2026-08-12 17:41:08 +02:00
enricobuehler	535e95c4c0	fix(punktfunk-host): idle-stop the virtual-mic stream so a Windows host can sleep ... The mic pump's WASAPI backend rendered silence into the virtual mic's render endpoint (typically the Steam Streaming Microphone) for the whole host lifetime. A RUNNING stream makes the Windows audio stack hold a kernel power request ("An audio stream is currently in use", visible in powercfg /requests), so every idle Punktfunk host blocked system sleep forever — field-reported 2026-08-12 ("doesn't go to sleep anymore since installing punktfunk; powercfg shows the Steam Streaming Microphone"). Stop the render stream (IAudioClient::Stop — client stays initialized, the mic endpoint keeps existing) after 10 s of silence-only output at an unchanged queue length, and park the render thread on a condvar the producer notifies on the empty->non-empty edge, so the next mic frame resumes the stream within one device period — well under the jitter buffer's prime depth, so nothing audible changes. Keying the idle window on the queue LENGTH (not emptiness) also covers a sub-prime tail a vanished client left behind, while any fresh burst moves the length and resets the window instead of being dropped. During a session the box stays awake through the session's own DisplayWakeRequest (pf-frame), never through this silence. PUNKTFUNK_MIC_ALWAYS_ON=1 restores the old always-running stream in case a virtual audio driver misbehaves while its render side is paused.	2026-08-12 17:39:22 +02:00
enricobuehler	b385f0a031	Merge pull request 'Rust edition 2024: the whole tree, with the env-mutation class made visible (WP20)' (#177) from worktree-edition-2024 into main ... Reviewed-on: #177	2026-08-12 15:38:22 +00:00
enricobuehler	7528fd48a9	Merge pull request 'A stats tier picked between streams reached nothing until the app was restarted' (#178) from worktree-console-stats-tier-relatch into main ... Reviewed-on: #178	2026-08-12 15:38:03 +00:00
enricobuehler	c68e0be688	Merge remote-tracking branch 'origin/main' into worktree-edition-2024	2026-08-12 17:27:27 +02:00
enricobuehler	71c1970b93	fix(client/console): a stats tier picked between streams reached nothing until a restart ... Field report: "no matter what I select the stats overlay is stuck showing as detailed" on the Deck, cured by restarting the client app. The console (Gaming Mode, and therefore Decky) builds its window and its run loop ONCE and streams every session through them, and the loop took its stats tier from the settings snapshot read at process start. Its own settings screen writes the chosen tier to the file and redraws its row, so the choice looked taken while every stream kept the tier the process happened to start on — Detailed for anyone who had been on Detailed. Only a restart re-read it. The desktop shells were never affected: they spawn a session process per stream, which resolves settings for itself. The tier now rides `SessionParams` per launch, so browse mode adopts what THIS launch resolved and the start-of-process value only seeds the loop until the first stream. Two things fall out of resolving per launch rather than per process: a profile bound to a host can finally move the tier in console mode (part of the documented P4 gap), and the adoption sits in the `Start` arm rather than `StreamState::new`, so the codec-fallback retry can't snap the overlay back and undo an in-stream cycle. The `--stats` rule (a floor that lifts Off to Normal and demotes nothing) was written out three times and is now one tested helper. The rest of the console's latched presentation tier — touch and mouse model, shortcut inhibit, match-window, render scale — is unchanged and still needs the models rebuilt per launch. Gate: clippy --all-targets -D warnings, plain build, and tests for pf-client-core, pf-presenter and punktfunk-client-session, all green in pf-lxcheck2 (linux/amd64); clippy proven non-vacuous by touching the four edited files. cargo fmt --all --check clean.	2026-08-12 17:26:33 +02:00
enricobuehler	f373dffb5e	chore: migrate the main workspace and pf-vkhdr-layer to edition 2024 (WP20) ... The safety half of the rust-safety programme's §8.4: `std::env::set_var`/`remove_var` are `unsafe fn` in edition 2024, converting the class of bug the programme found the hard way (the 972af299 environ data race lived in a file with ZERO occurrences of the word `unsafe`) from invisible to counted and compiler-enforced. Manifests: [workspace.package] edition 2021→2024, rust-version 1.82→1.85 (the pinned toolchain is 1.96.0, so no toolchain bump — only the declared floor rises); the 13 crates pinning `edition = "2021"` literally now inherit it (Trap 1: the root bump alone reaches only `edition.workspace = true` crates and would have left pf-encode/pf-capture/pf-inject et al. on 2021 while reading as complete); pf-driver-proto's stale rust-version 1.82 pin now inherits; pf-vkhdr-layer (a separate workspace, inherits nothing) bumped to 2024. The four vendored crates (fec-rs, cros-codecs, usbip-sim, the patched ndk) stay on 2021 deliberately — upstream code stays pristine. The excluded usbip-poc standalone PoC is untouched. Mechanical, done textually across ALL cfg branches so no platform's half is left behind (Trap 3 — 44% of the host's unsafe is Windows-only and a one-platform `cargo fix` misses it): 148 `#[no_mangle]` → `#[unsafe(no_mangle)]` (83 in abi.rs); 12 bare extern blocks → `unsafe extern`; `gen` is a reserved keyword, so pf-vdisplay's generation stamps (registry.rs, windows/manager.rs) and the WinUI shell's animation counters rename gen → generation (internal identifiers only, no serde/wire surface); two match-ergonomics patterns take the compiler's suggested reference form. env mutation: every `set_var`/`remove_var` site (20 files) now sits in an `unsafe` block whose SAFETY comment states the real serialization argument (pf-vdisplay's ENV_LOCK, CONFIG_DIR_TEST_LOCK, ART_ROOTS_LOCK, vkdecode's gpu_lock, the `--test-threads=1` contracts of the hardware spikes, or single-threaded startup). Two genuine hazards surfaced en route — exactly the WP3b-class finds this migration exists to make visible — and are fixed here: - windows/service.rs spawned the network-profile warner thread BEFORE `load_host_env()`, so a child-spawning thread (child spawn snapshots the env block) was live while `set_var` ran in a loop; the load now precedes the spawn. - pf-console-ui's `fake_home()` re-set HOME outside its OnceLock on EVERY call, so two parallel tests could race the write; the set now happens exactly once inside `get_or_init`. cbindgen (Trap 2): 0.29.4 parses `#[unsafe(no_mangle)]` — verified empirically; the header regenerates byte-identical. The ci.yml drift check could never catch "failed to regenerate" (build.rs demotes a cbindgen failure to a warning and writes nothing, leaving the checked-in header untouched and the diff clean), so the step now first asserts the "punktfunk-core: wrote" line and the absence of "cbindgen failed" (sh -e safe: no `!` pipeline, no tee-masked exit). rustfmt: style_edition pinned to 2021 at the root — edition 2024 would otherwise flip the style edition and reformat ~370 untouched files inside this same commit, burying the migration diff. The drivers workspace pins its already-current 2024 style. Adopting the 2024 style tree-wide is its own future one-line-plus-reformat commit. Census: the primary metric moves UP BY DESIGN — 2435 → 2453 operations, unsafe blocks 1534 → 1577, and env_set_var is now a counted category (45 ops). The newly counted env sites are a truer number, not a regression; baseline snapshot saved as punktfunk-planning design/rust-safety-census-baseline-2026-08-12-edition-2024.txt. Gate C's env ratchet is now compiler-enforced (the hygiene-script header says so); the two shrunk file counts (nvenc_cuda 49→2 via the test helpers, shell/tests 2→1) are lowered in the same commit per the gate's own rule. Drop order (the semantic change most likely to bite this codebase): the migration lint `-W tail-expr-drop-order` reports zero findings on the macOS-visible halves of pf-encode / pf-zerocopy / pf-capture / pf-frame; the Linux and Windows halves run the same lint on the gate boxes. The four #[ignore]d alloc/drop-cycle tests on the hardware boxes remain owed, as before this change.	2026-08-12 16:12:35 +02:00
enricobuehler	28b6633058	Merge pull request 'feat(display): edid_lock policy axis — pin AMD connector EDID emulation while streaming' (#176) from worktree-edid-lock-toggle into main	2026-08-12 13:12:11 +00:00
enricobuehler	c58217e403	Merge pull request 'fix(client): stop the double-arm race re-freezing RFI-healed streams' (#174) from worktree-gate-double-arm-fix into main	2026-08-12 13:11:51 +00:00
enricobuehler	23f9b1130e	Merge pull request 'Black-stream fixes: CCD restore snapshot pruning, iOS silent-black recovery, devnode journal retention' (#175) from worktree-black-stream-fixes into main	2026-08-12 13:11:29 +00:00
enricobuehler	c2c71f0ac5	Merge pull request 'fix(vdisplay/driver,pf-frame): no punktfunk process holds REALTIME GPU priority by default' (#173) from worktree-rt-gpu-priority-defaults into main	2026-08-12 13:11:02 +00:00
enricobuehler	6a506a8fa9	fix(vdisplay/driver,pf-frame): no punktfunk process holds REALTIME GPU priority by default ... The RX 9070 XT field A/B (2026-08-11/12 logs) convicted BOTH of our REALTIME GPU-scheduling levers of generating the metronomic capture-stall class the stall program has chased for weeks — compose-silence holes of 150-800 ms in which ETW shows NO process presenting while the GPU stays responsive: - the vdisplay driver's IddCxSetRealtimeGPUPriority raise beat at ~1.75-1.78 s (PFVD_NO_RT_GPU=1 alone removed that metronome: ~0.35 stalls/s metronomic -> 10 sparse aperiodic over 3.9 min); - the host auto-gate's HIGH->REALTIME upgrade (pf-frame dxgi.rs, T2.3) beat at ~3.58 s in the AV1 sessions where it promoted (vram_pct=1, 12:59:26); pinning PUNKTFUNK_GPU_PRIORITY_CLASS=high removed that residual too (13:45 session: zero metronomic, stall rate at the clean-run baseline). Neither period matches any punktfunk clock: the full periodic-actor census (driver: event-paced drain + 16 ms E_PENDING wait, 33 ms cursor poll, 3 s watchdog reap; host: 250 ms descriptor poll, 5/50/100 ms probes + ~2 s scanline retarget, 2 s VRAM gate, 2 s exclusive re-assert, 3.33 s pinger, 1 s stats, ~1 Hz phase-lock, fps/2 LTR marks) has nothing in the 1.69-2.29 s band, and every host-side actor ran unchanged in the A/B that killed the fast metronome. The periodicity is emergent from holding an unreachable-priority queue against the WDDM scheduler on this AMD family (the period even differs by which of our processes holds REALTIME); it is not a punktfunk cadence being amplified, so there is nothing punktfunk-periodic to fix - the fix is to stop holding REALTIME by default, which is also canonical parity (no shipping IDD raises it, and HIGH was the class that delivered the original Sunshine-parity encode win). - Driver: PFVD_NO_RT_GPU (default-ON, opt-OUT) becomes the PFVD_RT_GPU ladder, default OFF on every vendor: unset = no raise (canonical IDD behavior); =thread = SetGPUThreadPriority(+7), a graduated in-band middle rung for field A/B (not default: unmeasured here, and the host measured the same call as "no help" for its own starvation case); anything else = the old REALTIME DDI. PFVD_NO_RT_GPU stays recognized and WINS over the opt-in, so the field boxes that carry it through the default-ON era keep meaning OFF. Both directions remain A/B-able without a rebuild (machine env + device restart). The CPU half of the original branch-2 hardening (MMCSS / TIME_CRITICAL) is untouched - it addressed the delivery holes that were actually observed. - Host: PUNKTFUNK_GPU_PRIORITY_CLASS default auto -> high. `auto` (the gated REALTIME upgrade) stays available as an explicit opt-in, `realtime` still pins; unrecognized values now land on the HIGH default instead of silently opting into the gate - a typo must not buy the hazard. The VRAM/HAGS gate machinery is unchanged for `auto`; it guards the NVENC-hang hazard but cannot see this one. - stall.rs: the no-OS-event METRONOMIC warning now carries rt_gpu_driver / rt_gpu_host fields (the machine-env state of both levers) and names clearing them as the FIRST cure, ahead of the display-hardware suspects - a field log self-answers the triage question this program just spent a week on. No console policy axis for the driver knob: the lever is default-safe now, the driver reads config at WUDFHost scope where machine env already matches the device-restart lifecycle, and a policy axis would need pf-driver-proto churn (or a device-key registry write) for an experimental lever that only exists to be A/B-ed. If the `thread` rung ever proves out as a default-worthy raise, that is the moment to revisit.	2026-08-12 13:57:20 +02:00
enricobuehler	712ee935d6	fix(win-display): a failed devnode re-enable must keep its crash-journal entry ... enable_instances cleared every requested id from the pnp-disabled-monitors journal unconditionally — a mid-life re-enable failure erased its own crash-recovery entry, so neither the running host nor the next start would ever retry, leaving the operator's monitor disabled (invisible to Windows and every display listing) until a manual Device Manager fix. Field 2026-08-12 (Android-client host running the pnp_disable_monitors axis): displays gone from the client after 2-3 sessions, only a full host restart bringing them back — the restart path only works while the journal still has the entry. Only successfully re-enabled ids clear now; failures stay journaled (and are logged with the consequence) so startup_recover retries them.	2026-08-12 13:30:04 +02:00
enricobuehler	a2aa0a5f97	fix(apple): never sit black AND silent while the video format is unseeded ... Both pumps (Stage2Pipeline + the stage-1 StreamPump) dropped every AU in a silent guard while 'format' was nil — the opening IDR's parameter sets never arrived or never parsed, and under the host's infinite GOP nothing re-delivers them unless the client asks. Field 2026-08-12 (iOS, H265): sessions decoding nothing, requesting nothing, host streaming perfectly — a black stream with zero recovery requests, randomly self-healing only when some later event produced a fresh IDR. While format is nil after the first received AU, the pumps now set awaitingIDR (routing through the existing 100 ms-throttled recovery.request()) and log the state once, so a lost/unparsed opening IDR converts to a normal recovery round-trip instead of a permanent silent black.	2026-08-12 13:16:58 +02:00
enricobuehler	d6b9862f1e	fix(win-display): prune unplugged targets from the CCD restore snapshot ... A monitor unplugged mid-session left the teardown replaying a snapshot whose paths reference an absent target — SetDisplayConfig rejects the WHOLE array with 0x57 ERROR_INVALID_PARAMETER, nothing restores, the desk stays dark, and the next session snapshots the wreckage (the poisoned-snapshot chain; field 2026-08-12: rc=0x57 across a mid-session unplug, then sessions flipping between black and working at random, incl. one that genuinely encoded black). The restore now prunes the snapshot against a live QDC_ALL_PATHS availability sweep before replaying: stale paths drop, the mode table is rebuilt with only the entries the survivors reference (an orphaned mode entry is itself an 0x57), and an empty survivor set skips the apply so the dark-desk backstop decides. Verbatim behavior is unchanged when everything is still attached or when the availability query itself fails.	2026-08-12 13:15:02 +02:00
enricobuehler	f4e39a442b	feat(display): edid_lock policy axis — pin AMD connector EDID emulation while streaming ... Productizes the adl-emul probe (the prior commit) as the display-policy axis its PR promised: the ADL FFI moves to pf_win_display::adl_emul (one surface shared by the probe tool and the host, so a reporter's probe and the console's toggle exercise byte-identical driver calls), and an EXPERIMENTAL edid_lock axis joins ddc_power_off/pnp_disable_monitors — orthogonal to presets, off by default. At the first Exclusive isolate the host pins each occupied AMD connector's live EDID + ADL_EMUL_MODE_ALWAYS (the software HPD dummy) BEFORE the physicals deactivate; last-member teardown unlocks. Pinned emulation outlives the process, so a crash journal (edid-lock-active.json) unlocks on the next host start, mirroring the pnp_disable_monitors recovery. Inert without an AMD driver. The console shows the toggle ONLY when the GPU inventory lists an AMD adapter — the lever exists nowhere else, and a toggle that can never act is the 'saved and then did nothing' trap the enforced-axes list exists to prevent.	2026-08-12 08:47:42 +02:00
enricobuehler	a0577cb86e	feat(tools/display-disturb): adl-emul — AMD connector-emulation probe (software HPD dummy) ... The standby-sink stall program's §3 dead-end list marked ADL EmulationMode 'likely Pro-gated' on field hearsay, with 'probe once, log rc' as the owed falsification — never run. Three RX 9070 XT field cases later (ASUS VG32VQ1B/DP, Odyssey G60SD/DP, LG UltraGear 32GS95UE/HDMI), this is that probe, shippable to reporters: read-only caps/board-layout/connection-state walk by default, --lock pins the live EDID + ADL_EMUL_MODE_ALWAYS on occupied connectors (the software HPD-holding dummy), --unlock restores. Every call prints the bench's epoch_ms correlation line with the decoded ADL rc — ADL_ERR_NOT_SUPPORTED(-8) vs ADL_OK on consumer Adrenalin is the Pro-gating answer, and a --lock run during a stream with the sink asleep is the direct A/B for the metronomic stall class. atiadlxx.dll is bound dynamically (absent = clean exit 2), structs mirror adl_structures.h verbatim, and the probe touches only connectors the board-layout walk enumerated. Gates: check/clippy -D warnings (msvc cross-target) + fmt clean; native stub unaffected.	2026-08-12 08:16:33 +02:00
enricobuehler	2a62fe7857	fix(client): stop the double-arm race re-freezing RFI-healed streams ... Every unrecoverable loss armed the client's freeze gate twice: instantly at frame-index-gap detection (which fires the RFI), and ~120 ms later when the reassembler ages the lost frame into frames_dropped and poll() re-armed unconditionally. An LTR-RFI recovery anchor lands in ~60 ms — between the two signals — so the stale climb re-froze a bit-exact-healed stream, the host swallowed the re-ask as an RFI echo, and the picture stayed frozen until the overdue backstop extracted a full IDR: the field 'H265 freezes on every loss, AV1 fine' signature on AMD hosts (AMF is the only LTR-RFI backend; the slower IDR path usually lands after the climb and dodged the race). The gap-arm now pre-credits the expected climb (ReanchorGate::arm_expecting_drops; credit expires after DROP_CREDIT_WINDOW so a straggler-filled gap can't mask a later real loss), and poll() consumes credited climbs instead of re-arming. Plumbed through every embedder: pf-client-core's session pump, Android's sync/async loops (note_frame_index now returns the gap width), and the Swift client via new ABI exports punktfunk_connection_note_frame_index_ex + punktfunk_reanchor_gate_arm_expecting_drops (additive; the bool ABI stays).	2026-08-12 08:11:35 +02:00
enricobuehler	66ba61b12c	Merge pull request 'Safety round 2: ASAN+LSAN over the C ABI boundary, two soundness fixes, and WP4's AvFrame RAII' (#172) from worktree-safety-round-2 into main ... Reviewed-on: #172	2026-08-12 05:57:16 +00:00
enricobuehler	5002849737	feat(pf-encode): WP4 — AvFrame/AvSwsContext RAII across all three libav backends ... Two newtypes beside AvBuffer/AvFilterGraph (same house shape: alloc/from_raw rejects the allocator's null once, as_ptr lends, Drop frees, no Clone; NonNull inside so the Options get a niche). 8 av_frame_alloc + 3 sws_getContext sites converted; all 22 hand-placed av_frame_free and 5 sws_freeContext calls are gone, and the three hand-written Drop impls (CpuInner, SystemInner, NvencEncoder) with them. The live defect this closes: ZeroCopyInner::submit (ffmpeg_win) leaked the frame AND one pooled hwframe surface on each of three ? exits between the pool pull and the send — under a SAFETY comment asserting no leak — and with POOL=8, eight such failures starved the pool and wedged the encoder with no error naming the cause. Every exit now returns the surface. Drop-order care (the hidden cost the survey flagged): NvencEncoder's sws_csc moved to field #1 (its hand-Drop freed it before all fields; this path runs on every stall-watchdog recovery via *self = fresh); CpuInner's nv12/sws declaration order flipped to match its hand-Drop; SystemInner's already agreed. Pinned by FIELD ORDER comments, not offset_of asserts — the survey's assert suggestion is the wrong tool: offset_of measures repr(Rust) memory layout, which the compiler may reorder independently of the declaration order that drop order actually follows. The dmabuf path keeps its early descriptor release via an explicit drop() at the exact point the hand-written free sat. Gates: .25 clippy -D warnings + tests green (nvenc,vulkan-encode,pyrowave); .133 check --all-targets + clippy --release -D warnings + 80 tests green (nvenc,amf-qsv,qsv; test step needs ffmpeg\bin on Path — 0xC0000135 otherwise). Owed on hardware: the #[ignore]d alloc/drop cycles on .136/.116/.173/.47 and the pool-exhaustion assertion (9th submit succeeds after 8 forced failures).	2026-08-12 00:31:14 +02:00
enricobuehler	9a59504ba4	fix(punktfunk-core): validate InputKind before forming &InputEvent in the C ABI ... abi.rs's two send-input entry points built &InputEvent straight out of caller memory with ev.as_ref(); InputKind is repr(u8) with 16 valid discriminants, so a C embedder writing ev->kind = 42 was immediate UB the moment the reference formed — in a file whose stated principle is that failures become status codes. New read_input_event() checks null, reads the tag as a raw byte, validates through the same InputKind::from_u8 the wire path uses, and only then forms the reference; bad tags return InvalidArg. Every other field is a plain integer, valid for any pattern. Test stages the event in MaybeUninit storage so the test itself never holds a reference to the invalid value. 380 lib tests + the C harness round-trip + clippy -D warnings green on .25; header regenerated.	2026-08-12 00:12:01 +02:00
enricobuehler	e8c306b9c0	fix(punktfunk-host): WP3c/3d — align the TOKEN_USER buffer, make EqualSid fail closed ... 3c: forming &TOKEN_USER (align 8) out of a bare [u8; 256] (align 1) was UB by the validity rule whenever the stack slot landed misaligned — shipped codegen happened to 8-align it, which is luck, not a contract. Fixed with a repr(align(8)) wrapper that keeps the buffer at 256 BYTES; the comment records why [u64; 32] is the wrong shape (len() would silently become 32 and misclassify every hand-run host as SYSTEM via ERROR_INSUFFICIENT_BUFFER, invisibly to a SYSTEM-side test). Length arg now size_of_val. 3d: EqualSid().is_ok() read BOTH 'SIDs differ' and 'EqualSid failed' as Err, so a genuine failure yielded 'not SYSTEM' — the fail-OPEN direction, contradicting the documented fail-closed contract. Now split three ways on the last-error code, with SetLastError(0) cleared first so a stale value cannot misclassify. Gate: cargo check -p punktfunk-host + cargo clippy --release -D warnings both green on .133 (real MSVC, fresh extraction, sentinel-verified).	2026-08-12 00:12:00 +02:00