888 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	69609945a3	feat(clients): host/network split in every stats HUD (stats phase 2, client side) ... Consumes the 0xCF host-timing plane (449a67c) on all four GUI clients: each keeps a bounded pending ring of receipt samples keyed by pts, matches the host's per-AU capture→sent reports against it, and the HUD equation becomes = host 3.1 + network 6.7 + decode 2.1 + display 2.3 falling back to the combined `= host+network …` term whenever no timing matched the window (old host / datagram loss) — same total, one split fewer, never a misleading zero. Apple additionally gains the split as the only equation line under the stage-1 fallback presenter (receipt is presenter-independent), a `nextHostTiming` wrapper with its own plane lock, and a unit-tested `HostNetworkSplitter`; Android extends the JNI stats array 16→18 doubles (0–15 unchanged); Windows/Linux thread the split through `Stats` into the HUD and the headless/debug logs. Docs updated: design/stats-unification.md Phase 2 → implemented (wire format, fallback semantics), and the docs-site matrix's Sunshine "Host processing latency" row is now a direct match (ours includes the paced send; avg vs p50). Verified here: linux client clippy -D warnings green on the live tree, windows stub check + hand-verified diff, android cargo-ndk arm64 check green, apple loopback test extended (needs the rebuilt xcframework + swift test on the mac). On-glass: pending on all platforms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:31:49 +00:00
enricobuehler	8470419433	feat(decky): pinned-games library + self-update robustness; fix gamepad tab-nav ... Decky client batch: - Pinned games / library picker: per-host game grid (GamePickerModal), pin/unpin, one-tap streams surfaced on the Hosts tab and QAM (usePins/streamPin/resolvePinHost, new src/library.tsx). - Self-update + client-update plumbing (main.py check_update, hooks.ts applyUpdate) with a CA-bundle-resolving SSL context and per-channel manifest polling; steam.ts / punktfunkrun.sh launch tweaks. - scripts/test-backend.py harness for the backend RPCs; README refresh. Fix: the fullscreen page wrapped <Tabs> in an overflow-visible box, so Valve's L1/R1 tab slide + autoFocusContents scrollIntoView panned #GamepadUI itself — the whole Steam UI slid left until a tab was clicked. Clip the Tabs wrapper (overflow:hidden), matching Valve's own Tabs containers. (On-glass verification pending — Deck offline this session.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 21:25:07 +00:00
enricobuehler	449a67ce8d	feat(protocol): per-AU host-timing plane (0xCF) — split host+network latency (stats phase 2) ... The unified-stats equation's host+network stage was one opaque number because the wire carried nothing but pts_ns. Now the host reports its own share per frame: when the client's Hello sets VIDEO_CAP_HOST_TIMING (0x08), the send thread emits a 13-byte 0xCF datagram — [tag][pts_ns u64][host_us u32] — right after the AU's last packet leaves the socket, so host_us = capture→fully-sent (capture read/convert, encode, FEC+seal, paced send) against the same anchor the wire pts carries. Clients correlate by pts_ns and derive network = (received + clock_offset − pts) − host_us; the two terms tile per frame by construction. Back-compat is free in all four combinations: old clients ignore unknown datagram tags, old hosts ignore unknown cap bits (client keeps the combined stage). The hardened data-plane format is untouched — this rides the established QUIC side-plane pattern (0xC8…0xCE). NativeClient ORs the bit in unconditionally and exposes next_host_timing(); the C ABI gains PunktfunkHostTiming + punktfunk_connection_next_host_timing (additive). The synthetic host emits 0xCF too, so pure-loopback protocol tests cover the plane. The probe reports the split (host_p50/p95_us · net_p50/p95_us) and is our direct analogue of Sunshine's "host processing latency" — ours additionally includes the paced send. Validated on loopback (synthetic host + probe, debug build): 240/240 AUs matched, host_p50 6.5 ms + net_p50 6.4 ms ≈ capture→received p50 13.0 ms. Core suite + new 0xCF roundtrip/truncation test green; host+core+probe clippy clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:22:12 +00:00
enricobuehler	09a5957c6d	feat(clients): unified stats vocabulary across every client + Moonlight comparison docs ... One stat model everywhere (design/stats-unification.md): four measurement points (capture/received/decoded/displayed), three stages that tile the interval exactly, and a HUD that shows the addition explicitly — end-to-end 14.2 ms p50 · 19.8 p95 · capture→on-glass = host+network 9.8 + decode 2.1 + display 2.3 replacing each client's ad-hoc mix of overlapping absolutes (the Apple HUD's three arrow lines that looked sequential but weren't), mean-vs-median decode times (Windows/Linux), missing same-host-clock flags (Windows/Linux), and three different names for the same capture→received measurement (probe's "reassembled", Apple/Android's "client", Windows/Linux's post-decode "lat"). Per client: Apple threads receivedNs through the VT decode via the frame refcon bit pattern so the decode stage exists at all (stage-1 fallback honestly degrades to a capture→received headline); Windows carries FrameTimes through the existing frame channel to the render thread and adds e2e p50/p95 post-Present; Linux stamps received at AU pop and rides decoded_ns on DecodedFrame to the paintable-set site; Android pairs receipt stamps with MediaCodec output buffers via the codec's pts round-trip (JNI stats array 14→16 doubles, indexes 0-13 unchanged). fps now uniformly counts received AUs; lost/(received+lost) per window, hidden at zero. docs-site gains "Understanding the Stats Overlay": what each line means, why the equation only approximately sums (percentiles), and a line-by-line Moonlight/Sunshine matrix — including that Moonlight has no end-to-end number and its "network latency" is an ENet control RTT, so punktfunk's headline must not be compared against any single Moonlight line. Verified here: linux client + probe + core check/clippy/fmt green, android native cargo-ndk arm64 check green. Pending: Windows CI + on-glass, swift test on the mac, on-device Android. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:01:29 +00:00
enricobuehler	c7630ff5dc	fix(host/audio): mic pump — open handshake on Linux + rapid-death backoff ... Found by a live boot-order test (host started before the user session's PipeWire): PwMicSource::open returned Ok before the daemon connection was attempted, so a PipeWire that wasn't running surfaced as an instantly-dead instance instead of an open failure — and the pump churned open→die→reopen at heartbeat rate (1 Hz "virtual mic ready" log spam) instead of backing off. - PwMicSource::open now has a bring-up handshake (mirrors the Windows backend): ready only after connect + stream connect succeed, so a down daemon is an open ERROR and the pump's backoff engages. - The pump triages deaths: an instance that lived >= 5 s (a one-off daemon restart) reopens immediately with the backoff reset; one that died right after opening counts as a failed open and backs off (2 s → 60 s cap). New pump test rapid_death_backs_off. Re-validated live: host started with PipeWire stopped → throttled "unavailable" warns, zero churn; daemon started → mic node up on the next retry; exactly one pump + one loop thread (no leak). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 20:58:06 +00:00
enricobuehler	2c7ded0f3c	fix(host/audio): rebuild mic passthrough — eager, self-healing virtual mic on both hosts ... Mic passthrough silently died on real hosts. Root causes, all fixed: - No liveness anywhere: a PipeWire restart (Linux) or any WASAPI device error (Windows) killed the backend worker; push() fed the dead queue for the rest of the host's life. VirtualMic now has a liveness contract (push -> bool, alive(), discard()) and the new shared audio::MicPump reopens with backoff, probing on an idle heartbeat so the mic heals BETWEEN sessions too. Validated live: systemctl restart pipewire -> node back in ~0.5 s, tone flows through the reopened backend. - Lazy creation: the mic device didn't exist until the first 0xCB frame, but games bind their capture device at launch and never re-follow. The pump opens eagerly at host start (node exists with zero clients, elected default source). - Windows headless dead-end: with VB-CABLE as the ONLY render endpoint (exactly what the installer ships), the anti-echo guard rejected the cable as the default render endpoint -> mic permanently dead. The new wiring_plan (pure, unit-tested on every platform) assigns the mic its endpoint FIRST (cable reserved for the mic), points the loopback at a DIFFERENT endpoint, and the capture side now yields (explicit endpoint or honest error) instead of the mic dying. Plan recomputed per (re)open — endpoints churn at boot/logon/driver installs. - Stale bursts: buffered audio from a previous session played into a newly-attached recorder (observed live). Timestamped chunks + a consumer-gap check in the process callback age everything past 1 s. The Linux node mechanism stays the stream-based Audio/Source with RT_PROCESS + priority.session: the canonical null-audio-sink adapter recipe was tested on this box (PipeWire 1.6.2) and never gets a clock (QUANT 0 -> pure silence), and WirePlumber reroutes a feeder targeting it to the default sink (echo). Decision documented in the module docs. Live-validated on this box (synthetic host + probe --mic-test, pw-record): eager node, both attach orderings, PipeWire-restart self-heal, post-session silence. Windows side compile/CI + on-glass validation pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 20:41:19 +00:00
enricobuehler	b7048446c4	fix(windows-host): IDD-push compose kick — idle desktop no longer fails the attach gate ... DWM presents a display only when something dirties it. On an idle desktop a perfectly healthy session sat at E_PENDING: the driver attached but no first frame ever landed, so wait_for_attach's 4 s gate failed the open (and a mid-session ring recreate hit the same stall against the 3 s recover-or-drop). A real client escaped only because its own input soon dirtied the desktop; a headless probe / input-less connect never did. kick_dwm_compose() injects two net-zero 1 px relative mouse moves via SendInput — pf-vdisplay has no hardware-cursor plane, so a cursor move is composited into the frame, a guaranteed real present onto the IDD swap-chain (the mechanism --input-test always relied on; the pointer ends where it started). Wired into wait_for_attach (first kick at 600 ms, then every 800 ms) and, rate-limited, into the GB1 recovery window. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 19:24:57 +00:00
enricobuehler	3039626b87	design(host): add vrr design doc	2026-07-03 19:22:19 +00:00
enricobuehler	3f33ed30ae	fix(windows-host): claim the vdisplay single-instance guard eagerly at serve startup ... On-glass the lazy (first-session) claim let a second host started while the freshly-restarted service sat idle win the mutex and ADD a monitor on the real driver — priority backwards. The claim is now a process-global, retryable slot (a failed claim is not memoized, so it heals once the other instance exits), and `serve` claims it before any client can connect; ensure_device keeps the lazy claim for standalone punktfunk1-host runs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 18:57:47 +00:00
enricobuehler	7e31020c1c	fix(windows-host): second-host guard — classify ACCESS_DENIED on the instance mutex as in-use ... On-glass the SCM service creates Global\punktfunk-vdisplay-manager as SYSTEM, so a second elevated-admin host's CreateMutexW fails ACCESS_DENIED (the implicit open is checked against the SYSTEM DACL) before the ALREADY_EXISTS branch can fire — right refusal, wrong message. Map it to the same loud "another instance is live" error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 18:53:54 +00:00
enricobuehler	fe54aff658	fix(windows-host): cross-plane IDD serialization, linger-expiry race, second-host guard ... Batch C of the audit's medium tier (M7+M8+M9): - M7: GameStream sessions now run the same begin_idd_setup dance as punktfunk/1 before creating the shared monitor. A GS connect could previously ADD/reconfigure the monitor while a native session was mid-build (and vice versa), and its sealed-channel delivery replaced the native ring (newest-wins) — each plane could freeze the other. GS has no cooperative stop plumbing, so it registers a flag nobody reads: a later session signals it, waits the 3 s grace, then force-preempts — the intended handover. - M8: the linger-expiry teardown now runs UNDER the state lock. Running it outside let a concurrent acquire see Idle and ADD+isolate while the old monitor's pinger-join / CCD-restore / REMOVE were still in flight — a failed or de-isolated session exactly at the expiry boundary. A racing acquire now waits the few teardown seconds instead. Lock order stays state → device everywhere; the pinger takes only the device lock. - M9: a named mutex (Global\punktfunk-vdisplay-manager) makes a SECOND host process fail its vdisplay open loudly instead of firing a startup CLEAR_ALL that razes the live host's monitors mid-stream (the admin footgun the shared watchdog then masked). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:28:22 +00:00
enricobuehler	b46aa15afb	fix(windows-drivers): pf-vdisplay robustness — AdapterInitStatus gate, pooled-device TDR check, MMCSS-optional worker ... Batch B of the audit's medium tier (M4+M5+M6): - M4: adapter_init_finished now reads AdapterInitStatus (was ignored) and only stashes the adapter on NT_SUCCESS, per the MS sample. A failed async init previously produced a HUSK adapter: monitors created on it arrive but the OS never assigns a swap-chain — every session black-screens with no visible cause (the exact signature live fault-injection produced after a WUDFHost kill). Unset adapter → ADD fails cleanly (host-retryable) and a re-entrant D0 retries the init; the status is now in the debug log. - M5: pooled_device checks GetDeviceRemovedReason on a cache hit — a TDR'd device was returned for its LUID forever (SetDevice fail-loop, black virtual display until device teardown); now it falls through to a fresh create. - M6: an AvSetMmThreadCharacteristicsW failure no longer aborts the worker before draining (which stalled the monitor and leaked the WDF swap-chain object) — continue unprioritized like the MS sample; revert only if MMCSS actually engaged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:20:48 +00:00
enricobuehler	058630f542	feat(decky): visible branded Steam shortcut, one-tap client updates, fullscreen-page polish ... - The "Punktfunk" shortcut is no longer hidden: it now ships committed artwork (grid/wide/hero/logo/icon, generated by scripts/gen-steam-art.py — a pure-stdlib SDF renderer drawing the lens mark + a monoline "punktfunk" wordmark) applied via SetCustomArtworkForApp / SetShortcutIcon. Existing installs are unhidden and re-arted once per ART_VERSION; relaunching the library entry streams to the last host. - Updates cover the flatpak CLIENT too: check_update compares the user-scope installed commit against its remote, applyUpdate runs `flatpak update --user` first (awaited) and the plugin reinstall — which reloads the panel — last; docs spell out the sudo-less --user update ("sudo flatpak update" silently skips per-user installs). - Fullscreen page: DialogButton stretches to 100% width in the gamepad UI, so the Stream/Pair/Refresh/… actions filled whole rows — sized to content + right-aligned now; the header drops its Update button (About tab + QAM banner keep the flow) and the back button gets a real 40px hit target. - Settings: the disable-Steam-Input note also shows for Automatic — on a Deck that now forwards the built-in controller as a Steam Deck pad (paddles/trackpads/gyro), which needs Steam Input off for the shortcut. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:16:40 +00:00
enricobuehler	e9c1f4083a	fix(client-linux): Deck Gaming Mode — auto pad type, real chrome-less fullscreen, leave-to-Gaming-Mode, colour bisect ... - "Automatic" gamepad type resolves to the virtual Steam Deck pad on Deck hardware (env SteamDeck / DMI Jupiter|Galileo): the built-in 28DE:1205 identity is invisible at Hello time — the Valve HIDAPI drivers run in-session only and Steam Input shadows the pad with its virtual X360 — so auto always fell through to Xbox 360. "steamdeck" is now also selectable in Settings. - Chrome-less launches flatten the window CSS (border-radius/box-shadow) and fullscreen at startup: gamescope never ACKs the xdg fullscreen state, so adwaita kept the floating-CSD rounded corners + shadow visible over the stream. - Gaming-Mode --connect launches quit on session end, so Steam ends the "game" and the Deck returns to Gaming Mode — previously the app popped to its own hosts page, stranding the user fullscreen and making the escape chord read as broken. - The capture hint is controller-aware; the chromeless hint teaches the hold-chord ("hold L1+R1+Start+Select to leave") and a quick chord press re-flashes it. - Colour bisect for the reported off-colours on the VAAPI dmabuf path: graphics offload defaults OFF under gamescope (a subsurface hands the NV12 CSC to the compositor), PUNKTFUNK_OFFLOAD=1|0 overrides, and each colour-signaling change logs whether GDK accepted the BT.709-narrow color state (fallback = GDK's BT.601 dmabuf default). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:16:26 +00:00
enricobuehler	20f0d2802f	feat(client/android): Snapdragon latency tuning — ADPF pipeline hints, game mode, max-clock decode ... Three levers to lower and steady decode latency on Snapdragon (Adreno) devices: - ADPF (Adaptive Performance Framework): a new dlsym-resolved hint session (native/src/adpf.rs; API-33+, resolved at runtime so there's no build-time link dependency and libpunktfunk_android.so still loads on API 31/32) tells the CPU governor the video pipeline runs a per-frame real-time workload, so it keeps those threads on fast cores at high clocks. It now covers all three latency-critical threads — the pf-decode feed/drain/present loop, the core data-plane pump (UDP receive + FEC reassembly), and the audio thread — via a new generic hot-thread registry on NativeClient (register_hot_thread / hot_thread_ids; the pump self-registers). The session is built lazily on the first presented frame, since ADPF createSession rejects a set containing any not-yet-live tid. - operating-rate -> Short.MAX ("as fast as possible"): pushes the Qualcomm decoder to run each frame at max clocks instead of merely sustaining the display rate at a power-saving clock that adds per-frame decode latency. - appCategory="game": makes the app eligible for OEM Game Mode / Game Dashboard performance profiles. The core registry is cross-platform (gettid on Linux/Android, a no-op elsewhere) — no Android-specific pollution of the shared core. Host workspace + 64 core tests green; Android arm64-v8a + x86_64 (platform 31) build + clippy clean. On-device Snapdragon validation pending. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 17:16:11 +00:00
enricobuehler	6f8fb15c9b	fix(windows-host): self-heal the hostless-zombie pf-vdisplay device (adapter cycle + re-probe) ... Fault-injection on-glass showed a killed/crashed WUDFHost leaves the devnode "started" but HOSTLESS: PnP Status OK, no WUDFHost process, zero device- interface instances — is_available() then fails every future session at the vdisplay::open gate (and a reopen inside VdisplayDriver::open finds nothing), until something cycles the device. Port reset-pf-vdisplay.ps1's adapter disable→enable step in-process (restart_vdisplay_device): the open gate now uses ensure_available() (cycle once + bounded re-probe; a genuinely uninstalled driver — no adapter devnode — still fails fast), and VdisplayDriver::open retries open_device over a short arrival window after a cycle, covering the manager's reopen path too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:12:43 +00:00
enricobuehler	89455032a0	fix(windows-host): IDD-push resilience — driver-death recovery, reopenable control device, full interface discovery ... Batch A of the audit's medium tier (M1+M2+M3): - M1 driver-death detection: a dead WUDFHost stops publishing, which at the ring is indistinguishable from an idle desktop — SDR sessions streamed a frozen frame forever (next_frame's 20 s bail is unreachable once anything presented). The ChannelBroker's process handle now doubles as a liveness probe (SYNCHRONIZE at OpenProcess); while no fresh frame arrives, try_consume polls it (rate-limited) and fails the capturer, landing in the session's bounded in-place rebuild. - M2 reopenable control device: the manager's OnceLock-cached handle is now a retire/reopen DeviceSlot — a gone-classified IOCTL failure (driver upgrade / WUDFHost restart; pinger, create, or REMOVE) retires the handle and the next use reopens + re-handshakes. Retired handles are deliberately kept alive forever: bare-HANDLE holders (pinger, ChannelBroker) rely on never-closed, and a retired handle only fails IOCTLs. CLEAR_ALL runs on the FIRST open only (a reopen races live-ish sessions); acquire retries the monitor create once after a reopen. The JOIN path now probes the active monitor's WUDFHost pid and preempts a DEAD monitor instead of handing the rebuilding session its stale target — without this the whole recovery chain starved to the rebuild budget. - M3 interface discovery: enumerate ALL interface instances with an SPINT_ACTIVE filter (a Code-10 devnode at index 0 no longer shadows the live interface), HDEVINFO behind RAII (error paths leaked one per probe), the raw device handle wrapped before GET_INFO (leaked on handshake failure), and the detail-sizing result guarded before the cbSize write. - pf-driver-proto: SetFrameChannelRequest doc now states the real adopt-on-success contract (the old wording invited a driver-side close-on-error — a cross-process double-close against the host's reap). - install: pf_vdisplay_present() passes /connected so a phantom devnode can't suppress creating a live ROOT node. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 17:04:19 +00:00
enricobuehler	0da9d8ec10	fix(windows): IDD-push audit highs — keyed-mutex timeout, two per-frame leaks, IDD_PUSH knob, pooled-device threading ... Five verified findings from the IDD-push/pf-vdisplay deep audit: - Keyed-mutex acquire (BOTH endpoints): AcquireSync returns WAIT_TIMEOUT (0x102) / WAIT_ABANDONED (0x80) as SUCCESS-severity HRESULTs, which the windows-rs Result wrapper erases — a busy slot read as "acquired", so driver and host could race the same ring texture (torn frames) and the designed busy-skip backpressure was dead code. Both sides now classify the raw vtable HRESULT; WAIT_ABANDONED counts as acquired (ownership transfers — refusing it would wedge the slot forever). - Host SDR hot path leaked one ID3D11VideoProcessorInputView per converted frame: the D3D11_VIDEO_PROCESSOR_STREAM ManuallyDrop field suppressed the release after VideoProcessorBlt. Released by hand now, success or not. - Driver leaked IddCx's per-acquire surface reference (from_raw_borrowed on a TRANSFERRED reference — the MS sample Attach/Reset's it): the swap-chain surface set survived swap-chain destruction, the likely true root cause of the ~50 MB-per-reconnect VRAM loss that device pooling only mitigated. Now adopted via from_raw (publisher or not) and dropped pre-Finished. - PUNKTFUNK_IDD_PUSH removed: capture is unconditionally IDD-push, but the vdisplay manager still gated the lingering-monitor preempt (and render pin) on the knob, whose default was OFF — dev/CLI runs reused a lingering monitor whose IddCx swap-chain is dead (black reconnect). The preempt and the render-GPU pin are now unconditional; host.env comments no longer promise the removed DDA/WGC fallback. - Driver D3D device: dropped D3D11_CREATE_DEVICE_SINGLETHREADED (unsound since DEVICE_POOL shares one device across processors) and the pooled immediate context is now SetMultithreadProtected — two concurrent monitors' workers otherwise race an unlocked context (UB in the UMD). No wire-contract change (pf-driver-proto untouched); the driver fixes take effect on the next pf-vdisplay redeploy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 16:27:13 +00:00
enricobuehler	fbf3fea0c8	fix(packaging/windows): Inno [Code] comment brace-nesting trap broke ISCC ... The PublicFwParam doc comment contained a literal code-constant token; Inno's { } comments don't nest, so its closing brace ended the comment early and the trailing text parsed as code ("'BEGIN' expected", compile aborted). Reworded to avoid the literal braces + added a warning note. Verified: the [Code] section has no other nested-brace-in-comment traps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 15:27:27 +00:00
enricobuehler	c52ae119e1	fix: regenerate Cargo.lock for punktfunk-host's winresource build-dep ... The "Punktfunk Host" identity work added winresource to the host crate but didn't update the lock, so every --locked CI job failed to resolve. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 15:17:31 +00:00
enricobuehler	5d7aabe8f0	fix(scripts/windows): keep deploy-host.ps1 pure ASCII (em-dash -> hyphen) ... Two comment em-dashes I added tripped the installer-run ASCII guard (PS 5.1 mis-parses non-ASCII on non-UTF-8 locales). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 15:09:17 +00:00
enricobuehler	f204a89cef	perf(encode/windows): AMF quality=speed + bf=0; drop the useless poll spin ... On-box A/B on the .173 Ryzen 7000 iGPU (720p60, real composition via input injection — an idle virtual desktop composes ~1 fps and gives meaningless encode timings): the encode-time-first `quality=speed` preset + explicit `bf=0` cut host-side encode_us from ~36 ms to ~19.5 ms. The blocking-poll idea from the prior commit was WRONG and is reverted to a single non-blocking receive (default PUNKTFUNK_FFWIN_POLL_MS=0): libavcodec's hevc_amf holds ~2 frames before releasing the oldest (needs frame N+2 to flush N), so a spin between submits provably never yields the owed AU — verified with a 150 ms cap pegging at exactly 150 ms across every usage preset and pipeline depth. That ~2-frame buffer is inherent to the libavcodec wrapper, not host scheduling; the real latency lever is a direct AMF SDK encoder (the AMF analogue of the direct-NVENC path), tracked as the next AMD work item. The env knob is retained for a future VCN/driver where a bounded spin can help. Also measured and rejected: PUNKTFUNK_ZEROCOPY=1 on AMF is ~2x WORSE (68 ms vs 36 ms) — the D3D11 import path adds sync overhead beyond the readback it saves, so the system-memory default stays. GPU-priority elevation is already process-wide (dxgi.rs), so it covers the iGPU encode session with no change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 14:57:39 +00:00
enricobuehler	24fa018c70	chore(encode/windows): AMF forensics knobs — PUNKTFUNK_AMF_USAGE + PUNKTFUNK_FFWIN_POLL_MS ... The blocking poll landed but wait_us pegs at exactly the 2-frame-period cap: AMF holds the AU ~2 frame periods regardless of retrieval. Field knobs to bisect on-box (usage preset × poll cap) without rebuild cycles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 14:39:36 +00:00
enricobuehler	51a6ca7e02	fix(encode/windows): AMF latency — honor the loop's blocking-poll contract + preset polish ... The session loop's pipeline deferral was designed around direct NVENC, whose poll() BLOCKS in lock_bitstream; libavcodec's AMF wrapper is truly async (EAGAIN until the ASIC finishes), so a single non-blocking receive quantized AU retrieval to the submit cadence: +1–2 frame periods flat (~43 ms p50 at 720p60 on the Ryzen iGPU vs ~3.5 ms of actual encode). FfmpegWinEncoder now tracks in-flight frames and, while an AU is owed, spin-polls with short sleeps bounded to ~2 frame periods (an overloaded encoder degrades to next-tick pickup instead of stalling capture). Also: quality=speed (latency-first, iGPU-class VCN), explicit bf=0 (h264_amf defaults >0 on RDNA3+), AMF low-latency submission mode (FFmpeg ≥6.1, ignored on older). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 14:32:41 +00:00
enricobuehler	b9fde03f1e	feat(security): finish Windows firewall Public opt-in wiring + vuln-disclosure + doc cleanup ... Firewall (the service.rs core landed in efb1ba2): scope the web-console rule (TCP 47992) to Domain+Private by default with a `--allow-public-network` opt-in that deletes-then-re-adds the rule, and add the installer "Allow connections on Public networks" task (unchecked) forwarding the flag to `service install` and `web setup`. Default is now trusted-networks-only; Public is explicit. Vulnerability disclosure: SECURITY.md (report to security@punktfunk.com, scope, SLAs, safe harbor), a Gitea issue-template contact link, a README security line, and a Reporting section on the docs Security page. Docs: the Security page now documents the Private/Domain firewall default (and how to fix a misclassified-Public network / opt in); removed internal design-doc and CLAUDE.md links from the user-facing docs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 14:08:17 +00:00
enricobuehler	efb1ba26d7	fix(windows): opt-in pad-driver file logs + size-capped service log rotation ... Two disk-write fixes: - pf-xusb/pf-dualsense no longer write C:\Users\Public\pf*-driver.log unconditionally — the file log is now opt-in (debug builds, or the PFXUSB_DEBUG_LOG / PFDS_DEBUG_LOG system env var), mirroring the audit-§4.4 fix pf-vdisplay already got: a release driver never writes the world-writable Public file (info-leak/DoS surface), and the per-report OUTPUT/SET_STATE hex dumps stop being a sustained per-rumble disk-write path during gameplay. OutputDebugStringA stays unconditional; the host's driver-silence WARN and the gamepad-driver-health failure-mode table now say the log is opt-in. - service.log/host.log get one-generation rotation: at each (re)open a file over 10 MB is renamed to .old, so a crash-restart loop or a RUST_LOG=debug left in host.env can't grow the append-forever logs without bound. Rotation runs only before an open (never under a live appender — host.log's handle lacks FILE_SHARE_DELETE, so a racing rename harmlessly fails). Windows CI compile/clippy pending (drivers workspace + host are not Linux-cross-checkable); rides along with the next pad-driver redeploy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 14:03:32 +00:00
enricobuehler	1320e3dc66	fix(scripts/windows): deploy-host.ps1 builds all-vendor when an FFmpeg tree exists ... The dev deploy built --features nvenc only, so a web-console GPU preference pointing at an AMD/Intel adapter made every session die at encoder open (NV_ENC_ERR_NO_ENCODE_DEVICE) — the exact "can't connect" just hit on the RTX box's Ryzen iGPU. The script now enables amf-qsv when FFMPEG_DIR (machine env, process env, or C:\Users\Public\ffmpeg) has a dev tree, and copies the FFmpeg runtime DLLs next to the exe after a successful build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 13:52:55 +00:00
enricobuehler	1be83575b6	feat(host/windows): "Punktfunk Host" identity in Task Manager (icon + version info) ... punktfunk-host.exe embedded no icon or version resources, so Task Manager and Explorer showed a bare lowercase exe name with a generic icon. build.rs now embeds the branded .ico + FileDescription "Punktfunk Host" / ProductName "Punktfunk" via winresource (same pattern as the Windows client and the tray; Linux packaging builds skip the block). The tray gets a matching "Punktfunk Tray" description, and the SCM display name moves off lowercase "punktfunk streaming host" to "Punktfunk Host" (applied idempotently by `service install` on upgrade). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 13:52:55 +00:00
enricobuehler	4d1d20f832	chore: untrack CLAUDE.md ... Local per-box assistant instructions (incl. internal environment detail) don't belong in the published tree; the file stays on disk, now gitignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 13:22:23 +00:00
enricobuehler	6e875fea44	fix(apple/ios): the ACTUAL type-checker bomb was pointerSection's footer ternary chain ... 4f3cd24 split the wrong expression — act's log masking hid the real line number. The unmasked retry pinpointed it: the pointerSection footer, a ten-segment string + chain with an isPad ternary nesting four more, evaluated inside the ViewBuilder. Moved the copy into a plain computed String built with += statements (linear to type-check); no text change. The two remaining 5-6 segment chains in Settings are compiled by the passing macOS slice, so they are proven cheap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 13:17:01 +00:00
enricobuehler	4f3cd24036	fix(apple/ios): split streamModeSection — the inline iOS branch blew the type-checker budget ... The Section's iOS content (resolution wheel + 3-way refresh rows + bitrate rows) as ONE ViewBuilder expression hit "the compiler is unable to type-check this expression in reasonable time" — failing exactly one build slice, the iOS archive, so swift test (macOS) and the tvOS/macOS archives never saw it and the 0.6.0 iOS TestFlight upload soft-failed. Extracted iosResolutionWheel / iosRefreshRows / bitrateRows; no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 13:06:48 +00:00
enricobuehler	af13f0b749	chore(release): 0.6.0 ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.6.0	2026-07-03 12:19:18 +00:00
enricobuehler	d285d4a0b2	fix(tray): live-probe the web console instead of sniffing the install layout ... The "Open web console" entry was gated on {exe dir}\web\web-run.cmd (Windows) / the punktfunk-web unit file (Linux) — which misses consoles run from a repo checkout (the RTX box, caught on-glass) and shows a dead entry while an installed console is stopped. The poller now probes https://127.0.0.1:<web port>/ each cycle (any HTTP response = up, transport failure = down) and the menu follows live on both platforms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:17:01 +00:00
enricobuehler	04f370999c	fix(web): pin the sidebar at viewport height ... Sticky h-dvh sidebar: long pages scroll the content, not the nav — the flex stretch was pushing the language switcher below the fold; overflow-y-auto keeps the nav usable on short viewports. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:09:52 +00:00
enricobuehler	2c937855b3	fix(packaging/windows): Windows 11 22H2 floor + tray install task + stale console-port fixes ... The OS floor is now enforced at install time (MinVersion=10.0.22621 with an explanatory [Messages] override): pf-vdisplay is built against IddCx 1.10, and on Windows 10 (incl. LTSC) / Win11 21H2 the device fails start with Code 10 STATUS_DEVICE_POWER_FAILURE (field-reported). Docs (site requirements/install/ windows-host pages + README) state the floor; new docs-site Security page. Installer also gains the trayicon task (punktfunk-tray.exe file + HKLM Run key, post-install launch as the signed-in user, upgrade taskkill + uninstall --quit/taskkill choreography before file deletion), and the wizard/cleanup text/port sweeps move off the stale :3000 web-console references to :47992 (cleanups sweep both for upgrades from old installs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:09:52 +00:00
enricobuehler	8005b11faf	feat(tray): system-tray status icon for the host (Windows + Linux) ... New crates/punktfunk-tray — a small per-user companion showing the host service state at a glance (running / stopped / starting / degraded / failed + the live session in the tooltip) with one-click actions: open web console, approve a pending pairing request, start/stop/restart, open logs. No more digging through logs to learn whether the service came back after a reboot or an update. Status is service-manager-FIRST (SCM / systemd user unit — a port squatter can never fake Running), then the new loopback-only unauthenticated GET /api/v1/local/summary (counts/booleans only; the mgmt token and cert.pem are SYSTEM/Admins-DACL'd on Windows, so a non-elevated tray cannot bearer-auth). Windows: windows_subsystem binary (a console exe in the Run key would flash a terminal at sign-in), Shell_NotifyIcon + hidden window, per-session single instance, TaskbarCreated re-add, --quit for the uninstaller; service actions elevate per click via ShellExecuteW "runas" onto the new `punktfunk-host service restart` (stop → wait Stopped → start). Linux: ksni/StatusNotifierItem over zbus, systemctl --user actions (no polkit), /etc/xdg/autostart entry whose --autostart self-gates to actual host users. Icons: scripts/gen-tray-icons.py (pure stdlib) renders the brand lens + status dot into committed .ico/hicolor assets; deb/rpm/arch ship binary+autostart+icons. Live-validated: Linux on the headless KDE session (SNI registration, state transitions, menu-driven start, dbusmenu layout); Windows on the RTX box (session-1 launch with no NIM_ADD failure, single instance, --quit, restart round-trip, summary loopback-200/LAN-401). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:09:35 +00:00
enricobuehler	01fcb01019	fix(encode/windows): resolve NVENC at runtime — AMD/Intel hosts no longer crash at start ... The nvenc build linked nvEncodeAPI64.dll's entry points at load time, so a --features nvenc binary hard-crashed on any box without the NVIDIA driver (AMD/Intel). Entry points now come from a runtime LoadLibrary table (encode/windows/nvenc.rs load_api); a missing DLL just falls through the encoder auto-detect to AMF/QSV/software. The generated import lib and all its plumbing (gen-nvenc-importlib.ps1, nvenc.def, PUNKTFUNK_NVENC_LIB_DIR, setup-build-env wiring) are gone. Live-validated on the RTX 4090 box (NVENC session, 7000+ frames). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:09:18 +00:00
enricobuehler	95a08e99c3	feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2) ... Frame ring (pf-vdisplay) and both gamepad SHM channels move off named Global\ objects (openable by any sibling LocalService) to UNNAMED sections/events whose handles the host DuplicateHandles into the driver's verified WUDFHost with least access — frame delivery over the SYSTEM+admins-only IOCTL_SET_FRAME_CHANNEL, pads over a 32-byte named bootstrap mailbox (pid + handle value only, DoS-bounded; HID minidrivers have no control device). Driver-validated pad_index kills cross-pad redirects; v1↔v2 mixes fail closed with diagnosis logs on both sides. Sibling-LocalService denial proven empirically (design/idd-push-security.md, design/gamepad-channel-sealing.md). Driver-side raw ops now live behind pf-umdf-util (checked shm accessors, the forbid(unsafe_code) ChannelClient state machine, WDF request tokens) — the pad drivers' logic is 100% safe Rust; whole drivers workspace clippy-gated in CI. driver install --gamepad now sweeps SWD\punktfunk phantom devnodes: a re-created SwDevice REVIVES the old devnode with its previously-bound driver (never re-ranks), so an upgrade otherwise leaves the old driver serving — or, across the v1→v2 fence, a dead pad (found live on the RTX box). On-glass validated on the RTX 4090 box: frame path 7007 frames p50 2.06 ms cross-machine; DualSense + XUSB "sealed pad channel mapped"/proto=2 attach via both the test harness and a real streaming session; phantom-sweep repro. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:08:56 +00:00
enricobuehler	a3e1ea2b44	fix(android/ci): retry transient Play API failures in play-upload.py ... The uploader only caught HTTPError — a URLError (TLS "EOF occurred in violation of protocol", the failure that dropped two release uploads on 2026-07-02) or a Google 5xx killed the job outright. Retry those with 3/9/27 s backoff; 4xx still fails fast. The edits API is transactional until commit, so re-sending is safe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 23:05:27 +00:00
enricobuehler	6686fcdded	fix(gamestream/tests): sender_delivers_batches flaked under CI load — burst overflowed the default socket buffer ... The test burst 3×100 1200 B datagrams into an undrained loopback socket: at ~2.5 KB kernel truesize each, the default ~212 KB rmem holds only ~80, so on a starved CI runner (parallel release builds) the kernel silently dropped the overflow and the recv loop could never reach 300 — surfacing as WouldBlock after the 3 s timeout. Size the burst (3×20) to fit the default buffer even with zero concurrent draining, and give recv a starvation-tolerant 10 s. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 22:35:23 +00:00
enricobuehler	31c382fde0	chore(release): 0.5.1 ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.5.1	2026-07-02 22:05:43 +00:00
enricobuehler	d707ee4d4e	feat(apple,android): three-way touch input — trackpad cursor (default), direct pointer, real multi-touch passthrough ... The two touch clients had exactly complementary gaps: iOS forwarded fingers ONLY as raw wire touches (no way to drive the host cursor from the touch screen), Android had the two mouse modes but no passthrough. Both now share one three-way "Touch input" setting: Trackpad (default) / Direct pointer / Touch passthrough. iOS/iPadOS: Input/TouchMouse.swift ports the Android gesture engine 1:1 (same px-based acceleration curve; tap=click, two-finger tap=right-click, two-finger drag=scroll, tap-then-drag=held drag, three-finger tap=stats HUD via the shared hudEnabled default); direct-pointer mode maps through the aspect-fit letterbox; the previous always-on behavior lives on as the passthrough option. The mode latches per gesture (a Settings change never splits one gesture across models), touchesCancelled releases held state without synthesizing a click, and session stop flushes a mid-drag button. Settings picker on iPhone + iPad next to the iPad-only pointer-capture toggle. Deliberate default change: trackpad, not passthrough. Android: new nativeSendTouch JNI shim → wire TouchDown/Move/Up (the host already injects real touch on every backend — libei touchscreen, wlroots, KWin fake-input, SendInput); streamTouchPassthrough forwards every finger with stable ids and lifts still-held contacts on teardown; the trackpadMode Boolean becomes the TouchMode enum (old pref migrated on load, never rewritten) with a Settings dropdown. Verified: macOS swift build + full suite (incl. new TouchMouseTests), iOS Simulator Swift compile, cargo check/fmt/clippy on the native crate, Kotlin app+kit compile + unit tests. On-glass feel of the iOS ballistics and Android passthrough against a touch-aware app still pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 00:02:12 +02:00
enricobuehler	e8196b33b8	feat(client/linux): Steam Deck batch — idle gamepad grab, fullscreen streams, in-band HDR colors, gamescope-safe settings, pad-pin persistence ... Root-caused fixes from on-Deck testing (owner + first external tester): - System input broke while the app was merely OPEN: SDL's Steam Deck HIDAPI driver clears the built-in controller's "lizard mode" (trackpad-mouse, clicky pads) at device ENUMERATION and keeps feeding the firmware watchdog (SDL_hidapi_steamdeck.c InitDevice/UpdateDevice) — and we enabled that driver at startup and held every pad open app-lifetime. The Valve HIDAPI hints are now enabled only while a session is attached, and only the active pad is opened (Settings enumerates via SDL's ID-based metadata getters, no open). Close/detach hands the hardware back; the watchdog restores lizard mode within seconds. This also unblocks click-to-capture on the Deck (the dead trackpad made "input not passed through" a symptom, not a cause). - Washed-out colors from a Windows host with an HDR desktop: the host ships Main10 BT.2020 PQ IN-BAND (correct VUI) while the Welcome still says SDR; this client rendered everything as BT.709 narrow. Colour signaling is now read per-frame (video::ColorDesc from the AVFrame CICP fields) and drives the GdkDmabufTexture color state, the software path's swscale matrix/range plus a tagged MemoryTexture for PQ, and an "· HDR" HUD chip — GTK tone-maps correctly on SDR displays, mid-session SDR↔HDR flips included. Regression- tested against a checked-in Main10 PQ fixture (tests/pq-frame.h265). - Streams start fullscreen by default (Settings toggle; F11 / the controller chord lead out, and the pointer at the top edge reveals the header while input isn't captured — a Deck desktop has no F11). Gaming-Mode launches (--fullscreen / Deck env) build the stream page with NO header bar at all: gamescope doesn't reliably ACK xdg_toplevel fullscreen, so anything keyed on is_fullscreen() could leave the title bar drawn over the stream. - Game Mode settings were uneditable: GTK popovers are xdg_popups, which gamescope never maps for nested apps — every ComboRow dropdown flashed and died. Under gamescope the preferences dialog now uses in-window selection subpages (PreferencesDialog::push_subpage) via a ChoiceRow that stays a stock ComboRow on desktops. Covered by an in-process GTK test (choice_row_modes, #[ignore]d — needs a display). - Forwarded-controller pin persists across restarts (Settings::forward_pad, stable vid:pid:name key — SDL instance ids are per-run) and survives disconnects; automatic selection skips Steam Input's sensor-less virtual pad (28de:11ff) so gyro doesn't silently die on Bazzite/Deck. - "Punktfunk" branding in the About dialog. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 21:37:43 +00:00
enricobuehler	fd699b3e2c	feat(decky): plugin overhaul — on-Deck update check, exec-bit-free runner, About/host-detail UI, Punktfunk branding ... Fixes from live debugging on the Deck: - check_update() was dead on-device: Decky Loader's embedded (PyInstaller) Python has no usable default CA paths, so every HTTPS fetch failed with CERTIFICATE_VERIFY_FAILED. Build the SSL context explicitly: default paths first, then the known system bundles (SteamOS/Arch, Debian, Fedora/Bazzite, openSUSE), then certifi if importable. Verification stays on; the check stays offline-tolerant with its 30-min cache. - "could not chmod runner" on every use: Decky extracts plugin zips without exec bits into a root-owned dir the unprivileged backend can't chmod. The Steam shortcut now launches the runner through /bin/sh with the script as a %command% argument — no exec bit needed, existing shortcuts migrate on reuse, the chmod attempt is gone. UI/structure: - index.tsx (660 lines) split into page/pair/settings/hooks/boundary modules; PluginErrorBoundary kept guarding every surface. - New About section/tab: visible version + channel, explicit check-for-updates (forces past the cache, always toasts an outcome), setup-guide link, leave- chord help, and a Force-stop backstop for a wedged stream. - Host rows open a details modal (address, protocol, pairing policy, paired state, fingerprint). Settings gain 1280×800 (Deck native), Xbox One and DualShock 4 pad types, and a host-compositor picker. - Update flows note the Decky store contact can stall a couple of minutes on networks that blackhole plugins.deckbrew.xyz (observed live). - "Punktfunk" in all user-facing strings; plugin id/paths/env unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 21:37:43 +00:00
enricobuehler	79dd8f58e3	docs(readme): status refresh — Windows client streaming live, console features ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 21:37:43 +00:00
enricobuehler	be879c946a	fix(host/logs): mdns-sd noise gate + tracing-log target normalization in the log ring ... log-crate events arrive through the tracing-log bridge under the shim target "log" — normalize them back to the real module path (NormalizeEvent) so the console's target column and the noise gate see mdns_sd::… , and suppress the bridge's log.* bookkeeping fields like the stderr fmt layer does. Gate known-chatty third-party DEBUG targets (mdns-sd DEBUG-logs every unparseable multicast packet — one AirPlay device floods thousands of entries per hour) to INFO-and-up in the ring, so ambient LAN noise can't evict the tail the ring exists to preserve. stderr under RUST_LOG is unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 21:37:43 +00:00
enricobuehler	f3646d4e7c	feat(apple/gamepad): claim controller system gestures during capture — PS button opens the Steam overlay, share/create stops screenshotting locally ... While a pad drives a stream, GamepadCapture now sets EVERY element's preferredSystemGestureState to .disabled (restored to .enabled on unbind). iOS/macOS attach system gestures to several controller buttons — share/create took a LOCAL screenshot instead of reaching the game, and only the Home element was opted out before. With the gestures claimed, the already-wired chains do their job: PS/Home → wire guide → BTN_MODE on the virtual xpad (the Steam-overlay button) / the PS bit on the virtual DualSense. Also fold the share/create/capture element (GCInputButtonShare) into the back/select wire bit — clone pads like the GameSir G8 expose their screenshot button only as the share element, not buttonOptions (OR onto the same bit, so double-exposed pads are harmless). The G8's other extra button (M) is a firmware-local modifier (turbo/hair-trigger/swap) invisible to the OS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 23:36:16 +02:00
enricobuehler	396c3453f5	feat(apple/gamepad): rewrite rumble renderer — bounded divergence + iOS 27 plain-player fix ... Ground-up RumbleRenderer rewrite around one principle: rumble is idempotent state on a lossy channel, and the actuator's divergence from it must be bounded, not best-effort. The old renderer rebuilt an infinite-duration CHHapticAdvancedPatternPlayer per 0xCA datagram via an async stop; one stop lost inside CoreHaptics left an unstoppable player buzzing forever (the "entered the menu and rumble never stopped" bug). - Finite 4 s segments, never infinite events — a leaked player self-silences; steady levels re-arm seamlessly ON the engine timeline (no stop/start race) - GamepadFeedback drains the rumble plane DRY per cycle, newest-wins (was one datagram per 8 ms through a 16-deep drop-newest queue = lag + shed stops) - Host 500 ms state refreshes dedupe to a liveness stamp; zero applies immediately; nonzero ramps throttle to one rebake/25 ms per motor - Throwing player stop escalates to engine.stop() (kills leaked players); 1.6 s staleness watchdog (Policy.session) force-silences on a dead channel; the test panel holds levels via Policy.manual - Plain makePlayer, NEVER makeAdvancedPlayer: gamecontrollerd's controller haptics server advertises `adv players: 0`, and iOS 27 beta 2 hard-drops advanced loads with an XPC decode fault (-4811/4097, rumble silently dead). Live-verified on an iOS 27 beta 2 iPhone: DualSense rumble works - Split-handle engines fall back to one combined .default engine on repeated failure; renderer publishes health transitions and the test panel shows them (a refused system service no longer reads as silent app breakage) - Per-motor sharpness on split handles (0.3 heavy / 0.7 light); macOS DualSense raw-HID path gains a ~1 s keepalive re-write while nonzero - RumbleTuningTests pin the scheduling math, tuning relations, and a queue/ticker teardown smoke test Stuck-rumble streaming repro revalidation on glass still pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 23:06:45 +02:00
enricobuehler	6921e147dd	ci(release): idempotent registry publish — survive re-tagged releases ... A moved release tag re-fires the publish workflows, and the Gitea registries reject duplicate uploads with 409 (deb pool, rpm group, and the generic packages' versioned URLs; the channel aliases already pre-deleted). Delete any prior copy of the exact version before uploading (404 on first publish tolerated), so a republished tag overwrites instead of wedging — v0.5.0's retag left stale no-port-change artifacts published and every re-run red. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 19:23:04 +00:00
enricobuehler	861da54066	feat(web,host/windows): move the web console off :3000 to :47992 ... Port 3000 collides with half the dev-server ecosystem; 47992 sits next to the mgmt API (47990) in the punktfunk port family. Updates the run scripts, systemd/scheduled-task units, Dockerfile, Windows firewall rule + installer, packaging, and every doc that referenced :3000. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.5.0	2026-07-02 18:17:42 +00:00