477 Commits

Author	SHA1	Message	Date
enricobuehler	71e1865519	fix(android): gate the latency overhaul behind an experimental toggle, default off ... The 27c53a4 low-latency overhaul regressed badly on some phones. Every piece of it — decoder ranking, per-SoC vendor keys, the async decode loop, pipeline thread boosts, the ADPF max-performance bias, game-tagged AAudio, DSCP marking, the Wi-Fi low-latency lock, HDMI ALLM and the forced TV mode switch — now rides the "Low-latency mode (experimental)" toggle, default OFF. Off restores the pre-overhaul pipeline byte-for-byte: the sync poll loop, the platform-default decoder, and the original format keys (standard low-latency + blind Qualcomm twin + priority=0 + operating-rate=MAX together). - New pref key (low_latency_mode_experimental): the old key shipped default-ON, so any install that ever saved settings persisted true — flipping the default under the old key would leave exactly the regressed devices stuck on. - DSCP is applied at socket creation, so the toggle reaches the transport via NativeBridge.nativeSetLowLatencyMode → transport::set_dscp_default, called in the connect choke point before nativeConnect; the core DSCP default reverts to off everywhere. - nativeStartAudio(handle, lowLatencyMode) gates AAudio usage=Game. - VideoDecoders.pickDecoder now skips `.secure` decoder twins and decoders that require FEATURE_SecurePlayback: they need a secure surface, and a secure twin could out-score its plain sibling (only it advertising FEATURE_LowLatency), which black-screens a clear stream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 20:18:59 +02:00
enricobuehler	05a6f39550	style: rustfmt drift from the native AMF SDK encoder ... The native AMF encoder (7649ccb) landed unformatted, failing CI's Format step (and short-circuiting Clippy/Build/Test). Reformatted amf.rs with the pinned rustfmt 1.96.0 — no functional change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 17:39:40 +00:00
enricobuehler	58d7b64978	Merge remote-tracking branch 'origin/main'	2026-07-06 16:29:48 +00:00
enricobuehler	a041b0aa96	fix(host): stop force-disabling zero-copy on Mutter+NVIDIA by default ... apply_session_env unconditionally forced PUNKTFUNK_FORCE_SHM=1 for every GNOME/Mutter session, added 2026-06-14 after a same-day stale-frame bug hunt found Mutter has no implicit dmabuf fence on NVIDIA. That override silently contradicted the documented "zero-copy is on by default for all Linux GPU backends" behavior and left Mutter+NVIDIA hosts on the slower CPU/SHM path unconditionally, with no way to opt back in. Live retesting (192.168.1.21, RTX 5070 Ti, real client with cursor movement/window drag/typing — the historical trigger) shows no visible staleness with the override removed. Drop the automatic force; PUNKTFUNK_FORCE_SHM stays as a manual escape hatch for anyone who does hit flashing/stale frames on a Mutter+NVIDIA host. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 16:04:25 +00:00
enricobuehler	7649ccb66b	feat(host): native AMF SDK encoder for Windows AMD — drop libavcodec ... Direct-SDK AMF encoder (encode/windows/amf.rs), the AMD analogue of the direct-NVENC path, replacing the libavcodec *_amf dispatch. C-vtable FFI pinned to AMF headers v1.4.36, runtime-loaded from the driver's amfrt64.dll (no build feature, no new dependency) exactly as NVENC loads its DLL. - AVC/HEVC (SDR NV12 + 10-bit HDR P010) and AV1 (RDNA3+, probed); a bounded poll retires the libavcodec ~2-frame output hold; native in-place reset(). - Intra-refresh wave (PUNKTFUNK_INTRA_REFRESH), in-band HDR mastering/CLL metadata (*InHDRMetadata -> HEVC SEI / AV1 OBU), and a native codec probe feeding the GameStream advertisement (windows_backend_is_ffmpeg -> windows_backend_is_probed). - AMD dispatch / advertisement / 4:4:4 are native-only; the libavcodec AMF fallback and the PUNKTFUNK_AMF_FFMPEG hatch are removed. FFmpeg serves QSV only (its AMF path retained solely as the latency A/B comparator). - Overload back-pressure: submit bounds in-flight surfaces below the input ring, draining finished AUs (buffered for poll, FIFO-preserved) to free a slot and retry on AMF_INPUT_FULL instead of tearing the encoder down and forcing an IDR; this also closes a latent ring-overwrite corruption seen under load on-glass. Validated on the lab Ryzen iGPU (AMF runtime 1.4.37): HEVC/AVC across a native reset, HEVC Main10 mastering+CLL SEIs byte-verified, intra-refresh accepted, a backpressure burst FIFO-clean, and end-to-end via the macOS client. Measured §5.2 latency A/B: native encode_us p50 ~5 ms (0.31 frame periods) vs libavcodec ~17 ms (1.01). 4:4:4 stays unsupported (VCN hardware limit). Live-gated tests skip cleanly on non-AMD boxes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 17:33:23 +02:00
enricobuehler	6081502949	feat(clients): signal explicit exit (QUIT_CLOSE_CODE) on deliberate disconnect ... The core's deliberate-quit close (NativeClient::disconnect_quit → QUIT_CLOSE_CODE, host skips the keep-alive linger) was implemented but never called by any client. Wire it to each client's explicit user-disconnect action — NOT to a network drop / host-ended / app-background (those keep the linger for a reconnect): - core: new C-ABI punktfunk_connection_disconnect_quit(c) for the ABI clients - Linux (direct-core): Ctrl+Alt+Shift+D + the controller escape chord - Windows (direct-core): Ctrl+Alt+Shift+D - Apple (C-ABI): PunktfunkConnection.disconnectQuit() + a `deliberate` flag on SessionModel.disconnect() (sessionEnded passes false → keeps the linger) - Android (JNI): new nativeDisconnectQuit export, called from the back gesture + the Select+Start+L1+R1 chord (not the host-gone watchdog) - probe already did this via --quit (b71dc94) Verified: core + Linux client + Android (cargo-ndk + gradle) build clean; Windows/Apple compile-checked by CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:37:45 +00:00
enricobuehler	a2723e34a1	style: rustfmt drift from the AMF/watchdog commits ... `cargo fmt --all --check` (a CI gate) failed on main: config.rs (the new `zerocopy: val(...).map { !matches!(...) }` from 8fb1264) and punktfunk1.rs (the `reset_stalled_encoder` conditions from 06d594b) were left unwrapped by the pinned rustfmt. Pure reformat, no semantic change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:00:23 +00:00
enricobuehler	8fb126482e	feat(host): default the Windows AMF encode input to zero-copy D3D11 ... On-glass A/B on the Ryzen 7000 iGPU (1080p120 HDR P010, hevc_amf, PUNKTFUNK_PERF stage split): the system-memory readback costs the encode thread 2.7-2.9 ms p50 (6.6 ms p99) per frame in submit; the zero-copy D3D11 pool path does the same work in 0.26 ms p50 (0.5 ms p99) — and on an iGPU the readback also burns the shared memory bandwidth the game needs. The docs-site already promised "on by default ... D3D11 on Windows" since the Linux flip (2f9e61d was Linux-only); the Windows code now delivers it. PUNKTFUNK_ZEROCOPY becomes a tri-state override: unset defers to a per-vendor default in zerocopy_enabled(vendor) — ON for AMF (validated above; open failures still fall back to system-memory readback), OFF for QSV until it is validated on Intel glass (the fallback only catches *setup* errors; a QSV derive that opens but maps wrong would corrupt silently, so probe-never-assume applies). Explicit values force either way: 0|false|off|no = readback, anything else = zero-copy, so the old presence-style =1 keeps working. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:36:43 +02:00
enricobuehler	06d594bc2a	fix(host): encode-stall watchdog — heal the silent AMF/QSV freeze in place ... Field reports: Windows AMD/Intel streams freeze after ~3-5 min regardless of desktop activity. Root cause: the libavcodec AMF/QSV poll is non-blocking (EAGAIN -> Ok(None)), and the encode loop's drain treated None as benign without popping `inflight` — a wedged driver (QueryOutput stops producing) meant frames kept being submitted, inflight grew unboundedly, no AU ever reached the send thread, and nothing logged: a silent permanent freeze. The input-side twin: once libavcodec's one-frame buffer fills, avcodec_send_frame EAGAINs and the submit `?` killed the whole session. Add `Encoder::reset()` (in-place encoder rebuild; implemented for AMF/QSV by dropping the wedged libavcodec encoder so the next submit re-opens it on the current device, forced IDR) and an encode-stall watchdog in the stream loop: trip on a poll error, on no AU within max(2 s, 8 frame intervals) while frames are owed, or on an owed backlog worth more than the window's frames (the slow-leak latency-runaway form). Recovery is a bounded (5 consecutive, cleared by any delivered AU) in-place rebuild + forced IDR — a logged ~one-second hiccup instead of a dead stream; exhaustion or a reset-less backend still fails the session with a clear error. Submit failures route through the same bounded recovery. The three existing pipeline-rebuild paths (session switch, mode switch, capture loss) now also clear the stale in-flight records that pointed at the dropped encoder. Backends whose poll blocks (direct NVENC sync, software) can't false-trip: they never return Ok(None) mid-stream and drain inflight below depth each tick. Validated: clippy -D warnings (nvenc,amf-qsv), 191 host tests, synthetic E2E 300/300 frames, and an on-glass AMD iGPU session (1080p120 HDR hevc_amf). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:36:29 +02:00
enricobuehler	39889c3102	fix(host): silence write-only cur_node_id on non-Linux encoder builds ... cur_node_id (the capture 5-tuple's node id, added for the Linux dedicated- game-exit check) is read only under #[cfg(target_os = "linux")], so on the Windows nvenc/amf-qsv build it was assigned but never read — failing `clippy -D warnings`. Read it on non-Linux platforms (the `let _ = &launch` idiom already used in this file). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:49:45 +00:00
enricobuehler	2f9e61d191	feat(host): enable GPU zero-copy by default on all backends ... Now that the per-capture worker subprocess makes an NVENC EGL/CUDA driver fault survivable (design/zerocopy-worker-isolation.md), the reason the NVENC zero-copy path stayed opt-in is gone. zerocopy::enabled() now defaults ON for both GPU backends (was ON VAAPI / OFF NVENC). Fallbacks are intact: VAAPI's one-shot CPU auto-downgrade (VAAPI-gated, never trips for NVENC) and NVENC's per-capture fallback + worker-death latch. Reframe the shipped host.env examples and setup guides to rely on the default rather than force PUNKTFUNK_ZEROCOPY=1 (an explicit =1 skips the VAAPI auto-downgrade). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	a947f48d29	fix(host): preserve a physical monitor's refresh when adding a virtual display ... Connecting reset an existing physical monitor's refresh (e.g. 120->60 Hz) because the topology code read the physical's mode AFTER the virtual output perturbed the compositor layout — by which point it had already been downgraded. Read/preserve each physical's mode from a pre-connect snapshot. - Mutter: build_primary_keeping_physicals takes the pre-virtual snapshot and preserves each physical's real mode (pick_keep_mode, unit-tested) - KWin: capture each output's mode when disabling for exclusive, re-assert it on re-enable (a bare enable defaulted to ~60 Hz) - Windows: skip the refresh-resetting SDC_TOPOLOGY_EXTEND when a physical is already active Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	a4f81dec48	feat(host): user-defined custom display presets ... Save named bundles of the display-management policy (the six behavior axes plus the game-session axis) as custom presets, alongside the built-ins. A custom preset is data — stored in <config>/display-presets.json — not a Preset enum variant, so DisplayPolicy::effective() stays pure and the built-in set is untouched; applying one writes a Custom policy via the existing PUT /display/settings. - policy.rs: CustomPreset/CustomPresetInput + load/add/update/delete store - mgmt.rs: GET/POST /display/presets + PUT/DELETE /display/presets/{id}, surfaced on GET /display/settings - web console: custom-preset cards with save-as / edit / delete + i18n - regenerated api/openapi.json; docs Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	077d8f85ca	feat(host): isolate the zero-copy GPU import in a worker process ... The tiled EGL/GL→CUDA import crashed the whole host (SIGSEGV inside libnvidia-eglcore via cuGraphicsMapResources) when the compositor invalidated an imported dmabuf mid-map — reproduced on the Bazzite F44 Game→Desktop switch (design/zerocopy-hardening-handoff.md). A driver SIGSEGV is uncatchable in-process, so the whole EglImporter (tiled EGL/GL→CUDA and LINEAR Vulkan→CUDA) now runs in a per-capture `zerocopy-worker` subprocess: dmabuf fds go over a SEQPACKET socketpair (SCM_RIGHTS, sent once per buffer keyed by dmabuf st_ino; NeedFd resend self-heals cache desync), frames come back as CUDA-IPC pooled device buffers (still zero-copy, +one socket RTT/frame). Worker death poisons the capturer so the existing capture-loss rebuild runs — the host survives; 3 consecutive deaths latch the GPU import off (CPU/SHM path). PUNKTFUNK_ZEROCOPY_INPROC=1 keeps the old in-process import for debugging/A-B. Also fixed along the way: a failed *tiled* import no longer falls through to the CPU mmap de-pad (which scrambled tiled bytes; LINEAR keeps the fallback); Nv12Blit dropped its GL textures while still CUDA-registered (unregister now runs first); GlBlit had no Drop at all (GL objects leaked per size change); VkBridge's per-fd src cache is now invalidated on renegotiation/eviction instead of never. Design: design/zerocopy-worker-isolation.md. Unit tests: 14 new (protocol fd-passing, worker dispatch, client handshake/death/NeedFd, death latch). On-glass validated on the RTX 5070 Ti/GNOME box (.21): the worker path streams at p50 1.30 ms (NV12, 1800 frames 0-mismatched, parity with the in-process path), and a kill -9 of the worker mid-stream is survived by the host and recovered — poison -> capture lost, rebuilding pipeline in place -> a fresh worker in ~185 ms -> streaming resumes (2385 frames, 0 mismatched). A real KWin compositor-crash repro is still pending (a worker kill -9 is strictly harsher, so it corroborates). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	1271fd5ea2	feat(host): game-mode integration + dedicated game sessions ... Implements design/gamemode-and-dedicated-sessions.md (Parts A1-A5 + B0-B2): reconciles the merged display-management registry with session-mobile Bazzite/SteamOS hosts and adds a per-launch dedicated gamescope mode. - A1 DisplayOwnership {Owned,External,SessionManaged} + poolable_now(): the registry pools only what it owns, so gamescope managed/attach outputs are no longer double-owned by the registry AND the gamescope restore worker (fixes the game-mode-reconnect stale-node wedge). - A2 validated reuse: (backend,mode,launch,epoch) reuse key + kept_display_alive liveness probe + reused_gen/mark_failed on a reused-display first-frame failure. - A3 policy-driven managed restore (keep_alive replaces the hardcoded 5s debounce; forever = held = gaming-rig truthful) + crash-restore persist + SIGKILL teardown (kill_unit, applied to our transient unit AND the autologin stop -- validated live on .181 to avoid the F44 GPU-context leak). - A4 session epoch: observe_session_instance bumps the epoch + invalidate_backend on a desktop-compositor instance change; gamescope spawns are exempt. - A5 per-spawn log + PID-scoped gamescope node discovery. - B0 game_session {auto,dedicated} policy (top-level, preset-orthogonal) + pick_gamescope_mode dedicated_launch + steam -silent command shaping. - B1 free the autologin Steam before a dedicated Steam spawn (single-instance). - B2 game-exit -> APP_EXITED_CLOSE_CODE (0x52) clean session end. Adversarially reviewed (11 findings fixed). Validated on glass (.181 Bazzite F44, RTX 4090): dedicated spawn streams a real game smoothly; keep-alive reuse; the SIGKILL fix avoids the F44 vkCreateDevice leak. Workspace green (build / test --workspace / clippy -D warnings / fmt), OpenAPI + C header regenerated, web console tsc + vite build green. clients/probe: bump the no-video timeout 8s->45s for gamescope cold starts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	42b45113a9	fix(android): pass dropped streams through to the ui	2026-07-06 12:14:40 +02:00
enricobuehler	ab56536842	docs(readme): Windows host capture is IDD-push, not DXGI/WGC ... The DXGI Desktop Duplication + WGC relay paths were removed; sealed IDD-push (finished frames pushed straight into the host's own IddCx driver, no screen-scraping) is now the sole Windows capture path. Fix the stale "DXGI/WGC capture" claims in the root and punktfunk-host READMEs, which also contradicted the push-based IDD description already present in the root README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:28:29 +02:00
enricobuehler	27c53a4b53	perf(android): low-latency decode overhaul — vendor keys, async loop, system tuning ... Close the latency gap on the Android client with per-SoC decoder tuning, an event-driven decode loop, and full system integration. - Decoder selection: rank MediaCodecList decoders in Kotlin (hardware/vendor preferred, software avoided, FEATURE_LowLatency probed) and create the chosen one by name. Per-SoC low-latency keys gated on the codec-name prefix: Qualcomm picture-order + low-latency, Exynos (also Google Tensor), Amlogic, HiSilicon; MediaTek vdec-lowlatency set unconditionally. operating-rate = MAX (Qualcomm) vs priority = 0 (else) are mutually exclusive. NVIDIA/Rockchip/Realtek have no vendor key — covered by ranking + the standard low-latency key. - Async decode loop: AMediaCodec async-notify replaces the poll loop, presenting a decoded frame the instant it is ready instead of waiting out a poll interval. Behind USE_ASYNC_DECODE with the synchronous loop kept for A/B during bring-up. - System integration: Wi-Fi FULL_LOW_LATENCY lock and HDMI ALLM (setPreferMinimalPostProcessing) for the stream's lifetime; game_mode_config.xml opting out of OEM downscaling / FPS overrides. - Pipeline: boost the data-plane pump + audio thread priorities, AAudio usage=Game, DSCP marking on by default on Android, ADPF setPreferPowerEfficiency(false), and setFrameRateWithChangeStrategy(ALWAYS) to force the HDMI mode switch on TV. - lowLatencyMode master toggle (default on) as the escape hatch; the stats HUD now shows the resolved decoder name. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:25:16 +02:00
enricobuehler	19c35de3d7	style(host): cargo fmt --all (rustfmt 1.9.0 drift) ... The CI image's rustfmt reformats these files (multi-line assert!/tracing! macros, match-arm and struct-variant wrapping) — pre-existing drift that the Format job caught. Reformat to match. Pure formatting; no logic change. main.rs also gets a blank line before a standalone comment so rustfmt stops mis-indenting it as a trailing-comment continuation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:29:28 +00:00
enricobuehler	aa012c6b45	feat(vdisplay/mutter): pin the client's refresh by default; drop PUNKTFUNK_MUTTER_VIRTUAL_REFRESH ... The >60 Hz virtual-monitor path (RecordVirtual "modes" with the client's exact WxH@Hz) was gated behind PUNKTFUNK_MUTTER_VIRTUAL_REFRESH, default OFF, after a high-refresh virtual CRTC SIGSEGV'd gnome-shell on session teardown. That crash was since fixed by stopping the screencast before any monitor reconfig, so the gate is dead weight — and a silent footgun: every non-headless GNOME client was capped at Mutter's PipeWire-derived 60 Hz unless they knew the hidden flag. Make it the default: the custom-mode path now runs whenever mode.refresh_hz > 60 (≤60 Hz stays byte-identical to before — Mutter's 60 Hz default is already correct), and the virtual_refresh_enabled() env read is removed. Docs updated (configuration.md env table, vrr-plan.md reference). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:25:36 +00:00
enricobuehler	74c9e46faf	fix(vdisplay/windows): Windows clippy — per-block SAFETY comments + then_some ... The branch's Windows-host code never ran through the fleet Windows clippy (kept off CI); the merge to main exposed it. Fix the 4 -D warnings failures in cfg(windows) code: - manager.rs: 3 unsafe blocks (isolate_displays_ccd / force_extend_topology / set_virtual_primary_ccd) had one "both arms" SAFETY comment on the `match` line — clippy::undocumented_unsafe_blocks wants it immediately before each block. Split into per-block SAFETY comments. - win_display.rs: `.then(|| …)` on a POD u32 union read → `.then_some(…)` (eager is fine, discarded when false) for clippy::unnecessary_lazy_evaluations. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:04:06 +00:00
enricobuehler	334f36ce25	test(punktfunk1): serialize in-process-host tests (shared admission table) ... The reconnect-preempt (b53710d, preempt_same_identity) reads the process-global admission table and signals same-identity live sessions. The three in-process-host tests each bind a fixed loopback port and share that ONE table, so running them concurrently let one test's connection preempt + close another's live session — an intermittent `next_au: Closed` in c_abi_connection_roundtrip (surfaced under full-workspace load; a lucky pass hid it at b53710d). Serialize them on a poison-tolerant lock. Test-isolation only — in production a host is one process with unique client certs, so same-identity preempt is correct. Full workspace `cargo test` now green (18 suites, 3× clean). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 18:09:59 +00:00
enricobuehler	fc1e8a8a32	test(mgmt): display_settings_surface stays read-only (gaming-rig now accepted) ... The old `..._and_forever_rejected` asserted a 400 for keep_alive=forever; now that it's accepted, that PUT succeeded and WROTE gaming-rig into the process-global prefs, racing other tests. Rewrite read-only: assert the surface (5 presets, effective, enforced axes) and read gaming-rig=forever off the preset list — no write. Acceptance is covered on-glass (.116) + the pure policy tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 18:03:11 +00:00
enricobuehler	69f4c987f6	feat(tray): surface kept virtual displays in the tray tooltip ... Stage 8 polish. `GET /api/v1/local/summary` (the tray's loopback-only unauthenticated status source) gains `kept_displays` — the count of lingering/pinned virtual displays (held with no live session), over the already-validated `registry::snapshot()`. The tray shows it in the idle tooltip ("idle · 1 display kept"), so a user knows a display — and, under exclusive topology, their physical monitors — is being held (e.g. a gaming-rig `forever` pin). Release stays via the console: a state-changing release can't be an unauthenticated endpoint, and the non-elevated Windows tray can't read the SYSTEM-DACL'd mgmt token, so a tray release button isn't cleanly cross-platform. `#[serde(default)]` on the tray side keeps it compatible with an older host. Tray tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 17:54:44 +00:00
enricobuehler	04a397be84	fix(vdisplay/windows): drop an unused mut in isolate-retry (clippy -D warnings) ... `let (mut paths, mut modes)` — `modes` is only read (`modes.as_slice()`), never mutated. A pre-existing unused_mut (from 029d113) that the Linux CI never caught because win_display.rs is #[cfg(windows)]; surfaced by a manual .173 build. Would fail the release-gated Windows clippy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 17:41:22 +00:00
enricobuehler	ccbd7e8880	feat(vdisplay): ship keep_alive=forever (gaming-rig) — Windows MgrState::Pinned ... Completes the last §6A-era preset. The Linux registry already resolved forever→Pinned (pure lifecycle machine); the blockers were the Windows manager, the mgmt reject, and the console tag: - Windows manager: new `MgrState::Pinned { mon }` — the last-released monitor under keep_alive=forever is kept indefinitely (like Lingering but the linger timer never fires). A reconnect preempts + recreates it (same as Lingering — a reused IddCx swap-chain is dead), snapshot reports "pinned", and `force_release` (POST /display/release, the §8 escape hatch) frees a pinned monitor. release() branches on the new `keep_alive_forever()`; all MgrState matches made exhaustive over Pinned. - mgmt PUT /display/settings: stop rejecting keep_alive=forever (now honored on both platforms with a release path). OpenAPI regenerated. - web: un-disable the gaming-rig preset (DISABLED_PRESETS now empty) — one-click applies. Linux paths + web/tsc/openapi green; 47 vdisplay tests pass. The Windows manager.rs is #[cfg(windows)] (not compilable on the Linux dev box) — build-verified + on-glass validation on .173 to follow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 17:26:43 +00:00
enricobuehler	b53710da1a	feat(vdisplay): harden keep-alive reconnect — same-client preempt, quit-skips-linger, configurable idle ... On-glass testing (Test 2, KWin .116) surfaced that a reconnect within the QUIC idle-timeout window (~8s) lands on a fresh SECOND display instead of reusing the kept one: the old session was still Active (not yet Lingering), so the registry's keep-alive reuse (which only matches Lingering) skipped it and the old session kept streaming to nobody. Three fixes: #3 Same-client reconnect preempt (the real fix): admission::preempt_same_identity() lists a reconnecting client's OWN still-live session(s) (same cert fingerprint); serve_session signals their stop + waits the release grace BEFORE acquiring, so the zombie tears down → its display lingers → the reconnect REUSES it instead of making a second. Implements the "preempts downstream" the admission docs already promised. Independent of the mode_conflict policy; the pure core (same_identity_stops) is unit-tested. #2 Deliberate quit skips linger: a client that deliberately disconnects closes the QUIC connection with QUIT_CLOSE_CODE (0x51, shared in core::quic); the host reads the ApplicationClosed reason and tears the display down immediately (registry release() gained force_immediate → Linger::Immediate; multi-session-safe via the pure lifecycle machine), while a bare disconnect still lingers for reconnect. Threaded via a session quit flag → the DisplayLease. NativeClient::disconnect_quit() + punktfunk-probe --quit drive it; GameStream (Quit App / h_cancel) is a documented follow-up. #1 Configurable disconnect-detection latency: the QUIC control-connection idle timeout (stream_transport, 8s default) is host-tunable via --idle-timeout-ms / PUNKTFUNK_IDLE_TIMEOUT_MS, clamped >=1s with a keep-alive that scales to it so a live session never false-closes. Default unchanged (8s stays load-bearing for the Windows IDD-push reconnect flow). Workspace check + 63 core / 215 host / 47 vdisplay tests green; clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 16:41:06 +00:00
enricobuehler	62e0367f4b	feat(punktfunk1): configurable data-plane UDP port (--data-port) ... The native data plane used a random ephemeral UDP port (hole-punched), which a strict firewall can't pre-open — so remote clients behind one couldn't connect. Add an optional fixed data port: - `Punktfunk1Options`/`NativeServe` gain `data_port`; `bind_data_socket` binds the fixed port (→ direct, no hole-punch) or falls back to a random port + hole-punch when unset or the fixed port is busy (a concurrent session already holds it). - `UdpTransport::from_socket`/`from_socket_punch` adopt an already-bound socket, so the host keeps the SAME data socket from handshake through streaming — no drop-then-rebind window in which a concurrent session could steal a fixed port. - `main.rs` wires the CLI flag through to `NativeServe`. - Firewall docs updated (troubleshooting.md + apt/pacman/bazzite READMEs): control plane is the fixed UDP 9777; the data plane is a separate random port that usually needs no rule, with the fixed-port option for strict firewalls. Unit-tested: default random+hole-punch, and fixed-port-then-fallback-when-busy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 13:53:54 +00:00
enricobuehler	677a4f4cf5	perf(gamestream): move FEC packetization off the encode loop (3-stage pipeline) ... FEC/Reed-Solomon packetization ran inline on the encode loop (~3 ms/frame at 4K), serializing behind encode and capping the GameStream frame rate below what the encoder alone can sustain. Split it into a 3-stage pipeline, each stage on its own thread joined by a depth-2 bounded queue: encode loop → [raw AUs] → packetizer (FEC/RS) → [wire batch] → paced sender - `spawn_packetizer`: turns each `RawFrame`'s access units into wire datagrams via the stateful VideoPacketizer, off the encode loop. Above-normal priority (on the per-frame critical path). Tallies goodput (bytes to the wire) for the stats window. - Backpressure chains up: a slow sender blocks the packetizer, which fills the encode→packetizer queue, which makes the encode loop drop the NEWEST frame — encode itself never waits. - A dropped frame now consumes no client-visible frameIndex (packetization is downstream), so the host re-anchors the reference chain: a drop arms a keyframe on the next iteration (`recover_after_drop`), routed through the same coalesce gate as client IDR requests so a burst of drops (congestion) can't become an IDR storm. - Perf/stats relabeled: `pkt` = AU drain, `send` = enqueue to the pipeline (both should be near-zero now; nonzero = encode being stalled by pipeline backpressure). Goodput read from the packetizer's atomic at the 1 s stats boundary. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 13:53:43 +00:00
enricobuehler	87435e6547	feat(vdisplay): complete Stage 5 §6A group semantics — per-group restore, Mutter group-aware, gamescope groups ... Host-side completion of Stage 5 (§6A many-clients-as-monitors), all unit-tested; two-session on-glass validation still pending (no GPU on the dev VM): - Per-group topology restore (§6.1): the KWin `exclusive` restore no longer rides the per-session StopGuard (which re-enabled the physical the moment the FIRST of several exclusive sessions dropped, under a live sibling). KWin hands its restore to the registry as a closure (new trait `take_topology_restore`); the registry keeps it in the display group (`Entry.topology_restore`) and, on teardown, floats it to a surviving same-group sibling (`hand_off_restore`) or runs it when the group empties — outside the lock, before the last output's keepalive drops, so the compositor never sees zero outputs. All three teardown paths (lease drop / linger expiry / mgmt release) honor it. Single-display path byte-for-byte unchanged. Unit-tested: float / run-on-last / non-carrier-first / never-cross-backend. - Mutter group-aware (new trait `set_first_in_group`): the registry tells each backend whether it's the first display of its group; a non-first Mutter session EXTENDS into the already-exclusive desktop instead of re-applying a sole-monitor ApplyMonitorsConfig that would disable the first session's virtual. (Mutter connectors are un-nameable, so it can't build a keep-all-virtuals config; skipping is the safe equivalent.) Single-session unchanged. Residual APPLY_TEMPORARY revert documented. - gamescope groups (§6.1): `registry::group_key` makes each gamescope spawn its own group (independent nested session, no shared desktop) — never auto-rowed against or restore-/topology-grouped with another gamescope. Applied in both the /display/state assembly and the acquire-time position computation. Unit-tested. Remaining Stage 5: the web console arrangement table, on-glass validation, and the documented residuals (wlroots exclusive, Mutter APPLY_TEMPORARY). design doc updated. cargo build/test (214)/clippy --all-targets/fmt green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 13:26:25 +00:00
enricobuehler	e0f15822ae	feat(vdisplay): Stage 5 layout foundation — arrangement engine + /display/layout + group placement ... §6A layout, riding the Stages 1-3 registry with no protocol change: - vdisplay/layout.rs: pure arrangement engine — auto-row (left-to-right in acquire order, top-aligned) + manual (per-identity-slot offsets, auto-row fallback for unpinned members). Unit-tested. - Registry group model (Linux): group = backend (one desktop per compositor session). /display/state groups entries, orders by acquire (gen), and computes each member's position via the engine (pure `assemble_displays`, unit-tested). DisplayInfo carries group/display_index/position/identity_slot/topology. The backend reports its resolved slot via the new VirtualDisplay::last_identity_slot (KWin only), so the arrangement + state key on per-client identity. - Registry-driven position apply: new VirtualDisplay::apply_position(x,y) (default no-op; KWin drives kscreen-doctor). Right after create the registry computes the new display's position over its whole group (pure `position_for_new`, unit-tested) and applies it — one seam for BOTH deterministic auto-row AND manual placement. Guarded: the origin (0,0) is skipped, so a single-display / first-of-group session (and every non-KWin backend) issues no positioning — the historical single-display path is unchanged. On-glass-validation-pending. - PUT /api/v1/display/layout: persists the console's manual arrangement via the pure EffectivePolicy::with_manual_layout transform (locks current effective behavior into explicit Custom fields + sets a manual layout, so arranging is orthogonal to the other axes). OpenAPI regenerated. - /display/settings `enforced` now lists all five axes (keep_alive, topology, mode_conflict [Stage 4], identity [Stage 3], layout [Stage 5]) — was stale at keep_alive+topology; the console reads it to know which controls are live. Still Stage-5 TODO (design/display-management.md §11): Mutter/wlroots group-aware analogues, per-group topology restore, the web arrangement table, gamescope decline. cargo build/test/clippy/fmt green; OpenAPI in sync. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 12:59:04 +00:00
enricobuehler	eddcd91f48	feat(vdisplay/kwin): group-aware exclusive — never disable a sibling output (Stage 5 §6.1) ... The critical latent bug Stage 3 introduced: per-slot output names mean a 2nd exclusive session's other_enabled_outputs() (which disabled 'everything not named Virtual-punktfunk') would black out the 1st session's Virtual-punktfunk-<id> output. Fix: recognise the whole managed group by the shared Virtual-punktfunk prefix — exclusive now disables only NON-managed outputs (bootstrap/physical), never a group sibling. Plus first-slot-wins for the group primary (a_managed_output_is_primary): a later session joins as a secondary monitor of the shared desktop instead of stealing the shell off the first. Unit-tested. Start of Stage 5 (§6A many-clients-one-desktop). Remaining: Mutter/wlroots group-aware analogues, layout (auto-row/manual + /display/layout + console), per-group topology restore, gamescope groups. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 11:44:41 +00:00
enricobuehler	23446fa177	fix(vdisplay): Windows admission default is reject, not join (single-capturer limit) ... Two concurrent Windows sessions both drive the same pf-vdisplay monitor's single-capturer IDD-push channel (newest-delivery-wins), which freezes the live client and can wedge the driver (observed live: a concurrent-session test wedged .173 → Moonlight 'no video'; needed a reboot). True multi-session capture is §6.6/ Stage 7. So on Windows 'separate' (incl. the unconfigured default) now resolves to REJECT — a 2nd client gets a clean 503 and the live session is protected — instead of join (which would freeze it). join/steal stay explicit opt-ins; Linux keeps separate (real multi-view). Centralized as admission::effective_conflict(), shared by the native handshake + GameStream h_launch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 11:32:52 +00:00
enricobuehler	980939ed6b	refactor(gamestream): extract + unit-test gamestream_admission (Stage 4) ... Pull the GameStream mode-conflict decision out of h_launch into a pure gamestream_admission(live, req_fp, policy) -> GsDecision so the 503/join/take-over logic is unit-tested (no live session / same-client → Serve; different client → Reject/Join/Serve per policy; anonymous requester treated as different) — the GameStream path can't be driven without a Moonlight client, so this covers the logic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 10:43:08 +00:00
enricobuehler	cfad0cf7ee	feat(vdisplay): finish Stage 4 — typed reject, Windows join-default, GameStream 503 ... Completes the mode-conflict admission surface deferred from the initial Stage 4: - REJECT now delivers the reason to the client: punktfunk/1 closes the QUIC connection with a distinct BUSY code (0x42) + the 'host busy: streaming WxH@Hz to <client>' string, which the client reads from ApplicationClosed (validated on loopback: the probe logs 'closed by peer: host busy … (code 66)'). - Windows default: separate (incl. the unconfigured default) resolves to JOIN — the Windows native host admits a second client at the live mode instead of the old silent last-wins reconfigure of the shared monitor (release-note behavior fix; the reconfigure is now opt-in as steal). separate stays multi-view on Linux. - GameStream 503: h_launch tracks the session owner fp (LaunchSession.owner_fp, kept [u8;32] for Copy) and applies the policy when a DIFFERENT paired client launches — reject → 503 (Moonlight 'host busy'), join → serve the live mode, steal/separate → take over. Same-client re-launch is never a conflict. Native reject-reason loopback-validated; Windows join-default pending .173 rebuild; GameStream 503 pending a Moonlight client (can't drive /launch autonomously). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 10:34:49 +00:00
enricobuehler	42b1158ea7	feat(vdisplay): mode-conflict admission — separate/join/steal/reject (Stage 4) ... The mode_conflict policy is now enforced at ADMISSION, before the punktfunk/1 Welcome, when a DIFFERENT client connects while another client's session is live: - separate (default, unconfigured → no change): each client its own display. - join: admit at the live display's mode (honest-downgrade — the Welcome carries it). - steal: signal the victim session(s)' stop flags, wait the release grace, serve. - reject: refuse the handshake with a busy reason (live mode + client label). New vdisplay/admission.rs: the pure decide() (unit-tested — same-client never conflicts, anonymous clients each distinct, join targets the oldest session) + a live-session registry (identity + mode + stop flag) sessions register in once up. Wired into punktfunk1 serve_session: admit() before validate_dimensions, register after the data plane binds. A same-client reconnect never conflicts. Validated on loopback (two probes, distinct identities, differing modes) across all four policies: separate→own mode, join→live mode, steal→victim interrupted, reject→handshake refused. Remaining Stage-4 surface (deferred): GameStream 503 path, Windows-specific defaults (separate→join map, silent-reconfigure→steal), reject reason delivered to the client as a typed message (currently host-side log + connection close). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 10:21:28 +00:00
enricobuehler	029d1134a9	harden(vdisplay/windows): verify+retry exclusive isolation; pack primary layout ... Exclusive (topology=exclusive) was fire-and-forget — a field-reported bug had a physical monitor STAY ACTIVE. isolate_displays_ccd now re-queries after each apply and RETRIES (up to 4x) until count_other_active()==0, never trusting rc alone; logs SOLE-active on success, an error if a display survives all attempts. Secure desktop correctness depends on the lock screen not landing on a stray panel. Primary: drop the temporary per-path diagnostic; pack the kept displays left-to- right from the virtual's right edge instead of blindly shifting each by virt_width (which left a dead gap when extend already placed them right). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:55:13 +00:00
enricobuehler	e35b6991e2	fix(vdisplay/windows): topology=primary force-extends to reactivate the physical ... Root cause: on a headless box the IDD auto-activates as the SOLE display, so QueryDisplayConfig sees only the virtual — the physical is already deactivated before set_virtual_primary_ccd runs (no physical to keep). Force EXTEND first to reactivate every connected display alongside the virtual, then reposition to make the virtual primary, keeping the physical active. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:41:20 +00:00
enricobuehler	913f6ce659	diag(vdisplay/windows): log active paths in set_virtual_primary_ccd ... Temporary diagnostic — the physical monitor goes black in topology=primary despite rc=0; the SSH/session-0 view can't see the real interactive-session topology, so log the active paths the host actually operates on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:36:53 +00:00
enricobuehler	d23bd9b0cf	fix(vdisplay/windows): DISPLAYCONFIG_PATH_SOURCE_INFO union field access ... modeInfoIdx lives in the Anonymous union (windows-rs), not directly on sourceInfo — set_virtual_primary_ccd now reads .Anonymous.modeInfoIdx. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:27:07 +00:00
enricobuehler	eda7cac78e	feat(vdisplay/windows): topology=primary — keep physicals active, virtual primary ... Implements the deferred Windows primary-only CCD (Stage 2). set_virtual_primary_ccd repositions the virtual output's source to (0,0) = primary and shifts the physical display(s) to its right, ALL kept active — one atomic CCD SetDisplayConfig (not GDI CDS_SET_PRIMARY, which storms MODE_CHANGE_IN_PROGRESS with another display live). The manager's should_isolate() becomes topology_action() (3-way): extend (skip), primary (set_virtual_primary_ccd), exclusive (isolate_displays_ccd). Restore-on-teardown covers both. Validates the user's two scenarios on a physical-monitor .173. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:17:41 +00:00
enricobuehler	d73951414c	feat(vdisplay): KWin per-slot output naming for persistent scaling (Stage 3) ... The KWin backend names its output Virtual-punktfunk-<id> from the client's stable identity slot, so KWin persists per-output config (scale/mode) by name in kwinoutputconfig.json and reapplies that client's scaling on reconnect — the KDE scaling ask. Also fixes the latent clash where two concurrent sessions both used Virtual-punktfunk (topology name-matching now uses the per-slot name). - identity::global() + resolve_slot(fp, mode, default) — the shared persisted map (Windows manager dropped its own field; both use the global — never same-process). Default identity is per-platform: PerClient on Windows, Shared on Linux, so unconfigured hosts keep today's behavior (Linux = single 'punktfunk' name). - KwinDisplay carries the client fp (set_client_identity), computes the per-slot name, threads it through the stream_virtual_output name + the topology helpers (set_custom_refresh / apply_virtual_primary[_only] / other_enabled_outputs). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 08:54:39 +00:00
enricobuehler	b150d79626	feat(vdisplay): platform-neutral identity map + per-client-mode (Stage 3) ... Generalize the Windows-only per-client stable-id map into vdisplay/identity.rs: - DisplayIdentityMap keyed on a composable string (identity_key: fingerprint, or fingerprint+resolution under per-client-mode); LRU at 15, persisted to display-identity.json (migrated from the legacy pf-vdisplay-identity.json). - Windows manager wired to it, picking the key from the identity policy. - Foundation for KWin per-slot output naming (persistent KDE scaling) — the KWin wiring is the next Stage-3 step (needs a KWin box). - Unit-tested (stable, per-client-mode split, LRU, key composition). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 08:40:18 +00:00
enricobuehler	cb7ddc0411	feat(vdisplay): topology decoupling — distinct primary level (Stage 2) ... The three topology levels become distinct behaviors (Stage 0 only did extend-vs-exclusive, faking primary): - vdisplay::effective_topology() -> the concrete level (console policy > legacy *_VIRTUAL_PRIMARY env > Auto default). Backends read it directly at create time; apply_session_env no longer writes the boolean env (one fewer connect- path env mutation). - Mutter: extend (no config), primary (virtual primary + physicals kept as secondaries — build_primary_keeping_physicals), exclusive (sole, physicals disabled). KWin: extend (no-op), primary (kscreen primary only), exclusive (primary + disable others). - Windows should_isolate treats primary as isolate (the primary-only CCD variant is a follow-up); wlroots exclusive + the physical-keep effect need a display-attached box (headless lab boxes can't observe primary vs exclusive). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 00:18:46 +00:00
enricobuehler	60816709c4	fix(vdisplay): call life.acquire() outside debug_assert (release no-op) ... The pooled entry's lifecycle transition was inside debug_assert_eq!, whose arguments don't evaluate in release builds — so acquire() never ran, the entry stayed Idle, and release saw Noop → immediate teardown (no keep-alive). Caught on-glass on the CachyOS box. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 23:45:36 +00:00
enricobuehler	783c52dfad	feat(vdisplay): Linux keep-alive pool — registry-owned display lifecycle (Stage 1b) ... The ownership split (design/display-management.md §3): the registry owns the per-session virtual-display lifecycle on Linux, so a display can outlive its session (keep-alive) and be reused on reconnect. - registry.rs: a Linux pool driven by the pure lifecycle machine. acquire() reuses a kept (lingering/pinned) display of the same backend+mode, else creates one and keeps the backend's keepalive so the compositor output (and its PipeWire node_id) survives the session. The session's capturer holds a gen-stamped DisplayLease instead of the real keepalive; its drop drives linger/teardown. Enabling fact: KWin/Mutter/gamescope put their node on the DEFAULT PipeWire daemon (remote_fd=None) — reconnect re-attaches by node_id, no fd re-open. wlroots (remote_fd=Some, xdpw portal) passes through unchanged (teardown-on-drop) pending the fresh-portal-capture re-attach. - Default (unconfigured) linger = Immediate → today's teardown-on-disconnect, so no behavior change without a keep-alive policy; concurrent sessions still each create their own output (reuse only matches LINGERING entries). - Wired build_pipeline (punktfunk1) + gamestream through registry::acquire; capture_virtual_output signature unchanged. Windows delegates to vd.create (the manager already leases) — unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 23:37:21 +00:00
enricobuehler	2dd17dda80	test(mgmt): display state/release endpoint smoke test ... Covers the idle path (empty /display/state + released:0 /display/release) on a unit-test host, exercising the wiring + auth without touching any global owner. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 21:27:52 +00:00
enricobuehler	87f0ce7997	feat(vdisplay): lifecycle state machine + display state/release API (Stage 1) ... Stage 1 of design/display-management.md — the lifecycle core + the display management surface: - vdisplay/lifecycle.rs: pure per-slot state machine (Idle/Active{refs}/ Lingering{until}/Pinned) with acquire/release/expiry/force-release transitions. No I/O, no OS types — the platform-neutral distillation of the Windows manager's model. Unit + a 200k-iteration seeded property walk (no leaks / double-frees / refcount underflow across arbitrary interleavings). - vdisplay/registry.rs: neutral snapshot/release facade over the per-OS lifecycle owners. Windows reads/controls the VirtualDisplayManager; Linux keep-alive (a per-session pool) lands in a following increment (needs GPU-box validation). - windows/manager.rs: additive snapshot() + force_release() (no behavior change to the on-glass-validated path). - mgmt: GET /api/v1/display/state (live/kept displays) + POST /api/v1/display/release (tear down lingering/pinned now; refuses active). OpenAPI regenerated. - web console: Virtual displays card gains a live-display list (polled) with per-row + release-all buttons and a linger countdown. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 20:32:03 +00:00
enricobuehler	bbd98241e4	feat(vdisplay): display-management policy surface (Stage 0) ... A user-configurable policy layer above the per-compositor VirtualDisplay backends: keep-alive, topology, conflict, identity, layout, max-displays — persisted to display-settings.json, editable from the web console, applied per connect. Design: design/display-management.md. Stage 0 stands up the surface and wires the two behaviors the existing code can already express — the Windows monitor linger duration and the "make the streamed output the sole desktop" topology — through it; every other option is stored + echoed but not yet enforced (later stages). An unconfigured host (no display-settings.json) keeps today's exact behavior. - vdisplay/policy.rs: pure DisplayPolicy + 5 presets + JSON store (gpu-settings pattern) + EffectivePolicy; 9 unit tests. - vdisplay.rs: resolve_topology(Auto); apply_session_env drives *_VIRTUAL_PRIMARY from the policy only when a settings file exists. - windows/manager.rs: linger_ms() + should_isolate() read the policy when configured. - mgmt: GET/PUT /api/v1/display/settings (bearer-only); PUT rejects keep_alive forever until the lifecycle stage. OpenAPI regenerated. - web console: Host → Virtual displays card (preset picker + custom fields); en+de. - docs-site: virtual-displays.md + configuration.md cross-links. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 19:44:18 +00:00
enricobuehler	7930d2f0f4	fix(core): split WIRE_VERSION from ABI_VERSION — new clients locked out of every deployed host ... ABI_VERSION was doing double duty: the embeddable C surface AND the punktfunk/1 Hello/Welcome version that hosts equality-check. The WoL feature's v3 bump added a client-local FFI function without changing a single wire byte — and every new client started refusing against every deployed host ("ABI mismatch: client 3 host 2", observed live Deck → Bazzite). The wire now carries its own WIRE_VERSION (still 2); ABI_VERSION stays 3 for the C header and the mgmt API's informational field. Bump WIRE_VERSION only when the handshake/planes actually change incompatibly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 14:29:33 +00:00