100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehlerandClaude Fable 5	75474dcc90	fix(pyrowave): guard 4:4:4 modes that overflow the rate controller's block index ... The vendored rate controller packs its wavelet block index into 16 bits (RDOperation.block_offset_saving), so a mode whose 32x32-block count exceeds u16::MAX wraps inside the controller and corrupts the bitstream — ~8K-class 4:4:4 territory. Compute the exact count (`block_count_32x32`, the counting walk of upstream init_block_meta, pinned against the validated Apple WaveletLayout) and expose `pyrowave_mode_fits_rdo`; the negotiator downgrades such a session to 4:2:0 before the Welcome (the honest-downgrade channel), and both encoders refuse outright if one slips through rather than emit a wrapped stream. Vendor patches: 0002-rdo-saving-clamp (analyze_rate_control.comp clamps the saving accumulation to the target, same overrun class as 0001; slangmosh.hpp regenerated), 0003-devel-encode-16bit-read (devel tool y4m 16-bit plane reads; tool-only, kept so the vendored source stays honest). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 01:16:51 +02:00
enricobuehlerandClaude Fable 5	ac0e73321c	perf(pyrowave): elevated GPU scheduling + global-priority encode queue ... PyroWave's wavelet encode runs on the GPU's compute/shader cores, so a GPU-bound game starves it: submit spikes from ~2 ms to ~15 ms under a 95%+ game load and the stream fps collapses. NVENC is immune (separate encoder ASIC). Two levers to let the encode get scheduled ahead of the game's rendering: - Windows process GPU scheduling: D3DKMTSetProcessSchedulingPriorityClass, env PUNKTFUNK_GPU_PRIORITY = off|above-normal|high (default)|realtime. Best-effort, once per process, non-fatal on refusal (enc/windows/pyrowave.rs). - Global-priority Vulkan encode queue (Granite patch 0005): request a VK_KHR_global_priority queue (PYROWAVE_QUEUE_PRIORITY = off|high|realtime, default realtime), downgrading REALTIME→HIGH→none on NOT_PERMITTED so a refused class never regresses the encoder to HEVC. HONEST STATUS: on an RTX 4090 / Windows / WDDM neither moved the ~15 ms spikes — the graphics-vs-compute preemption granularity is the wall, not the priority level. Kept because both are correct, harmless (graceful fallback), and may help other GPUs/drivers. For a GPU-saturated game the working levers are reducing the encode's GPU cost (4:2:0/8-bit) or H.265; PyroWave holds full rate on the desktop and in games that leave the GPU headroom. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 01:02:01 +02:00
enricobuehlerandClaude Fable 5	dc20e4452e	fix(pyrowave): anchor frame-driven pacing to arrival, hold full framerate ... The frame-driven capture loop set its rate-limit floor (`earliest`) relative to `next`, which is re-based to the instant AFTER submit(). For an async encoder (NVENC) submit() returns in ~0, so that anchor is ~frame-arrival and the loop correctly waits for the next vsync — full framerate. But PyroWave's encode is SYNCHRONOUS (~2 ms inline in submit()), so the anchor lands ~2 ms late every frame: the loop misses the next arrival and samples one interval behind, making the period `interval + encode`. That capped a 240 Hz source at ~158 fps (and a 360 Hz request at ~200) with the link and the encoder both idle — no drops. Anchor the floor to this frame's arrival (`t_cap`) instead. The synchronous encode now overlaps the interval rather than stacking onto it; the ≥0.9×interval spacing from the last grab still caps the rate at ~1.11× target. No-op for async NVENC (t_cap ≈ post-submit there), which is why H.26x already held full rate. Measured on-glass (5120x1440@240, RTX 4090 host, macOS client): desktop now holds 240 fps. Also reduces latency (samples fresher frames). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 01:01:59 +02:00
enricobuehlerandClaude Opus 4.8	017b083e32	feat(library): serve provider entries' local art via the host art proxy ... A provider plugin that runs on the host (e.g. the Playnite sync plugin) can now reconcile cover art as an on-host FILE PATH instead of an inlined data URL. `GET /library` rewrites such local-file art into `/library/art/<id>/ <kind>` proxy URLs (the same relative-proxy shape Steam art already uses), and the art proxy serves the bytes from the stored path. Moonlight's /appasset proxy reads the local file too. This is what lets a large Playnite library sync with covers: the reconcile payload carries paths, not bytes, so it no longer blows past the mgmt API's request-body limit and scales to thousands of titles. Cross-platform; local-path detection is Windows-shaped (Playnite is Windows-only). Unit-tested (compiles + 5/5 art tests on Linux). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-19 00:53:40 +02:00
enricobuehlerandClaude Opus 4.8	e5eec51a78	docs(pyrowave): document 4:4:4 + HDR and add an interactive bitrate calculator ... - New "4:4:4 and HDR" section: what each mode buys, the ~1.6× / +15% bitrate cost, that HDR needs a Windows host today (Linux capture has no HDR source), and that the two combine (~1.9× the 4:2:0 SDR rate). - Interactive <BitrateCalculator> (registered in the MDX components map): resolution (presets or custom), frame rate, 4:2:0/4:4:4, SDR/HDR -> the estimated Automatic pin, bits/pixel, per-frame size, and which link tier it needs. Formula mirrors the host's resolve_bitrate_kbps_for exactly. - Expanded the bandwidth table with 120 Hz rows; note the big modes want 5/10 GbE. - Document PUNKTFUNK_PYROWAVE_MAX_MBPS (cap the open-loop pin on a constrained link) in configuration.md. - pyrowave.md -> .mdx so the page can host the component. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 19:28:28 +02:00
enricobuehlerandClaude Opus 4.8	9fe9c451dc	perf(pyrowave): pool encoder scratch buffers + fix client parser O(n²) — lift the 2.5 Gbps wall ... Real-world PyroWave streaming maxed ~2.5 Gbps with sagging fps while raw transport does 4.8. Root-caused to serial per-frame paths at BOTH ends (the transport was never the limit); this fixes the two dominant ones. Host (vendored shim, patch 0004): pyrowave_encoder_encode_gpu_synchronous allocated four Vulkan buffers (meta + bitstream, Device + CachedHost) on EVERY frame. At 240 fps with MB-scale bitstreams that per-frame allocator churn stalled the encode itself. Pool them on the encoder and reuse across frames (recreate only on a size grow); the sizes are session-fixed, so it is pure reuse after frame 1. On an RTX 4090 the 5120x1440 submit+fence-wait drops ~15 ms -> ~1 ms, i.e. the host serial ceiling goes 64 -> 1025 fps (444+HDR 44 -> 614). Safe under the synchronous encode model; re-validated by pyrowave_win_smoke (Windows) and pyrowave_smoke/_444 (Linux). Applies to both host encoder paths (they share the shim). Client (Apple Metal decoder): WaveletBitstream.parse reserved the payload buffer per packet (reserveCapacity(count + words), an exact realloc each of ~3000 packets/frame => O(n²)) and copied word-by-word. Reserve once up front and memcpy each packet's coefficients in one shot (all Apple platforms are little-endian, so the wire's LE u32s land verbatim; memcpy is alignment-free). 5.44 ms -> 0.055 ms per 1.44 MB frame (25x); byte-identical (parser unit tests + golden-frame PSNR unchanged). Also: - native.rs: PUNKTFUNK_PYROWAVE_MAX_MBPS caps PyroWave's open-loop Automatic bitrate pin for hosts on a constrained link (unset => no cap; an explicit client rate bypasses it). The pin is all-intra + ABR-off, so at a high pixel rate it can outrun the fabric (4:4:4+HDR 5120x1440@240 pins ~5.3 Gbps, over a 5 GbE link) and the overshoot just becomes loss. - pf-encode caps(): report the real opened chroma instead of a hardcoded 4:2:0 default, so a genuine 4:4:4 session no longer trips the spurious "encoder chroma disagrees with the negotiated Welcome" warn. Also fix a latent Windows reset() that rebuilt at 4:2:0 for a 4:4:4 session. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 19:09:23 +02:00
enricobuehlerandClaude Opus 4.8	b89dbfa979	feat(gamescope): end dedicated stream on Steam game exit + auto --steam ... Dedicated single-game sessions now end cleanly when the launched game quits, and Steam launches get gamescope's Steam integration without an operator env knob. End-on-exit: the existing APP_EXITED close only fired when gamescope's PipeWire node vanished, which never happens for Steam — the nested `steam` is the resident singleton client and stays up after a game quits, so gamescope (and its node) never die and the stream sat on a hidden Steam session forever. Add a Steam AppId reaper watcher (pf-vdisplay .../gamescope/discovery.rs): steam_appid_from_launch() parses steam://rungameid/<id>; wait_for_steam_game_exit() waits for the game to start (<=300s grace) then exit (3s confirm); steam_game_running() scans same-uid /proc for Steam's launch reaper matching both the `SteamLaunch` and `AppId=<id>` argv tokens (exact-match; reaper lifetime == game lifetime, so shader precompile can't false-trigger). The host spawns a pf1-gamewatch thread for nested Steam launches that closes the connection with APP_EXITED (launcher clients return to their library) and sets quit/stop; cancelled via stop if the session ends first. Non-Steam nested launches keep the node-death path (gamescope's child IS the game). Flags: auto-enable `--steam` whenever the launch is a Steam launch (was only the global PUNKTFUNK_GAMESCOPE_STEAM knob, default-off) — in-game overlay / Steam+X / gamepad-UI nav for Steam titles with no operator config. New opt-in PUNKTFUNK_GAMESCOPE_GRAB_CURSOR adds `--force-grab-cursor` for a real game launch (FPS mouselook); default OFF because it forces relative mode, which breaks absolute-pointer games/menus. Verified: fmt clean; clippy -D warnings clean on the three crates; pf-vdisplay 64/0 (incl. new steam-appid parse test); punktfunk-host builds + 186/0; reaper /proc detection smoke-tested (detect, exact non-match, gone-after-exit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 16:24:34 +02:00
enricobuehlerandClaude Opus 4.8	770994b7aa	fix(web): tighten mobile padding so content isn't too narrow ... The main content wrapper used p-6 (24px) on mobile while the mobile top bar uses px-4 (16px) — an inconsistent, oversized side gutter that ate into the usable width on phones. Drop it to a 16px side gutter (px-4) on mobile, matching the top bar; sm+ padding is unchanged. Also make the shared Card padding responsive (p-4 on mobile → p-6 from sm up) so card content isn't double-inset on small screens. Desktop layout is identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 13:50:14 +02:00
enricobuehlerandClaude Fable 5	3ff1973d7f	feat(pyrowave): Apple Metal 4:4:4 + HDR decode, EDR present — self-configured in-band ... Phases 4+5 of design/pyrowave-444-hdr.md. The Metal decoder needs NO new ABI: every frame's sequence header carries chroma (444) and, since the Phase-3 stamps, the PQ/BT.2020 bits — so the decoder self-configures per session. Decoder: WaveletLayout grows the 4:4:4 block space (chroma runs the full pyramid like luma — no level-0 skip, no early half-res emit; the Metal kernels were already chroma-agnostic, only the dispatch structure changes); the parser accepts chroma_resolution=444, reads the PQ transfer bit, and lifts the even-dims rule for 444; the plane ring allocates full-res chroma and r16Unorm for PQ streams; CSC rows switch to depth-10 MSB-packed. Presenter: planar HDR passthrough reuses pf_frag_planar on an rgba16Float drawable (itur_2100_PQ + EDR metadata interpret the samples — same split as pf_frag/pf_frag_hdr), plus a new pf_frag_planar_tm PQ->SDR tone-map (shared pqToSdr tail refactored out of pf_frag_hdr_tv) for tvOS-without-headroom AND macOS WINDOWED sessions, whose IOSurface present path (the DCP-panic mitigation) is BGRA8-only. SessionModel stops stripping the HDR/10-bit/444 caps on the PyroWave opt-in. New golden: au-dense444 + upstream's own 4:4:4 reference planes (regenerated via the extended pyrowave_dump_golden); Metal decode matches at 64-67 dB (420 fixtures re-verify 77-88 dB). Full Apple suite 157 tests green on a real M-series GPU. Docs updated: the 8-bit-SDR-only wording is gone, the Windows host is no longer 'on the roadmap', bpp scaling documented. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 13:21:23 +02:00
enricobuehlerandClaude Fable 5	188edde2b3	feat(pyrowave): Windows host HDR + 4:4:4, Rust client HDR present ... Phase 3 of design/pyrowave-444-hdr.md. A PyroWave session now negotiates HDR (10-bit) and 4:4:4 on a Windows host exactly like HEVC/AV1, and the Linux client presents it through the real HDR10 path. Host (Windows): BgraToYuvPlanes becomes mode-aware — SDR/BGRA and HDR/scRGB variants at half- or full-res chroma. The HDR passes reuse HdrP010Converter's exact colour math (scRGB -> PQ BT.2020 limited studio codes, verified by hdr_p010_selftest) but write P010-style MSB-packed codes into two separate shareable R16_UNORM/R16G16_UNORM textures; chroma keeps the pyrowave family's centre-sited 2x2 box. idd_push pins the composition to the NEGOTIATED depth (SDR sessions force advanced color off as before; 10-bit sessions enable it and ride the FP16 ring), and the descriptor poller re-asserts that state instead of following display flips the fixed-format encoder can't. The encoder imports 8/16-bit planes per session and stamps the sequence header's BT.2020/PQ/matrix bits on HDR (stamp_color_bits, extending 574e3e4e's range stamp); supports_10bit/can_encode_10bit/can_encode_444 gates open (HDR Windows-only — Linux capture has no HDR source). Client: the plane ring becomes R16_UNORM for 10-bit sessions (with a STORAGE_IMAGE format probe), the planar CSC pass joins the HDR10 swapchain rebuild (set_hdr_mode previously destroyed it without rebuilding — latent), st.hdr follows frame.color.is_pq(), and the planar push constants carry depth-10 MSB-packed rows + the PQ tonemap mode, identical to the NV12 arm. Verified: .173 (RTX 4090) deploy-config clippy + fmt + wire tests + the extended pyrowave_win_smoke (10-case {SDR,HDR}x{420,444} matrix incl. R16 imports and header stamps); .21 (RTX 5070 Ti) clippy across 4 crates, host 186 tests, client/presenter/encode tests, both Linux GPU smokes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 13:21:06 +02:00
enricobuehlerandClaude Fable 5	4861824e7d	feat(pyrowave): Linux 4:4:4 encode — per-pixel CSC, full-res chroma, gate open ... Phase 2 of design/pyrowave-444-hdr.md. can_encode_444(PyroWave) now returns true on Linux, so a client that advertises VIDEO_CAP_444 (the 4:4:4 setting) and prefers PyroWave negotiates a full-chroma wavelet session end to end (the client decoder side landed in 5eb930e7). - rgb2yuv444.comp: the 4:4:4 twin of rgb2yuv.comp — one invocation per pixel, full-res interleaved RG8 CbCr, no box filter/siting, byte-identical BT.709 limited coefficients; compiled .spv committed (glslangValidator -V, matches the existing shader's toolchain). - Encoder: chroma-conditional pyrowave create (open + reset), full-res chroma plane + views, per-pixel dispatch, 4:2:0-only even-dims check. - Tests: decode oracle grows a 4:4:4 mode (YUV444P CPU readback); pyrowave_smoke_444 round-trips plane means AND drives the busy test card at the ~2.6 bpp operating point asserting in-budget + run-to-run deterministic AU sizes — the exact regime that silently corrupted before the vendored payload_data fix (patches/0001), so this doubles as its regression test. Verified on .21 (RTX 5070 Ti): clippy -D warnings, host tests, and both GPU smokes (pyrowave_smoke + pyrowave_smoke_444) green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 12:43:34 +02:00
enricobuehlerandClaude Fable 5	5eb930e71d	feat(pyrowave): negotiation plumbing for 4:4:4 + HDR — thread chroma/depth/ColorInfo end to end ... Phase 1 of design/pyrowave-444-hdr.md. No behavior change yet: the handshake's 4:4:4 gate now admits PyroWave (probe = can_encode_444(codec), capture gate inherently satisfied — the wavelet path always ingests an RGB source and does its own CSC), but can_encode_444 stays false for PyroWave until the per-OS full-res-chroma CSC variants land (Phase 2 Linux, Phase 3 Windows), so every session still resolves 4:2:0/8-bit. - Both host encoders take the negotiated ChromaFormat (bail on 444 for now); the PUNKTFUNK_ENCODER=pyrowave lab override pins 4:2:0. - Bitrate: the automatic ~1.6 bpp pin resolves AFTER depth+chroma and scales x1.625 for 4:4:4 / x1.15 for 10-bit (factors from the Phase-0 fixture matrix); the mid-stream mode-switch re-resolve threads the session's values. - Client: PyroWaveDecoder builds its plane ring (full-res chroma when 444) and creates the upstream decoder from the negotiated chroma, keeps chroma fixed across mid-stream resizes, drops the even-dims requirement for 444, and returns the negotiated Welcome ColorInfo as the frame colour contract instead of hardcoded BT.709 (the wavelet bitstream has no VUI). Verified on .21 (RTX 5070 Ti): clippy -D warnings (host+client+encode), host 186 tests, client + pf-encode tests, fmt, and the pyrowave_smoke GPU round-trip through the patched vendored lib (97cf15e3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 12:37:12 +02:00
enricobuehlerandClaude Fable 5	97cf15e3b7	fix(pyrowave-sys): vendor patch — size the encoder's payload_data staging for 4:4:4 ... Upstream sizes the raw quantized-payload worst-case buffer at aligned_width*aligned_height*2 bytes: real headroom for 4:2:0's 1.5 samples/px, but half of what 4:4:4's 3 samples/px can produce. Busy 4:4:4 content overruns the buffer on the GPU and corrupts the adjacent meta/bucket suballocations — nondeterministic corrupt bitstreams and encoder crashes at ANY target bitrate (smooth content never trips it, which is why 4:2:0 and simple 4:4:4 both look fine). Found by the Phase-0 measurement matrix for design/pyrowave-444-hdr.md; fix validated alone via upstream's own devel tools on the RTX 5070 Ti: deterministic byte-identical outputs across runs, 1080p + 4K, 8- and 16-bit, PSNR at the expected operating points. Patch lives in crates/pyrowave-sys/patches/ and vendor-pyrowave.sh now re-applies patches on re-vendor; PUNKTFUNK-VENDOR.txt records it. Upstream report to follow. No wire/ABI change; 4:2:0 sizing unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 12:16:56 +02:00
enricobuehlerandClaude Opus 4.8	94533bb071	feat(scripting): discover scoped @punktfunk/plugin-* packages ... The runner only found unscoped `punktfunk-plugin-*` packages. An unscoped package can't be split across registries, which forced plugins to bundle their own copy of @punktfunk/host + effect (the plugin's Gitea registry has no `effect`; `--registry <gitea>` 404s it). Discovering the scoped `@punktfunk/plugin-*` convention lets a plugin resolve cleanly from one scope map and depend on @punktfunk/host + effect as SHARED (hoisted) deps instead of bundling — no per-plugin duplication. Additive: unscoped names still work. Bumps @punktfunk/host to 0.1.1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 12:12:11 +02:00
enricobuehlerandClaude Fable 5	f407f41855	fix(apple): present windowed macOS PyroWave via IOSurface layer contents — swapID panic survives glass pacing ... The DCP "mismatched swapID's" kernel panic reproduced on a 240 Hz Mac Studio with stage-3 glass pacing active: a fully serialized, one-in-flight present stream still races WindowServer's own swap submissions. So the mitigation has to change the MECHANISM, not the rate — the CAMetalLayer image queue itself is the racing path in a composited (windowed) session. Windowed PyroWave now presents the way video players do: the planar CSC renders into a pooled IOSurface (4 × BGRA8, in-use-aware LRU reuse) and the render thread hands it to a plain CALayer's `contents` on main inside an ordinary CATransaction. WindowServer treats that as normal layer damage on its own composite cadence — no out-of-band image-queue swaps to race. Fullscreen keeps the CAMetalLayer path (direct scanout, no compositing, no panic reports); the hosting view pushes the window's composited state on every layout, and flipping modes just covers/uncovers the metal layer (no black flash). VT codecs keep the metal path everywhere: no panic reports there, and their HDR/EDR presentation has no surface-contents equivalent wired. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 11:51:31 +02:00
enricobuehlerandClaude Opus 4.8	574e3e4e3f	fix(pyrowave): signal ycbcr_range=LIMITED in the sequence header ... pyrowave's encoder fills the BitstreamSequenceHeader with `= {}` and its C API offers no way to set colour/range, so it signals ycbcr_range=0=FULL — but both host CSCs (rgb2yuv.comp on Linux, BgraToYuvPlanes on Windows) always emit BT.709 LIMITED Y'CbCr (black = Y'16). A client that honours the VUI (the Apple wavelet decoder reads bit 30 of word1) then skips the limited→full expansion and shows washed-out, raised blacks — reported on both Linux and Windows hosts. Patch the range bit HONEST (mark_limited_range in the shared pyrowave_wire, called by both encoders after packetize). Clients that hardcode limited (the Vulkan video_pyrowave path) are unaffected, and pyrowave's own decode ignores the flag (raw Y'CbCr reconstruction). No client rebuild needed. Unit-tested + asserted in pyrowave_win_smoke; the smoke decode still round-trips 100/180/60. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 11:39:44 +02:00
enricobuehlerandClaude Opus 4.8	ebd9967547	feat(pyrowave): Windows host encoder — separate-plane zero-copy D3D11→Vulkan ... Wire PyroWave into the Windows host (design/pyrowave-windows-host-zerocopy.md). Before this a macOS client + Windows host that both selected PyroWave silently ran HEVC: the host never advertised CODEC_PYROWAVE and open_video_backend bailed. Approach (zero-copy, no GPU→CPU→GPU): pyrowave owns its own Vulkan device (create_device_by_compat, by render-GPU vendor/device-id — NOT LUID, invalid in Session 0). The capturer runs a BGRA→YUV BT.709-limited CSC (matching rgb2yuv.comp) into TWO SEPARATE shareable plane textures — full-res R8 Y + half-res R8G8 CbCr — which the encoder imports into pyrowave's device. Separate single/two-component textures import reliably on NVIDIA at any size; a single planar NV12 import does NOT (the vendored interop test: "only very specific resource sizes" — confirmed on-glass: 1024² fine, 720p/1080p/1440p garbage). A shared D3D11 fence, signalled after the CSC, is imported as a Vulkan timeline semaphore so the wavelet read is ordered after it. - pf-encode: enc/windows/pyrowave.rs (Encoder impl, two-plane import + Linux-style plane views); host_wire_caps advertises CODEC_PYROWAVE on Windows when the backend isn't Software; open_video_backend routes a negotiated PyroWave session first; pyrowave-sys on the Windows target; interop confirmed at open → clean HEVC fallback. - pf-encode: shared, unit-tested enc/pyrowave_wire.rs (single source of truth for the client-facing AU framing); Linux encoder uses it too. - pf-capture: dxgi.rs BgraToYuvPlanes CSC; idd_push.rs pyrowave mode — forces the virtual display SDR (the VideoProcessor can't ingest the FP16 HDR ring), a two-plane shareable out-ring, a shared fence passed every frame (so a rebuilt encoder re-imports it). Threaded via OutputFormat::pyrowave. - pf-frame: D3d11Frame::pyro carries the CbCr plane + fence; OutputFormat::pyrowave. Verified on .173 (RTX 4090): full-host build + clippy -D warnings (nvenc,amf-qsv) + fmt --all --check; pyrowave_wire unit tests; pyrowave_win_smoke GPU test round-trips distinct Y/Cb/Cr (100/180/60) exactly at 1024²/720p/1080p/1440p; Stage-0 interop validated in the real Session-0 service context on-glass. Deployed to the box. Owed: final on-glass picture/latency confirmation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 11:39:44 +02:00
enricobuehlerandClaude Opus 4.8	1e7c18b2c8	fix(packaging): install punktfunk-host on Ubuntu 24.04 LTS via a noble builder that bundles FFmpeg 8 ... The host .deb was built on the Ubuntu 26.04 rust-ci image, so dpkg-shlibdeps baked in `Depends: libavcodec62` (FFmpeg 8) and a glibc-2.41 floor — making it uninstallable on Ubuntu 24.04 LTS (FFmpeg 6.1 / libavcodec60, glibc 2.39; apt reports the deps as "too recent"). The source floor (ffmpeg-next 8, libavcodec >=61 APIs) means a straight 24.04 rebuild would fail too. Build the host on Ubuntu 24.04 instead — lowering the glibc floor to 2.39 so one binary runs on 24.04 -> 26.04 — and bundle a from-source LGPL FFmpeg 8 into the package so it no longer depends on the distro libav*. Everything else the host links is soname-compatible on 24.04 (opus is vendored via cmake; NVENC/libcuda are dlopen-only, never link-time), and the only FFmpeg encoders used are *_nvenc / *_vaapi (software H.264 fallback is the BSD-2 openh264 crate, not FFmpeg libx264), so an LGPL build keeps the bundle license-clean. - ci/rust-ci-noble.Dockerfile (new): ubuntu:24.04 builder; nv-codec-headers + FFmpeg 8 (--enable-nvenc --enable-vaapi, shared) -> /opt/ffmpeg; PKG_CONFIG_PATH. - packaging/debian/build-deb.sh: BUNDLE_FFMPEG=1 copies libav*/libsw*/libpostproc into /usr/lib/punktfunk-host, patchelf-sets the rpath ($ORIGIN per-lib + binary --force-rpath), feeds them to dpkg-shlibdeps (captures libva2/libdrm2), and drops the libav* sonames from Depends. Normal (non-bundle) path unchanged. - .gitea/workflows/deb.yml: split into build-publish (client/web/scripting on the 26.04 image) and build-publish-host (noble image, BUNDLE_FFMPEG=1); parallel, identical version step, same apt distribution -> one universal host .deb. - .gitea/workflows/docker.yml: build+push punktfunk-rust-ci-noble. - packaging/debian/README.md: document the 24.04 LTS path + bundled local build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 11:30:19 +02:00
enricobuehlerandClaude Fable 5	9aebc3f251	fix(apple): default macOS PyroWave sessions to glass-gated present pacing — DCP swapID kernel-panic mitigation ... Windowed PyroWave sessions were kernel-panicking Macs ("mismatched swapID's" @UnifiedPipeline.cpp, WindowServer → AppleMobileDisp*-DCP). The panic is an Apple DCP bug (SketchUp/Unity/240Hz-monitor reports hit the same signature), but our stage-2 arrival pacing feeds the trigger pattern: displaySyncEnabled=false out-of-band presents arriving faster than the compositor latches them in a composited (windowed) session. PyroWave makes that pattern routine — near-instant Metal wavelet decode turns network clumps into same-millisecond present bursts, and it is the codec that sustains stream rates above panel refresh. Mitigation: PyroWave sessions on macOS now default to the stage-3 PresentGate (one presented-but-undisplayed swap in flight, serialized on the on-glass callback, 100 ms stale backstop) — the racing pattern cannot occur. Explicit stage2/stage3 picks (setting or PUNKTFUNK_PRESENTER) still win, so the arrival-pacing A/B stays honest. VideoToolbox codecs keep arrival pacing (decode latency spaces their presents; no panic reports there). PresenterChoice gains an `explicit` resolver (nil = no user selection) so the codec-conditional default only applies when the user hasn't picked a stage; pacing selection is a testable helper carrying the rationale. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 11:17:48 +02:00
enricobuehlerandClaude Opus 4.8	7f639f7cf5	docs: link every client in the clients-page chooser + correctness sweep ... The "Which should I use?" table on the clients page listed most client names as bold text, not links — only the Decky plugin and pf-webos were clickable — so the client references appeared broken. Link each client to its section (or dedicated page), and fix a stale Windows headless command. Repo-wide docs correctness/staleness pass against the code: - steam-deck: client-not-found -> flatpak-not-found (the real backend code) - install: host cert is punktfunk-host-windows_<ver>.cer, not ..._setup.cer - configuration: GPU_PRIORITY_CLASS default is auto; 10BIT/444 are default-on - how-it-works/index: GameStream/Moonlight is opt-in (--gamestream) - roadmap: clipboard sync is shipped, not planned - install-client: MSIX/cert artifacts are arch-suffixed (_x64/_arm64) - requirements: fix garbled 22H2/IddCx sentence - status: Linux encode also covers AMD/Intel (VAAPI/Vulkan Video) - automation: add the plugins.changed event - windows-host: note the optional bundled VB-CABLE virtual mic - sway: PUNKTFUNK_COMPOSITOR=hyprland is a wlroots-family alias - running-as-a-service: punktfunk-probe is a source-build-only dev tool Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 09:50:29 +02:00
enricobuehlerandClaude Opus 4.8	2c0aee3979	chore(plugins): regenerate OpenAPI spec + SDK client for /api/v1/plugins ... Regenerated api/openapi.json (host built on Linux) with the plugins tag — registerPlugin/listPlugins/deregisterPlugin/getPluginUiCredential + the PluginRegistration/PluginSummary/PluginUi/PluginUiPublic/UiCredential schemas — and the SDK's generated client. Drift test + 44 mgmt/events host tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 09:48:37 +02:00
enricobuehlerandClaude Opus 4.8	ec84b30eae	feat(plugins): console-hosted plugin UI surface (host registry + SDK servePluginUi + console proxy/nav) ... Implements planning/design/plugin-ui-surface.md (U1-U3): - host: in-memory lease-based plugin registry (mgmt/plugins.rs) — PUT/GET/DELETE /api/v1/plugins + GET /plugins/{id}/ui-credential; bearer+loopback only (not on the mTLS read-only allowlist); plugins.changed event; port-only registration (proxy always dials 127.0.0.1); secret never in the listing. - sdk: servePluginUi — loopback ephemeral bind + per-boot secret + constant-time check + /__health + static/SPA-fallback + register/renew(30s)/deregister via pf.request (skew-proof, D7). Example + tests. - console: /plugin-ui/{id}/** reverse proxy (server-side secret injection, cookie strip, SSE streaming, stale-secret 401-retry) + credential cache; BFF denylist for the credential endpoint; dynamic Plugins nav (desktop + mobile) fed by a polled list; iframe-in-shell page with health probe, offline card, open-in-tab, deep-link sync. Dev-mode /plugin-ui middleware in vite.config.ts. OpenAPI regen for the new endpoints follows in the next commit (built on Linux). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 09:48:37 +02:00
enricobuehlerandClaude Opus 4.8	d579cd318e	ci(windows-host): lint host + tray in --release so clippy reuses the release build ... The clippy step ran in the default (debug) profile, compiling the whole dep tree into a second target dir (C:\t\debug) — a second full build of openh264-sys2's vendored C++ (pf-encode's software-H.264 fallback) on top of the release copy the Build steps already produced. That second cc-rs cl.exe fan-out tips the self-hosted runner into `cabac_decoder.cpp: fatal error C1069 (cannot read compiler command line)` — environmental disk/temp exhaustion, not a source error: the identical file compiles fine in the release build minutes earlier, and openh264 is untouched here. Linting in --release reuses the release build-script artifacts (no openh264 rebuild) and keeps everything in one C:\t\release tree. Matches pf-vkhdr-layer's clippy, which already runs --release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 02:12:43 +02:00
enricobuehlerandClaude Opus 4.8	bb755ef7d2	fix(gamestream): generate the RSA host identity via the rsa crate, not rcgen (ring can't RSA-keygen) ... The workspace went ring-only in 0.13.0 (aws-lc-sys breaks Windows CI), and `ring` can sign with an existing RSA key but cannot *generate* one — rcgen's ring backend returns `KeyGenerationUnavailable` for `generate_for(&PKCS_RSA_SHA256)`. So `ServerIdentity::{load_or_create, ephemeral}` panics with "rcgen RSA keygen / There is no support for generating keys for the given algorithm" on any host without an existing `cert.pem`. This is the shared trust root for both the GameStream TLS cert and the QUIC identity clients pin, so a *fresh* 0.13.0 install can't start the host at all (existing dev boxes survive only because they already have a cert on disk); in CI every test that builds a `ServerIdentity` (all of `mgmt::tests`, `gamestream::nvhttp`, and the `native::tests` synthetic host via `serve()`) failed — 30 failures from this one cause. Moonlight requires an RSA-2048 identity, so generate the key with the pure-Rust `rsa` crate (already a dependency for the pairing signer) and hand its PKCS#8 PEM to rcgen, whose ring backend *can* load and self-sign with an externally supplied RSA key (`from_pkcs8_pem_and_sign_algo` → `RsaKeyPair::from_pkcs8`). Return that same PEM so it stays byte-identical to what `from_pems` re-parses. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 01:59:28 +02:00
enricobuehlerandClaude Opus 4.8	08a397cf08	fix(transport): treat Windows WSAENOBUFS as a transient send drop, not a stream teardown ... `is_transient_io` only recognized `ENOBUFS` on unix; on Windows the `#[cfg(not(unix))]` arm returned `false`, so `WSAENOBUFS` (10055) — which Rust maps to `ErrorKind::Uncategorized`, missing the `WouldBlock` arm — propagated out of the USO `send_gso` path through `Session::send_sealed` and killed the session with `native::stream` "send failed — stopping stream". A high-bitrate keyframe burst (one `WSASendMsg` USO super-buffer is up to ~512 segments) momentarily exhausts the socket send buffer / AFD non-paged pool; it's a lossy drop that FEC + the next frame recover, exactly like the unix `ath11k` `ENOBUFS` case the classifier already handles. Fires independently of client platform (Windows/macOS clients both saw the crash) because it's the Windows *host's* send socket. Add a `#[cfg(windows)]` arm matching `WSAENOBUFS` plus the `WSAENET*`/`WSAEHOST*` network-path family (the Windows counterparts of the droppable unix set), and extend the classifier test with per-platform raw-errno coverage so the Windows CI runner exercises the 10055 path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 01:43:15 +02:00
enricobuehlerandClaude Fable 5	11cca33300	fix(host/hooks): honor hand-edits to hooks.json without a restart ... docs/automation.md promises 'changes apply immediately, no restart' for BOTH config paths, but the store loaded hooks.json once (OnceLock) — only PUT /api/v1/hooks applied live, and a hand-edited file silently did nothing until the next host start. Since the file is the accessible path most users will take, make it real: get() re-stats the file per event (mtime + length) and re-reads it on change, with the same lenient contract as startup (missing = no hooks, invalid = disabled loudly). set() records the identity it wrote so the API path doesn't trigger a spurious reload. Validated live on the 0.13.0 host (.21): full connect/disconnect lifecycle fires exec hooks (client.*/session.*/stream.*) — the reload gap was found setting that test up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 23:53:25 +02:00
enricobuehler	4d2632a845	fix(client/deps): ring-only rustls in pf-client-core — finish dropping aws-lc-sys ... Companion to the host ring fix: pf-client-core declared rustls with features=["ring"] but WITHOUT default-features=false, so rustls's default aws-lc-rs backend came along too (feature tree: aws-lc-rs <- rustls default <- pf-client-core default) — pulling aws-lc-sys 0.41.0 into the Windows client + session + presenter builds, the same C dep that fails on the CI runner. Pin default-features=false + [ring, logging, std, tls12] (matching the tray/host/core pattern). aws-lc-sys now gone from EVERY windows-built crate (host, client-windows, client-session, tray — all 'cargo tree -i aws-lc-sys' => no match). Code already used rustls::crypto::ring::default_provider (library.rs); no behaviour change. Validated: cargo tree (all 4 windows crates aws-lc-free) + .21 clippy -D warnings (pf-client-core, pf-presenter, punktfunk-client-session) clean.	2026-07-17 22:26:04 +02:00
enricobuehler	17a262aace	fix(host/deps): ring-only crypto — drop aws-lc-sys (fails to build on the Windows CI) ... The Windows host clippy CI broke building aws-lc-sys 0.41.0 (a heavy C dep that cl.exe fails to compile on the runner). The host was the ONLY thing pulling it: its rcgen used features=["aws_lc_rs"], and bare `rustls`/`tokio-rustls` take the default (aws-lc-rs) backend, and gamestream/{mod,tls}.rs installed the aws_lc_rs crypto provider explicitly — a pre-existing deviation from the project's documented ring-only design (punktfunk-core + the client are ring). Align the host to ring: rcgen/rustls/tokio-rustls pinned to the `ring` feature (keeping tls12 for Moonlight/GameStream TLS-1.2 clients) and the two GameStream provider installs switched to `rustls::crypto::ring::default_provider()`. Both providers offer the same standard TLS 1.2/1.3 suites, so it's transparent to the TLS paths; aws-lc-sys/aws-lc-rs leave the tree entirely (`cargo tree -i aws-lc-sys` => no match). Not caused by the preceding log fix (that touched no crypto deps / the lock). Validated: cargo tree (aws-lc-sys gone, windows target, amf-qsv,qsv features) + .21 host clippy -D warnings (--features nvenc) clean. Owed: GameStream on-glass re-check with a real Moonlight client (low risk — same TLS suites, client is already ring).	2026-07-17 22:21:23 +02:00
enricobuehlerandClaude Fable 5	205e5c5a59	fix(apple): recover dropped macOS client features lost in the W7/W8 refactor ... The W7/W8 client refactor (extracting FullscreenController/ApprovalRequest out of ContentView, splitting Settings) landed the DefaultsKeys + scaffolding but dropped the feature WIRING, which was uncommitted WIP shelved in a stash during the 16:28 clipboard/v4 reconcile. Recovered from that stash (+ its untracked-files parent for the whole new ModifierLayout.swift) and re-ported onto the refactored tree: - invertScroll: applied in InputCapture.sendScroll (the one scroll sink) + Settings toggle - modifierLayout (Cmd/Option switch): restored ModifierLayout.swift enum + KeyMaps .applyModifierLayout + InputCapture.emitKey wire-boundary + Settings picker - fullscreen shortcut (Ctrl+Cmd+F): InputCapture ⌃⌘F interception + onToggleFullscreen + StreamView wiring + Stream-menu item (the .punktfunkToggleFullscreen sink + FullscreenController observer already survived on main) - render scale: Settings picker + MatchWindowFollower renderScale/maxDimension application + StreamView/StreamViewIOS plumbing (RenderScale.swift already on main) StreamCommands re-ported by hand (the stash hunk deleted the since-landed clipboard item — kept it, added the fullscreen item alongside). Recovered ModifierLayout + RenderScale tests. swift build green; 15 tests pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 22:20:46 +02:00
enricobuehlerandClaude Fable 5	3584b47fb8	fix(host/log): drop the wasapi crate's once-a-second DEBUG device-poll from the logs ... The `wasapi` audio crate polls the default output device ~1×/s and `log::debug!`s it (`wasapi::api default device Ok(...)`), flooding host.log even at RUST_LOG=info: those `log`-crate records reach tracing through the tracing-log bridge, and at *filter* time they carry the bridge's "log" shim target, so neither a bare-info EnvFilter nor a `wasapi=warn` directive on the file layer matches them (the ring already drops them post-hoc via normalized_metadata + NOISY_DEBUG_TARGETS — the fmt layer filters pre-event and can't). Fix at the source: a shared `log_capture::install_global` replaces SubscriberInitExt::init in both init paths (service file log + interactive stderr) and inits the tracing-log bridge with `ignore_crate("wasapi")`, so the poll records are dropped before they ever become tracing events — both sinks go quiet, while every other log-crate dependency still reaches the console ring (bridge max-level stays DEBUG). `wasapi` also added to NOISY_DEBUG_TARGETS as belt-and-suspenders, and `log` moved dev-dep -> dep for LevelFilter. Validated: .21 clippy (host --features nvenc) clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 22:06:14 +02:00
enricobuehlerandClaude Opus 4.8	de651c0f1a	chore(gitignore): ignore Gradle build output in the vendored pyrowave Granite Android platform ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 21:36:49 +02:00
enricobuehlerandClaude Opus 4.8	e7a8cf2bba	feat(packaging): nix web console + plugin/script runner everywhere; fix tray zbus/tokio crash ... Ship the management web console and the plugin/script runner across the packaging matrix, and fix a Linux tray startup crash. - nix: add punktfunk-web (Nitro SSR on bun) and punktfunk-scripting (Effect runner), with services.punktfunk.{web,scripting} modules. Both bun node_modules come from fixed-output derivations pinned to real deps hashes; patchShebangs the web node_modules so orval/paraglide/vite run in the sandbox. Validated on x86_64-linux (nix build .#punktfunk-{web,scripting,tray,host} all green). - punktfunk-scripting now ships for deb/rpm/arch/nix/windows, mirroring the web-console mechanics (vendored bun on deb/rpm/arch, pkgs.bun on nix; one self-contained `bun build --target=bun` bundle). Opt-in: host Recommends it, but the systemd --user unit ships un-started (Windows registers its scheduled task disabled). - fix(tray): build punktfunk-tray in its OWN cargo invocation on nix/rpm/arch. Cargo unifies features across one `cargo build`, so co-building the tray with the host pulls the host's ashpd->zbus/tokio onto the tray's shared zbus and it panics at startup ("there is no reactor running, must be called from the context of a Tokio 1.x runtime"). Isolated, the tray's zbus stays on async-io. The .deb already did this; runtime-verified on nix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 21:16:34 +02:00
enricobuehlerandClaude Opus 4.8	fb92dcd1c2	fix(release): regen managed dev profiles at archive (App Groups + widgets); widgets iOS target 27→17 ... The iOS/tvOS/macOS-AppStore archive steps sign development-automatic OFFLINE (no -allowProvisioningUpdates), so they depend on Xcode's cached managed dev profiles. Adding the App Groups capability (group.io.unom.punktfunk, shared with the Widget/Live-Activity extension) invalidated the cached "iOS Team Provisioning Profile: io.unom.punktfunk" (it carries no application-groups entitlement) and there is no managed dev profile for the embedded io.unom.punktfunk.widgets at all — so the archive fails with "doesn't include the App Groups capability" and "No profiles for io.unom.punktfunk.widgets". Add -allowProvisioningUpdates + the ASC auth key (asc.p8 already written to RUNNER_TEMP) to all three archive commands so Xcode syncs the App ID capabilities and regenerates/creates the managed *development* profiles. This is development signing against the Apple Development cert already in the keychain — no cert creation, so the App-Manager ASC key suffices; the manual distribution export steps are untouched. Also drop the widgets IPHONEOS_DEPLOYMENT_TARGET from 27.0 (an iOS-27-beta-era value, out of range on the runner's iPhoneOS26.5 SDK) to 17.0, matching the app. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 21:14:23 +02:00
enricobuehlerandClaude Fable 5	8e75f3d8bf	perf(latency): adaptive IDD pipeline depth — depth-1 default, escalate on contention ... From the 2026-07-17 on-glass finding (.173 RTX 4090): the IDD-push capturer's depth-2 pipeline measured ~13ms of glass-to-glass latency over depth-1 at 60fps (17ms → 4ms) — the AU is ready in µs but depth-2 holds it a whole frame interval unpolled while N+1 is submitted. Depth-2 only earns its keep under GPU contention (it overlaps the convert of N+1 with the encode of N, avoiding the depth-1 ~50fps collapse). So the native encode loop now runs depth-1 by default and escalates to the capturer's max ONLY when it can't hold cadence at depth-1 (a leaky-bucket over 'the frame's work overran its pacing deadline', with a startup warmup skip), then holds there for the session (no oscillation; de-escalation is a v2 item). PUNKTFUNK_IDD_ADAPTIVE=0 pins the capturer's full depth (pre-adaptive behaviour); no effect where the capturer's max is already 1 (every non-IDD backend). GameStream plane untouched. Pairs with the shipped REALTIME auto-gate (1bc156aa): uncontended sessions get the ~13ms latency cut, genuinely GPU-bound ones keep the depth-2 overlap AND the REALTIME priority. Validated: .21 clippy -D warnings (host --features nvenc). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 20:48:55 +02:00
enricobuehlerandClaude Fable 5	5e1e64e50b	perf(latency): T2.5b — NV12 compute CSC on the LINEAR/gamescope zero-copy path ... design/latency-reduction-2026-07.md T2.5's Linux half: the LINEAR dmabuf path (gamescope's only offer) fed NVENC RGB, paying its internal RGB->YUV CSC on the SM the game is saturating — the exact contention §5.A removed everywhere else. The Vulkan bridge now carries a buffer-to-buffer RGB->NV12 compute shader (rgb2nv12_buf.comp, BT.709 limited, coefficient-identical to pf-encode's rgb2yuv.comp; whole-word writes so no 8-bit-storage feature is needed): import dmabuf -> dispatch CSC into the exportable buffer -> CUDA de-strides both planes into a pooled two-plane NV12 buffer. PUNKTFUNK_NV12 (default-on) now covers LINEAR; a CSC failure latches RGB for the stream (mid-frame fallback, no dropped frame); 4:4:4 LINEAR sessions stay RGB (never silently subsample). New ImportKind::LinearNv12 rides the existing worker IPC (appended last per the wire-tag rule); cursor stays downstream (blend_nv12). Validated: .21 clippy -D warnings (pf-zerocopy/pf-capture/host+nvenc) + 17 zero-copy tests. Owed: on-glass gamescope session (visual + dmon sm% check). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 20:14:20 +02:00
enricobuehler	fbe1e62ef2	Merge commit '0c9d3ee3' into HEAD	2026-07-17 20:11:08 +02:00
enricobuehlerandClaude Fable 5	0c9d3ee33f	fix(windows-clippy): pf-frame SAFETY comments + checked_div, pf-clipboard SAFETY placement + Gdi feature ... Surfaced by giving windows-host CI its missing pf-encode/pf-frame path triggers: the T2.3 auto-gate (dxgi.rs) and the clipboard host (windows.rs) landed with Windows clippy owed — three undocumented unsafe blocks, one manual checked division, one comment orphaned off its statement, and a latent E0432 in standalone pf-clipboard builds (WNDCLASSW needs Win32_Graphics_Gdi; the host graph only compiled via feature unification). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 20:08:44 +02:00
enricobuehler	df04c2c54f	Merge commit '9da38b8d' into HEAD	2026-07-17 20:01:13 +02:00
enricobuehlerandClaude Fable 5	9da38b8d9c	ci(windows-host): build + clippy with the native QSV feature; encode-crate path triggers; CMake 4 policy floor ... --features nvenc,amf-qsv,qsv on build and clippy (static VPL dispatcher, no new DLLs — ffmpeg *_qsv stays as the fallback until Phase 4). Adds pf-encode/** + libvpl-sys/** to the paths trigger (drift from the W6 split: encoder changes only reached this workflow via Cargo.lock luck). Exports CMAKE_POLICY_VERSION_MINIMUM=3.5: audiopus_sys' vendored opus fails a FRESH CMake-4 configure (observed on this runner on a clean target dir), so green runs were one cache purge from breaking. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 20:01:05 +02:00
enricobuehlerandClaude Fable 5	1bc156aab0	perf(latency): T2.2 Linux NVENC two-thread retrieve + T2.3 REALTIME auto-gate ... design/latency-reduction-2026-07.md tier 2, the two code-side halves: - T2.2: the Linux direct-NVENC backend gains the two-thread retrieve (PUNKTFUNK_NVENC_ASYNC, the same opt-in knob as Windows): the session stays sync-mode (async events are Windows-only) but the blocking lock_bitstream moves to a dedicated pf-nvenc-out thread — the NVENC guide's sanctioned submit-thread/output-thread split. poll() drains completions non-blocking, submit() backpressures at PUNKTFUNK_NVENC_ASYNC_DEPTH (default 4) in-flight; map/unmap and every other session call stay on the encode thread; teardown joins the thread before destroying the session. Under a GPU-saturating game completed frames queue instead of serializing capture on the encode wait. - T2.3: PUNKTFUNK_GPU_PRIORITY_CLASS gains 'auto' AND IT IS THE NEW DEFAULT (gpu-contention §5.C): HIGH immediately, then REALTIME where the documented NVIDIA+HAGS+near-full-VRAM NVENC hang cannot bite — HAGS probed once via D3DKMT WDDM_2_7_CAPS (off => REALTIME outright); HAGS on => a pf-gpu-prio monitor flips REALTIME<->HIGH on LOCAL-segment VRAM headroom (downgrade >92% of budget, restore <=85% for 3x2s polls). 'high' restores the old static default; 'realtime' pins it (operator owns the hazard). Validated: .21 clippy -D warnings (punktfunk-host --features nvenc) against the QSV-merged main; .133 Windows cargo check of pf-frame + punktfunk-host. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:57:38 +02:00
enricobuehlerandClaude Fable 5	399ea9a0f1	merge(qsv): on-glass Arc validation round — MT-protect-before-SetHandle + live test matrix ... 8/8 live tests green on the Arc Pro laptop (VPL 2.16): H264/HEVC SDR, HEVC Main10+HDR metadata, AV1 10-bit, LTR-RFI clean recovery (no IDR; driver honors mfxExtRefListCtrl on H264/HEVC/AV1), no-IDR bitrate retarget. Zero-copy GetNativeHandle path confirmed (single textures, no array-slice hazard). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:56:51 +02:00
enricobuehlerandClaude Fable 5	df70bf00f9	test(qsv): live on-glass matrix — HEVC, Main10+HDR, AV1 10-bit, LTR-RFI, no-IDR retarget ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:55:43 +02:00
enricobuehlerandClaude Fable 5	9e6ab9b94d	fix(qsv): enable D3D11 multithread protection before SetHandle (on-glass -16 on Arc) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:52:44 +02:00
enricobuehlerandClaude Fable 5	6f409caac7	merge(qsv): land the native QSV backend onto main ... Reconciles the qsv line (libvpl-sys + qsv.rs + dispatch/probe wiring, verified on the .133 Windows box: check + clippy + dispatcher link test + unit tests) with the concurrent clipboard JPEG/GIF pass-through commits; Cargo.lock union re-adds the libvpl-sys entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:49:12 +02:00
enricobuehlerandClaude Fable 5	5977b4b9f1	chore(libvpl-sys): silence clippy across the generated bindings ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:48:17 +02:00
enricobuehlerandClaude Fable 5	0a617e7779	fix(qsv): clippy — per-block SAFETY comments, div_ceil, clamp, vec_box allow ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:44:16 +02:00
enricobuehlerandClaude Fable 5	75d1322b8a	fix(qsv): end the inner borrow before the retarget param rebuild ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:39:08 +02:00
enricobuehlerandClaude Fable 5	55e7f3fca9	feat(encode): native QSV backend — libvpl-sys + qsv.rs (Phases 0-3 of design/native-qsv-encoder.md) ... Vendored MIT VPL dispatcher (static, trimmed tree, pin 674d015b/v2.17.0) built via cmake+bindgen behind new feature 'qsv' (pf-encode + punktfunk-host forward). qsv.rs: dispatcher session on the capture adapter (LUID-matched), SetHandle D3D11, AsyncDepth=1/GopRefDist=1/VDEnc/CBR + HRD-off low-latency config, GetSurfaceForEncode + GPU CopySubresourceRegion input (zero-copy, no readback path), bounded sync-point poll, in-place reset with teardown escalation, no-IDR bitrate retarget (Reset + StartNewSequence=OFF), 10-bit P010 HEVC-Main10/AV1, HDR mastering/CLL SEI-OBU at IDR + BT.2020/PQ VSI, LTR-RFI via mfxExtRefListCtrl (AMF slot policy port, Query-gated per codec, wire-index FrameOrder pinning). Dispatch: native-first with ffmpeg fallback + PUNKTFUNK_QSV_FFMPEG hatch; probes (can_encode_10bit / windows_codec_support / windows_backend_is_probed) now answer natively for QSV. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:34:18 +02:00
enricobuehlerandClaude Opus 4.8	055b95a181	fix(pf-clipboard): winfmt layout + wayland map test for the JPEG/GIF pass-through ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 19:33:51 +02:00
enricobuehlerandClaude Opus 4.8	f4b52d0bf5	feat(clipboard): pass original JPEG/GIF through verbatim beside the PNG floor ... Transcoding every image to PNG was the Phase-1 floor, but it bloats lossy originals (a copied JPEG re-encoded lossless is 5-10x the bytes for zero quality gain — feeding the render-timeout on constrained links) and flattens GIFs to one frame. The wire already carries kind LISTS, so offer the original format beside the portable fallback and let the destination pick: - New wire kinds image/jpeg + image/gif (§3.5 extension; strings only, no protocol change). image/png stays the universal floor every peer accepts. - macOS: public.jpeg / com.compuserve.gif rows pass through verbatim both directions; the PNG floor is announced whenever any image is present. - Windows: registered JFIF/GIF formats read + promised verbatim; every image offer still promises CF_DIB, whose delayed render now fetches the richest offered kind (png > jpeg > gif) through the generalized image_to_dib. - Linux maps gain the matching rows (native MIME pass-through). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 19:32:04 +02:00
enricobuehlerandClaude Fable 5	bbe4380b41	perf(latency): T1.1 frame-driven encode trigger + T1.4 time-based flush thresholds ... design/latency-reduction-2026-07.md tier 1, remaining halves: - T1.1: the native encode loop wakes on the capture's ACTUAL arrival instead of sampling at a free-running tick — deletes the sample-and-hold (~half a frame interval on average, a full one worst-case: ~8ms avg @60fps). New Capturer::supports_arrival_wait/wait_arrival pair (IDD-push waits its frame-ready event against the shared-header token; the PipeWire portal blocks its channel with a pending stash); backends without an arrival signal — and PUNKTFUNK_FRAME_DRIVEN=0 — keep the legacy tick bit-identically. A 0.9x-interval rate floor caps encode at ~1.11x target when the compositor outruns the session; a +0.5x-interval keepalive keeps static desktops re-encoding at 1.5x-interval cadence. Pacing deadlines re-anchor to the actual submit so they can't drift against the arrival clock. GameStream plane untouched. - T1.4: the jump-to-live detectors run on WALL-CLOCK now (STANDING_TIME / FLUSH_AFTER = 250ms) instead of 30-frame counts whose meaning scaled with fps (500ms @60 but 125ms @240 — and stretching further under T1.1's slower static-scene repeats). The queue trip also requires depth still >= high, so a hysteresis-band hover can't fire on elapsed time alone. Validated: .21 Linux 185 core + 177 host + pf-capture tests, clippy -D warnings; .133 Windows cargo check of pf-capture + punktfunk-host green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:31:49 +02:00
enricobuehlerandClaude Fable 5	aedee2a4e3	perf(latency): tier-0 attribution + tier-1 send-path levers from the latency plan ... design/latency-reduction-2026-07.md T0.1/T0.2/T1.2/T1.3: - T1.2 rate-capped front-loaded pacing: the paced overflow's budget is now min(0.9x slack, overflow wire time at ~3x the live encoder bitrate) (PUNKTFUNK_PACE_FACTOR, 0 = legacy deadline-only spread). A 300 KB-1 MB frame's tail leaves in ~2-5 ms instead of smearing across ~15 ms at 60 fps; GameStream schedule byte-identical (pins unchanged). - T1.3 data-first wire order: packetize emits every block's data shards before any parity (per-block parity pools keep all blocks' parity alive for the second pass), so lossless completion stops waiting behind the parity tail. EOF = last emitted packet; receiver already order-agnostic. - T0.1 staged 0xCF: HostTiming gains an append-extensible per-stage tail (queue/encode/pace us; seal+channel-wait derived as residual) - no cap bit needed, old peers read the 13-byte prefix. Joined client-side into Stats::host_{queue,encode,xfer,pace}_ms, the OSD detailed tier, and the probe's report. - T0.2 true on-glass present timing: VK_KHR_present_id/present_wait enabled when supported; a PresentTimer waiter thread resolves each present id to real visibility, replacing the submit-time display stamp (which undercounts by up to a refresh and hides a silent-FIFO standing queue). Validated on .21: core 185 + host 185 tests, pf-presenter 19, clippy -D warnings across all five touched crates; loss-harness recovery curve unchanged; C ABI harness round-trips. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:13:08 +02:00
enricobuehlerandClaude Opus 4.8	c28b10a5b9	fix(apple/clipboard): announce + serve image/png from ANY pasteboard image type ... macOS image copies rarely carry public.png — screenshots/Preview put TIFF on the pasteboard, browsers add WebP/AVIF/GIF (observed live: TIFF+RTFD+WebP+AVIF+ 8BPS+GIF, no PNG) — so the literal .png announce never fired and images silently didn't sync. Announce image/png whenever a convertible image is present (TIFF/HEIC alongside the native PNG check) and convert at serve time via NSImage -> NSBitmapImageRep PNG (lazy, per design §3.5 — bytes still cross only on a host paste). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 19:07:33 +02:00
enricobuehlerandClaude Opus 4.8	78d018ae2f	fix(apple/clipboard): announce + serve image/png from ANY pasteboard image type ... macOS image copies rarely carry public.png — screenshots/Preview put TIFF on the pasteboard, browsers add WebP/AVIF/GIF (observed live: TIFF+RTFD+WebP+AVIF+ 8BPS+GIF, no PNG) — so the literal .png announce never fired and images silently didn't sync. Announce image/png whenever a convertible image is present (TIFF/HEIC alongside the native PNG check) and convert at serve time via NSImage -> NSBitmapImageRep PNG (lazy, per design §3.5 — bytes still cross only on a host paste). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 17:43:00 +02:00
enricobuehlerandClaude Fable 5	1b58130e68	merge(release): reconcile the 0.13.0 bump with today's landings ... Brings origin's release prep (widgets App Store profile mapping + workspace version 0.13.0) into the local line that landed the Linux stream sink, the Windows client-only audio rework, the July security-audit fixes, cross-client render-scale, and the widgets scheme. release.yml was byte-identical on both sides; no other file overlap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:26:59 +02:00
enricobuehlerandClaude Fable 5	12d4b025f7	ci(release): widgets-extension App Store profile mapping + shared Xcode scheme ... Mirrors origin's 15233a68 (byte-identical release.yml, so it dedupes at the next reconcile) and adds the shared PunktfunkWidgetsExtension scheme the archive step builds with. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:15 +02:00
enricobuehlerandClaude Fable 5	871ebb31ce	feat(clients): render-scale setting on every client — shared punktfunk_core::render_scale ... Client-side supersampling/downscaling: the client asks the host to render and encode at chosen-resolution × scale (the host does no scaling) and the presenter rescales the decoded frame to the display. >1 supersamples for sharpness; <1 lightens the host GPU and the link. Default 1.0 = Native, the prior behavior. The geometry lives once in punktfunk_core::render_scale (multiply, preserve aspect ratio, floor to even, clamp to the codec's per-axis ceiling — 4096 for H.264, 8192 otherwise), the Rust twin of the Apple client's RenderScale.swift, consumed by the native session client, the presenter's match-window path, the Windows/Linux settings UIs, Decky, and Android (settings + host connect + unit test). Implemented and platform-verified by the Apple-client-features session (Linux+Android+Apple green there); the punktfunk-core wiring (pub mod render_scale) is restored here after being lost in a working-tree reconciliation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:15 +02:00
enricobuehlerandClaude Fable 5	600693914f	fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene ... The low/medium findings from the July host+Windows security review, as implemented in the audit session's working tree: - Webhooks and library-art fetches refuse loopback/link-local/metadata targets and no longer follow redirects (SSRF pivots from the privileged host process). - The paired-client rosters (/clients, /native/clients) move off the streaming-client auth lane — one paired device could enumerate every other device's name + fingerprint; only the bearer/loopback console keeps them. - Device-name sanitizing extends to bidi/format control characters (spoofable rendering) via the shared native_pairing::is_spoofy_char; stream-marker quoting uses the same set. - The SYSTEM service resolves powershell by its full System32 path — CreateProcess checks the launching EXE's own directory first, so a planted powershell.exe beside the host binary would have run as SYSTEM. - The pf-vdisplay driver's opt-in file log moves from world-writable C:\Users\Public to WUDFHost's own temp dir. - GameStream pairing sessions are single-use (removed whatever the outcome). - Uninstall also removes the pf_mouse driver-store entry (rider from the virtual-HID-mouse work). - openapi.json regenerated (hardened-config-dir doc wording). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:15 +02:00
enricobuehlerandClaude Fable 5	4d89dcd3d7	fix(audio/windows): explicit-endpoint capture, client-only playback, self-healing watchdog ... Root cause of the field report (Android client, Windows host: no audio until the user manually cycled Sound-output devices, then audio on BOTH PC and phone): the WASAPI loopback captured whatever the default render endpoint was at open time — not the wiring plan's chosen endpoint — the plan's IPolicyConfig default-set is warn-only and racy, and nothing reacted to mid-stream default-device changes. - Explicit-endpoint capture: the capture thread opens the plan's loopback_render by id, never "the default" (KEEP_DEFAULT preserves the old default-capturing behavior with the echo guard). - Client-only playback default: wiring_plan::plan(..., host_audio) prefers a silent sink (Steam Streaming Microphone render side — loopback-validated, silent on host) over real hardware, so stream audio plays on the client only; PUNKTFUNK_HOST_AUDIO=1 restores real-hw-first (audible on the host). The capture side auto-installs the Steam pair once per process when no silent sink exists; open() handshake timeout 3s -> 30s to cover it, and a handshake timeout now stops the detached thread (it used to run for the process lifetime with the default still parked). - Self-healing capture thread (wasapi_cap): outer capture_once loop (Assert|Follow) with a ~1s watchdog on the default render id. A user switch to a capturable endpoint is followed (their choice wins, audio on both); a switch to a dud (cable/SSS/mic target) re-asserts the plan; IPolicyConfig-denied converges to Follow instead of churning. Device errors reopen with 2s backoff; only the FIRST open failure is fatal. Zero-packets breadcrumb after 30s distinguishes broken-loopback from quiet-desktop. - Park/restore of the default playback device (audio_control): wire_now(set_playback) parks the default on the loopback sink only for the capture's lifetime (the mic pump passes false — it runs while the host is idle); crash marker audio-default.prev + recover_orphaned_default() at first wire; restore is skipped if the operator changed the default themselves. A mic-default hygiene pass keeps VB-Cable installs audible and never records the mic target as the restore target. - Session-end park_audio_capture(): Windows DROPS the capturer (thread join restores the default) instead of caching it; Linux keeps the parked PipeWire thread. Composes with the stream-sink idle() hook at all three park sites (idle is a no-op on Windows). Verified: Linux (.21) clippy -D warnings + 176 punktfunk-host tests green (incl. the new wiring-plan preference tests); Windows (.173) clippy with nvenc,amf-qsv --all-targets -D warnings green at this exact tree. On-glass winbox/Android validation still owed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:05:02 +02:00
enricobuehlerandClaude Fable 5	97c5778a36	merge(audio): land feat/linux-stream-sink — Linux host-owned stream sink ... Merges 44b71e74 (see its message for the full design: the "Punktfunk Stream Speaker" Audio/Sink claimed as the session's default output — the crackle root fix for hardware-sink churn — plus the core-error liveness fix and true 5.1/7.1 capture) across the W1–W8 refactor that landed since the branch forked: - punktfunk1.rs was split on main: the audio_thread idle()/drain() hunks are hand-ported into native/audio.rs (same three sites: reuse-drain comment, encoder-fail park, end-of-thread park). - pwinit moved to pf-capture (W6.2): the branch's crate::pwinit calls in pw_thread and stream_sink.rs become pf_capture::pwinit. - Kept main's log-tier demotions (stream-state + setup lines at debug) inside the restructured pw_thread. Resolution verified on Linux (home-worker-5): clippy -D warnings clean + 173 punktfunk-host tests green at the 691c064a-based equivalent ba5973a2; re-verified at this base before landing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 16:35:02 +02:00
enricobuehlerandClaude Fable 5	22b352c1da	chore(release): bump workspace version to 0.13.0 ... The eight W6 leaf crates hardcoded 0.12.0 instead of inheriting the workspace version — switched to version.workspace = true so the next bump is one line again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 16:32:35 +02:00
enricobuehlerandClaude Fable 5	15233a68cf	ci(release): map the widgets extension to its own App Store provisioning profile ... The .ipa now embeds PunktfunkWidgetsExtension (io.unom.punktfunk.widgets), a second distribution artifact, so the manual-signing exportArchive must map its App ID to its own App Store profile — without it the export fails with "no profile for io.unom.punktfunk.widgets". Requires the "Punktfunk iOS Widgets App Store Distribution" profile on the runner. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 16:32:35 +02:00
enricobuehlerandClaude Opus 4.8	2a637eaf3f	Merge origin/main: shared clipboard Phase 1 + first-frame-latency v4 into the local SDK line ... Brings the day's landed work — clipboard (pf-clipboard + macOS client, ABI v8), the perf/first-frame-latency merge (driver proto v4, Welcome-time display prep, in-place resize), and the W7/W8 reconciliation — into the local main that had diverged with the SDK-publish commits. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:29:10 +02:00
enricobuehlerandClaude Opus 4.8	6c976e9dc5	fix(apple): land the RenderScale/DefaultsKeys definitions the client refactor references ... The W7/W8 client reconciliation committed the CONSUMERS of the render-scale setting and the toggle-fullscreen notification (ContentView/FullscreenController et al.) while their definitions were still uncommitted working-tree state from the Apple-features effort — apple.yml red on main (run 10657). Lands the two definition files (PunktfunkShared/RenderScale.swift + the DefaultsKeys additions) so main builds; the rest of that effort's WIP stays in its working tree. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:20:39 +02:00
enricobuehlerandClaude Opus 4.8	c8ee4b9902	fix(pf-vdisplay,pf-capture,pf-win-display): pre-split paths in the auto-merged v4 code ... The rename-followed perf hunks still said crate::win_display:: (the pre-W6 layout) — point them at pf_win_display::win_display:: and widen the four helpers they call cross-crate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:13:15 +02:00
enricobuehlerandClaude Opus 4.8	1197415216	fix(pf-vdisplay,pf-win-display): v4 trait surface on the extracted driver.rs + cross-crate visibility ... The W-refactor extracted VdisplayDriver into manager/driver.rs (the merge resolution assumed it deleted) — carry the v4 changes there: open() returns the driver's protocol version, update_modes() default-errs to the re-arrival fallback. wait_target_departed goes pub for the manager's cross-crate call. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:11:34 +02:00
enricobuehlerandClaude Opus 4.8	18a5d93ae3	fix(host): allow too_many_arguments on the two fns the v4 merge grew ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:09:57 +02:00
enricobuehlerandClaude Opus 4.8	09849906e9	Merge perf/first-frame-latency: driver proto v4 + first-frame/resize latency (P0-P2) ... Brings the first-frame-latency branch (P0.1 transition tracing, P1.1/P1.2 Welcome-time display prep, P2 in-place resize; pf-driver-proto v3 -> v4 with IOCTL_UPDATE_MODES) onto current main. The branch predates the W6.2/W7 splits, so git's rename detection carried most of it into the moved crates (pf-capture idd_push, pf-vdisplay manager/pf_vdisplay, pf-win-display, pf-driver-proto, the driver workspace) and the punktfunk1.rs remainder was re-homed by hand: - native/handshake.rs: welcome/start trace marks + the Welcome-time display prep spawn (the prep thread BECOMES the stream thread; hand-off via a SyncSender<SessionContext>). negotiate() gains bringup/quit/stop and returns the PrepHandle. - native.rs: bringup/resize_ms creation + the stop/quit flags hoisted BEFORE the handshake (the close watcher splits: flags pre-handshake, lifecycle events post-handshake where `hello` exists); punch_done stamp; the data plane adopts the prep thread's result or builds inline. - native/stream.rs: SessionContext/SendStats carry the trace; send_loop finishes it on the first video packet; the resize path gains the in-place fast path (try_inplace_resize) with the full rebuild as fallback, restructured so both share the post-rebuild bookkeeping; prepare_display/PreparedDisplay/ PrepHandle; build_pipeline(+retry) thread the stage marks. - session_status/mgmt: ttff_ms + last_resize_ms per session (union with the lifecycle-events fields main added to the same spots). - pf-capture: Capturer gains capture_target_id() + resize_output() defaults. - pf-vdisplay manager: perf's faster activation poll (60x50ms) + the settle floor before the PnP sweep, on main's knobs/no-trait shape. Also: packaging/windows/build-gamepad-drivers.ps1 is ASCII again (an em-dash from the pf-mouse work tripped windows-host.yml's locale-safety gate on main). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:08:16 +02:00
enricobuehlerandClaude Opus 4.8	691c064a37	build(sdk): publish @punktfunk/host to the Gitea npm registry ... - package.json: drop private; point main/types/exports/bin at a tsc-built dist/; add publishConfig (unom/npm registry), files, repo metadata, and the MIT OR Apache-2.0 license; effect becomes a peerDependency (shared instance). - tsconfig.build.json: emit dist/ JS + .d.ts (bun shebang preserved on the bin). - .npmrc: map the @punktfunk scope to the registry (no token committed). - sdk-publish.yml: publish on sdk-v* tags or manual dispatch, reusing the REGISTRY_TOKEN secret; typecheck/test/build/tag-matches-version gate. - README: Install section for consumers. Verified: build green, frozen lockfile stable, bun publish --dry-run packs @punktfunk/host@0.1.0 (dist + README only) to the unom registry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:54:36 +02:00
enricobuehlerandClaude Opus 4.8	34519566ba	feat(sdk): VirtualHere DualSense passthrough example + automation recipe ... Add sdk/examples/virtualhere-dualsense.ts — bind a real USB DualSense (shared from the couch via VirtualHere USB-over-IP) to the host for the length of each connection and release it after, for full gyro/touchpad/adaptive-trigger/USB- rumble passthrough instead of the emulated pad. Brackets on client.connected/ disconnected and releases the pad on SIGTERM for a clean runner stop. Document it in the Events & hooks page with a zero-code hooks.json variant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:54:36 +02:00
enricobuehlerandClaude Opus 4.8	86d9f49473	style(pf-vdisplay): rustfmt under the pinned 1.96.0 toolchain ... The W6.2 pf-vdisplay extraction (27a5d8da) committed six spots that the pinned rustfmt (rust-toolchain.toml = 1.96.0) reformats — a short closure collapse and chain-call wrapping. No semantic change; makes cargo fmt --all --check green so the combined push does not land CI red on pre-existing format drift. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:38:12 +02:00
enricobuehlerandClaude Opus 4.8	2064c0780c	merge(core): reconcile the W7/W8 client refactor with origin's shared-clipboard feature ... origin/main landed the shared clipboard (design/clipboard-and-file-transfer.md) while this branch split quic/msgs.rs -> quic/{caps,control,...} and client.rs -> client/{mod,control,worker,pump,planes,...} (W7) and deleted the two monoliths. The feature had modified both deleted files, so its delta is re-applied onto the split instead of resurrecting the monoliths: - HOST_CAP_CLIPBOARD -> quic/caps.rs - MSG_CLIP_* / CLIP_* consts, the six Clip* structs, and their encode/decode impls -> quic/control.rs (beside the clock codecs) - CtrlRequest::{ClipControl,ClipOffer} + Negotiated.host_caps -> client/control.rs - WorkerArgs.{clip_event_tx,clip_cmd_rx} -> client/worker.rs - CLIP_EVENT_QUEUE -> client/planes.rs - NativeClient clip fields, the 7 clip_* / host_caps / next_clip methods, connect() channel wiring -> client/mod.rs - the control-task encode/decode arms and the clipboard-task spawn -> client/pump.rs Cargo.lock reconciled (adds pf-clipboard), punktfunk-host/Cargo.toml unions the W6 pf-* subsystem deps with pf-clipboard, and include/punktfunk_core.h is the cbindgen union (clipboard + rumble C-ABI). punktfunk-core builds --all-features and its 174 lib tests pass, including quic::tests::clip_loopback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:38:11 +02:00
enricobuehlerandClaude Opus 4.8	f439b69451	refactor(android/W8): split decode.rs into decode/ directory module ... Break the 1747-line clients/android/native/src/decode.rs into a decode/ directory module (mod.rs + 5 concern submodules): - decode/setup.rs : codec creation + low-latency config + thread/frame-rate tuning + HDR static-info encode - decode/display.rs : DisplayTracker + render-callback registration + HDR dataspace - decode/latency.rs : realtime clock + decoded-pts / user-flags stat recording - decode/sync_loop.rs : the synchronous poll decode loop (+ feed/drain) — moved WHOLE - decode/async_loop.rs : the event-driven async decode loop (+ helpers) — moved WHOLE decode/mod.rs keeps the consts, DecodeOptions, and the `run` entry point + the `codec_mime`/`codec_label` re-export, so every crate::decode::X path stays byte-stable. The module has no decoder struct (free functions + small types), so both decode loops move byte-for-byte and their separately-inlined received-stat recording is NOT unified. 16 helper fns/types became pub(super) for sibling access; zero field bumps. lib.rs unchanged (`#[cfg(target_os="android")] mod decode;` resolves to decode/mod.rs). Verified: cargo-ndk check (aarch64-linux-android, clean) + the gradle cargoNdkDebug build (arm64-v8a / armeabi-v7a / x86_64). On-device runtime re-verification still owed per the plan (the two decode loops are a hot path). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:06:24 +02:00
enricobuehlerandClaude Opus 4.8	1eef55016d	refactor(apple/W8): extract FullscreenController + ApprovalRequest from ContentView ... Move the macOS `FullscreenController` (NSViewRepresentable that drives native fullscreen) into its own FullscreenController.swift, and `ApprovalRequest` (the pending-trust-decision value type) into ApprovalRequest.swift, out of the 1041-line ContentView.swift. Both were file-`private`; dropped to internal so ContentView (same module) still references them across files. StreamView*.swift and the connection body are untouched. Pure move; no behavior change. Verified: `swift build` (macOS) — Build complete. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:02:34 +02:00
enricobuehlerandClaude Opus 4.8	61118cbdd4	refactor(presenter/W8): split vk.rs into vk/ directory module ... Break the 2513-line pf-presenter/src/vk.rs into a vk/ directory module (mod.rs + 6 concern submodules), keeping ALL type definitions in vk/mod.rs so every submodule (a descendant of vk) sees the Presenter/OverlayPipe/etc. private fields with no field bumps: - vk/setup.rs : Presenter::new + device/format/present-mode selection - vk/present.rs : the per-frame present path (present + CSC record + AVVkFrame sync) — HOT PATH, moved whole - vk/reconfig.rs : swapchain recreate/resize + HDR reconfiguration - vk/resources.rs : video-image/staging (re)build + Retired-frame destruction - vk/overlay_pipe.rs: the presenter-side overlay composite pipeline - vk/gpu.rs : memory allocation, image barriers, geometry helpers (+ tests) vk/mod.rs keeps FrameInput/Presenter/OverlayPipe/VideoImage/Staging/Retired/HwCtx* + the public accessors + Drop. Methods/free-fns a sibling submodule calls became pub(super) (~18); zero field bumps, zero re-exports (Presenter/FrameInput never leave mod.rs). lib.rs unchanged (`pub mod vk;` resolves to vk/mod.rs). The moved overlay shader include_bytes! gained one `../` for the deeper dir. Pure move; no behavior change; the hot present path keeps only static pub(super) calls (inlinable). Verified both platforms: Linux (home-worker-5) clippy -p pf-presenter (--all-targets -D warnings) + test; Windows (winbox, ASCII CARGO_HOME) clippy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 14:39:36 +02:00
enricobuehlerandClaude Opus 4.8	22a61e0b48	refactor(console-ui/W8): split shell.rs into shell/ facade + render/overlays/tests ... Break the 1212-line pf-console-ui/src/shell.rs into a facade + shell/ subdir (shell.rs stays the parent; `mod render;` resolves to shell/render.rs): - shell/render.rs : the per-frame screen compose/transition path (Shell::render + the LayerEnv paint helper) - shell/overlays.rs : the modal overlays (Shell::draw_overlays + draw_takeover) - shell/tests.rs : the inline #[cfg(test)] module, extracted verbatim The Shell struct + its public API + draw_aurora() stay in shell.rs (both children reach draw_aurora + the private fields as descendants — no bumps). Sole visibility change: draw_overlays -> pub(in crate::shell) (its caller Shell::render is now a sibling). Zero re-exports needed (Shell/ConsoleOptions never leave the root). Pure move; no behavior change. Verified both platforms: Linux (home-worker-5) clippy -p pf-console-ui (--all-targets -D warnings) + test; Windows (winbox, ASCII CARGO_HOME) clippy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 14:29:07 +02:00
enricobuehlerandClaude Fable 5	13b1f36d4a	feat(core,clients): one rumble policy engine for every platform (rumble root fix D) ... punktfunk-core client/rumble.rs: a per-connection policy engine consumes seq-gated wire updates and emits EFFECTIVE actuator commands — re-emits on renewals (duration APIs stay re-armed), self-silences at the v2 lease, a UNIFORM 1 s legacy-host staleness replacing the per-platform zoo (Apple 1.6 s / Android 60 s / SDL 1.5 s / Deck 1 s), quirk-declared actuator keepalives (Deck 40 ms + LSB dedupe-defeat jitter), and one stop per buzzing pad on connection close. Per-pad mailbox semantics: a stalled embedder wakes to ONE current command, and a stop can structurally never be the update an overflowing queue drops. New API/ABI: NativeClient::{next_rumble_command,set_rumble_quirks} + punktfunk_connection_next_rumble_cmd/_set_rumble_quirks (next_rumble/next_rumble2 stay for un-migrated embedders; both consumers are fed). Migrations DELETE the platform forks: pf-client-core loses RumbleState + the Deck keepalive loop + LEGACY_RUMBLE_CEILING_MS and physically silences a slot at close; Android loses the 60 s legacy one-shot (backstop repack, cancel-on-zero); Apple loses envelopeDeadline + sessionStaleSeconds + both tick watchdogs (CoreHaptics realization untouched; mac xcframework rebuilt locally). design/rumble-root-fix.md par. D. Engine 10/10 unit tests; core tests 176 Linux / 175 Windows + clippy -D warnings; swift build + RumbleTuningTests; Kotlin + android-native compile green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 14:07:32 +02:00
enricobuehlerandClaude Fable 5	9e6fc6e071	fix(host/inject,drivers): rumble root fixes A-C — lossless report ring + rumble-keyed idle watchdogs ... B: PadFeedback.game_drove -> rumble_drove, keyed on vibration-asserting reports — an LED/adaptive-trigger stream can no longer feed the abandoned-rumble force-off while a coalesced stop never re-asserts (the confirmed unbounded stuck-ON path). C: Linux parity — every UHID backend now arms the shared watchdog (Steam Input drives these pads over hidraw with Windows abandonment semantics) and the uinput mixer force-stops abandoned infinite-replay FF effects (FfState, unit-tested). Shared PUNKTFUNK_RUMBLE_IDLE_MS hatch (0 = off; non-zero floored above SDL's ~2 s rumble resend). A: PadShm v2.1 — a 1024 B tail extension carrying an 8-slot lossless output-report ring, feature-negotiated via zeroed reserved fields (out_ring_ver; deliberately NO GAMEPAD_PROTO_VERSION bump — mixed generations degrade to the legacy latest-report slot instead of failing closed). The pf-dualsense driver dual-writes both planes (publish_output); the host's shared OutputDrain drains oldest->newest with a torn-read recheck and an overflow->resync path (PadFeedback.resync force-stops + re-arms dedups). pf-umdf-util grows a min_data_size map fallback. Ds*Feedback.fresh removed (dead). design/rumble-root-fix.md par. A-C. Verified: pf-inject tests+clippy Linux+Windows (53/53 on winbox incl. the stop-coalesce repro); drivers ws check+clippy on the CI runner. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 14:07:32 +02:00
enricobuehlerandClaude Opus 4.8	570ff504ad	refactor(client-core/W8): split video.rs into flat decoder-backend siblings ... Break the 1974-line pf-client-core/src/video.rs into flat sibling modules (matching the crate's video_d3d11.rs / video_pyrowave.rs convention), leaving video.rs as the contract + Decoder dispatch facade: - video_color.rs : ColorDesc + csc_rows (the Y'CbCr->RGB matrix) - video_software.rs : the libavcodec/swscale SoftwareDecoder - video_vaapi.rs : the Linux-only VAAPI/DRM-PRIME backend (mod is cfg(linux)) - video_vulkan.rs : the FFmpeg Vulkan Video backend Every crate::video::X / video::X path stays byte-stable (ColorDesc + csc_rows re-exported from video.rs; frame POD, VulkanDecodeDevice, QueueLock, Decoder, decodable_codecs*, ffmpeg_codec_id, fourcc/drm_fourcc_for all stay in video.rs). Code-driven placements: averr, AVERROR_EAGAIN, frame_is_keyframe stay in video.rs (shared by all three decoders); DrmFrameGuard's field + drm_fourcc_for + Software/Vaapi/VulkanDecoder ctors/decode became pub(crate) (sibling access); the test module split three ways (software tests need private decoder internals). Pure move; no behavior change. Verified on Linux (home-worker-5): cargo clippy -p pf-client-core (default [pyrowave] + --no-default-features, --all-targets -D warnings) + cargo test. Windows verify BLOCKED environmentally: pf-client-core -> sdl3 build-from-source -> CMake/CL.exe fails on winbox's non-ASCII home path (fails the baseline too, independent of this split); the split's Windows surface (facade cfg(windows) bits + video_d3d11) is verbatim-preserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 14:06:57 +02:00
enricobuehlerandClaude Opus 4.8	5d0e23d6a5	feat(apple/clipboard): macOS client half of the shared clipboard (Phase 1 §5) ... The NSPasteboard bridge completing Phase 1 (design/clipboard-and-file-transfer.md §5) — with the host backends on this branch, copy/paste now crosses the wire in both directions on macOS. Lazy in both directions: - PunktfunkConnection grows the clipboard plane: its own clipboardLock (close() joins it like the other pullers), hostCaps/hostSupportsClipboard from the Welcome, the typed ClipEvent vocabulary, and the six ABI wrappers (clipControl/clipOffer/clipFetch/clipServe/clipCancel/nextClipboard — borrowed event payloads copied out before the next poll). - ClipboardSync (PunktfunkKit, macOS-only): one drain thread bridging NSPasteboard.general ↔ the QUIC clipboard plane. Local copies announce format lists via a 500 ms changeCount poll (+ immediate on app activation); bytes leave only on a host FetchRequest, answered from the live pasteboard and seq-guarded against staleness. Host copies install one NSPasteboardItem whose data provider fires only when a Mac app actually pastes, then blocks its provider thread (never main) on a 10 s-bounded fetch. Concealed/Transient pasteboards (password managers) are never announced; our own writes are changeCount-suppressed (§3.4). Text/RTF/HTML/PNG; files ride Phase 2. - UI: per-host "Share clipboard with this host" toggle (StoredHost.clipboardSync, optional for saved-JSON forward-compat — wire-format tests extended), a mid-session Share/Stop Sharing Clipboard item in the Stream menu (⌃⌥⇧C, greyed without HOST_CAP_CLIPBOARD), SessionModel owning the lifecycle (start on streaming after the trust gate, drain joined off-main on teardown). swift build + swift test green (macOS). Requires the ABI v8 xcframework (scripts/build-xcframework.sh). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:40:47 +02:00
enricobuehlerandClaude Opus 4.8	ffa63a74f2	refactor(core/W7): split client.rs into client/ facade + submodules ... Turn the 2674-line client.rs into a client/ directory module (mod.rs facade + 8 submodules) behind glob/`use self::` re-exports, so crate::client::X paths (NativeClient, ProbeOutcome, AudioPacket, display_hdr_env_override) stay byte-stable. Leaf lifts: frame_channel.rs (the FIFO hand-off + jump-to-live consts + DecodeLatAcc), recovery.rs (RfiRecovery loss-range detector), probe.rs (ProbeState/ProbeOutcome), planes.rs (side-plane queues + AudioPacket), control.rs (CtrlRequest/Negotiated), worker.rs (WorkerArgs + reject_from_close), pairing.rs (NativeClient::pair). The per-frame pump moves WHOLE as a plain `pub(super) async fn run_pump` (was worker_main) — the only edit is the signature line: no trait object, no Box, no per-frame allocation or indirection. NativeClient + its public impl + Drop + the cfg-gated thread-pin/hot-tid helpers stay in the facade. Visibility bumps are pub(crate) (struct + each field for WorkerArgs/Negotiated/ProbeState; FrameChannel + each method); reject_from_close is pub(crate) (sibling access). No behavior change. Verified: Linux clippy (quic + no-default, -D warnings) + full cargo test; Windows clippy (both) + test --lib; macOS clippy (apple thread-pin variant) + 165 lib tests. On-glass jump-to-live + ABR smoke still owed (pump is a pure relocation, so this is a formality) per the plan's pump gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:29:16 +02:00
enricobuehlerandClaude Opus 4.8	716875dd09	refactor(core/W7): split quic/msgs.rs into handshake/caps/control/pairing ... Break the 1302-line quic/msgs.rs into four flat sibling modules behind the quic facade's glob re-exports, so every crate::quic::X path stays byte-stable: handshake.rs (Hello/Welcome/Start + codecs), caps.rs (video-cap bits, codec & chroma negotiation, ColorInfo), control.rs (typed CTL_MAGIC messages + frame), pairing.rs (SPAKE2 ceremony messages). msgs.rs is deleted; quic/mod.rs gains the four `mod`/`pub use` lines and the `pub use crate::reject::*` hoist (moved up from msgs.rs). Pure move; no wire-format or behavior change. Private helpers (truncate_to, put_bytes, get_bytes) stay with their sole callers; no visibility changes. Verified both platforms from clean HEAD snapshots: Linux clippy (quic + no-default, -D warnings) + full cargo test (157 lib + integration); Windows clippy (both) + test --lib (156). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:08:45 +02:00
enricobuehlerandClaude Opus 4.8	da0578771e	fix(pf-clipboard): declare the libc dep the Linux backends call fully-qualified ... wayland.rs (pipe2/poll on the paste pipes) and mutter.rs (fcntl un-nonblocking on the transfer fd) reference libc:: inline — caught by the Linux leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:07:13 +02:00
enricobuehlerandClaude Opus 4.8	391f8fb9f7	feat(clipboard): Linux + Windows host clipboard backends as the pf-clipboard crate (Phase 1 host + Phase 3) ... The host half of the shared clipboard (design/clipboard-and-file-transfer.md §4), ported from feat/shared-clipboard (6bd8c18b) into the post-W6 crate shape: the backends land as a pf-clipboard subsystem crate (the pf-inject/pf-capture pattern) instead of growing punktfunk-host back out, and the ~340-line punktfunk1.rs integration is re-implemented against the native.rs/control.rs split that replaced it. pf-clipboard: - host::wayland — ext-data-control-v1 (KWin / wlroots / Sway / Hyprland). - host::mutter — GNOME via Mutter's *direct* org.gnome.Mutter.RemoteDesktop clipboard (no data-control at any GNOME version; the xdg portal needs an interactive grant a headless host can't answer). - host::windows + host::winfmt — Win32 clipboard on a hidden message-loop window: WM_CLIPBOARDUPDATE listener + OLE delayed rendering (WM_RENDERFORMAT) for text / CF_HTML / RTF / PNG. - host::session — the backend-agnostic coordinator bridging HostClipboard to the QUIC clipboard plane (offers, fetch accept-loop, remote offers, pastes). - A portable facade (policy / enabled / cap_advertised / ClipCoordCmd / start / spawn_decline_loop) so the orchestrator compiles cfg-free on every platform; ClipCoordCmd moves into the crate (it was host-owned before). punktfunk-host glue: - handshake.rs advertises HOST_CAP_CLIPBOARD via pf_clipboard::cap_advertised. - serve_session starts the coordinator (gated on a real compositor — the synthetic source stays out of the session clipboard) and spawns the CLIP_FETCH_UNAVAILABLE decline loop when the policy is on but no backend bound. - control.rs gains the ClipControl/ClipOffer arms + the host-offer forward branch, and the e2e session test (cap advertise → ClipState ack with BACKEND_UNAVAILABLE → fetch decline) rides in native.rs's tests. Still opt-in default OFF (PUNKTFUNK_CLIPBOARD). Remaining: the macOS client (design §5) — then this becomes user-visible. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:02:20 +02:00
enricobuehlerandClaude Opus 4.8	ef736cb9d7	refactor(core/W7): split transport/udp.rs into udp/ facade + per-OS backends ... Turn transport/udp.rs into a udp/ directory module: the cross-platform core (UdpTransport, is_transient_io, spawn_data_punch, the Transport trait impl) stays in mod.rs; the platform batched-I/O backends move to udp/{linux,windows,apple}.rs. The trait impl is kept whole -- its per-OS send_batch/send_gso/recv_batch methods become cfg-gated one-line delegators to pub(super) free fns that take &UdpTransport (byte-identical bodies, self -> t). transport/mod.rs is unchanged (re-exports still resolve; udp/mod.rs re-exports windows::send_uso_all). No behavior change. Module gates: linux = any(linux, android) (Android uses sendmmsg/recvmmsg via its bionic binding); windows = windows (USO); apple = all(unix, not(any(linux,android))) (recvmsg_x on Darwin, recv-loop on BSD). GSO stays linux-only. Verified on all four target families from clean HEAD snapshots: Linux clippy (quic + no-default, -D warnings) + full test; Windows clippy (both) + test --lib (156); macOS check (apple recvmsg_x path); aarch64-linux-android check (android_mmsg). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:01:53 +02:00
3 people	4ef90d586d	feat(clipboard): wire protocol + client-core task for shared clipboard (Phase 0) ... The portable shared-clipboard plane in punktfunk-core, all behind the `quic` feature (design/clipboard-and-file-transfer.md §3): - Control messages 0x40–0x44 (ClipControl / ClipOffer / ClipFetch...) and the HOST_CAP_CLIPBOARD capability bit, negotiated in the Welcome caps. - Per-transfer QUIC bi-streams ("PKFs" magic) for lazy fetch of offered content, with ClipFetchHdr status/size framing (quic::clipstream). - The §3.5 portable wire-MIME vocabulary (text/plain;utf-8, text/html, text/rtf, image/png) shared by both ends. - Client-side clipboard task (client.rs) + C ABI surface bumped to v8 (abi.rs, regenerated include/punktfunk_core.h). - Loopback transport tests (quic::tests). No OS clipboard integration yet — that is the host backends (Phase 1/3) and the macOS client (Phase 1). Ported from feat/shared-clipboard (af3a7d8c, pre-W6 base) onto current main; three deliberate deviations from the original commit: - ABI v6 → v8: main took v6 (reanchor gate) and v7 (typed connect rejection) in the meantime; the clipboard C surface re-lands as v8. - CLIP_CANCELLED_CODE 0x60 → 0x70: main's pairing-rejection close codes claimed the 0x60–0x67 block; the vocabularies stay disjoint on purpose. - Negotiated.host_caps coexists with main's 6-tuple host_caps plumbing: main needs the worker-local copy for gamepad snapshots, the clipboard path needs it across ready_tx to build the NativeClient handle (punktfunk_connection_host_caps). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:50:37 +02:00
enricobuehlerandClaude Opus 4.8	93c8dc4712	refactor(core/W7): split packet.rs into packet/ facade + submodules ... Turn the 1446-line packet.rs into a packet/ directory module (mod.rs facade + header/packetize/reassemble/tests) behind glob re-exports, so every crate::packet::X path stays byte-stable. Pure move: the header consts + PacketHeader -> header.rs; Packetizer -> packetize.rs; the Reassembler cluster (kept WHOLE -- disjoint-borrow hot path) + loss-window consts -> reassemble.rs; the inline #[cfg(test)] block -> tests.rs. Sole visibility change: LOSS_WINDOW_NS -> pub(super) (a test imports it). No behavior change. Verified on both platforms from a clean HEAD snapshot: Linux clippy (--features quic and --no-default-features, --all-targets -D warnings) + full cargo test; Windows clippy (both feature sets) + cargo test --lib (156 pass). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:48:48 +02:00
enricobuehlerandClaude Opus 4.8	f012ebbcba	feat(sdk): Effect v4 + @effect/openapi-generator; typed pf.api & example ladder ... Drop Orval for the first-party @effect/openapi-generator (OpenAPI 3.1 -> Effect Schema + a typed HttpClient client) and bump effect 3.19 -> 4.0.0-beta.98. Port the hand-written surfaces to the v4 API (Result over Either, Context.Service, Codec, Literals/Union arrays, Stream/Schedule/ Effect renames). Transport (CA-pinning fetch) and the reconnecting SSE source are kept intact. Make the SDK approachable for non-Effect users: - Add pf.api.* on the Promise facade: the generated client surfaced as typed, Promise-native methods (await pf.api.listPairedClients()), so REST calls are autocompleted and checked instead of stringly-typed pf.request(method, path, body) + `as` casts. Zero-drift veneer over make(httpClient), backed by the same pinning fetch. pf.request stays as the untyped escape hatch. - Re-tier examples into a 1-4 complexity ladder, rewritten onto pf.api.* (the typed payloads caught a wrong `launch` shape in provider-sync); the Effect example is labelled advanced. Add examples/ to tsconfig so they are typechecked (stops rot). typecheck + 19 tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:40:04 +02:00
enricobuehlerandClaude Opus 4.8	27a5d8daac	refactor(host/W6.2): extract virtual-display orchestration into the pf-vdisplay crate ... vdisplay.rs + vdisplay/* (the per-compositor Linux backends — KWin zkde-screencast, wlroots swaymsg, Mutter RemoteDesktop, Hyprland — and the Windows IddCx/pf-vdisplay driver backend, behind one VirtualDisplay trait; the mode-conflict admission registry, the display policy/identity/custom-preset state, and the session-env / gamescope routing) move into crates/pf-vdisplay (plan §W6). The DDC/CI panel-power control (used only here) and the KWin zkde protocol XML move with it. This completes the host-crate decomposition: capture, encode, inject, and vdisplay are now four subsystem crates over the shared leaves, and punktfunk-host is the orchestrator (serve/supervisor + native + gamestream + mgmt). Coupling breaks (all down-only, cargo-tree acyclic): - capture::dxgi identity -> pf_frame::dxgi; win_display/monitor_devnode/ console_session_mismatch -> pf-win-display leaf; can_open_another_session -> pf-encode (the NVENC session-budget admission gate — acyclic peer edge). - The registry's DisplayCreated/DisplayReleased emits into the host SSE event bus invert to a leaf hook: pf-vdisplay emits a neutral DisplayEvent to a host-registered DISPLAY_EVENT_SINK, so it never reaches the orchestrator's events module. - The IddCx driver module is renamed pf_vdisplay -> driver (its old name collided with the crate name through the host's `mod vdisplay` shim glob). The host keeps `mod vdisplay { pub use pf_vdisplay::* }` so every crate::vdisplay::* path (serve/mgmt/native/the capture FrameChannelSender seam) is unchanged; the heavy deps (wayland/ashpd/tokio + the zkde protocol) moved with the crate. Co-authored: a fail-closed IOCTL-reply-length security fix (reject short/zeroed pf-vdisplay driver replies before trusting protocol_version/target_id/wudf_pid/luid, security-review 2026-07-17) rides this commit in the moved driver module. Verified: Linux clippy -D warnings (pf-vdisplay + host nvenc,vulkan-encode,pyrowave --all-targets) + pf-vdisplay 63/63 + host 167/167 tests; Windows clippy -D warnings (pf-vdisplay --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:14:08 +02:00
enricobuehlerandClaude Opus 4.8	f6c6e4e594	refactor(host/W6.2): extract the input-injection backends into the pf-inject crate ... inject.rs + inject/* (the per-OS injectors — wlroots virtual-input, KWin fake_input, libei/reis, gamescope-EI on Linux; SendInput on Windows — plus the virtual-gamepad HID stack: DualSense/DualShock4/Switch Pro/Steam Controller/Deck over uhid/usbip and the Windows UMDF drivers, the proto codecs, the injector service, and the uhid manager) move into crates/pf-inject behind the InputInjector trait (plan §W6). It consumes punktfunk_core::input (the neutral GamepadEvent/InputEvent vocabulary, moved to core in W5) + the pf-driver-proto wire contract, and reaches pf-capture only for the Windows gamepad-channel WUDFHost check + the resident-mouse compose-kick hook. The one inject->vdisplay coupling (the libei gamescope-EI backend needs the EIS relay socket path) is broken via a leaf: gamescope_ei_socket_file moves to pf-paths as the shared contract — the gamescope producer (host vdisplay) keeps its session-env-lock wrapper around it, the libei consumer (pf-inject) reads it directly post-retarget. The host keeps a `mod inject { pub use pf_inject::* }` shim so every crate::inject::* path (the native/gamestream input planes + devtest) is unchanged; the heavy input deps (wayland/reis/xkbcommon/usbip + the KWin fake-input protocol XML) moved with the crate. Verified: Linux clippy -D warnings (pf-inject + host nvenc,vulkan-encode,pyrowave --all-targets) + pf-inject 69/69 + host 230/230 tests; Windows clippy -D warnings (pf-inject --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 11:52:02 +02:00
enricobuehlerandClaude Fable 5	0992548de7	feat(host/windows): HID compose kick — wake and dirty the display through the virtual mouse (lid-closed first-frame fix) ... The final piece of the lid-closed field report (fixes 1-3: 3d9b3290; prerequisites: 85dd2bb0 pf-mouse, 845a9760 leaf primitives, 94ca4041 pf-capture hook): the IDD first-frame gate can only pass if DWM composes at least one frame, and a lid-closed/locked/idle machine is exactly the state Windows has decided not to compose in. The SendInput compose kick is conditional on this process's context — wrong session → wrong input queue; secure desktop → blocked; display powered off → no wake. A report from the resident pf-mouse HID device is REAL input to win32k: session-independent, secure-desktop-proof, wakes a powered-off display, counts as user presence. Parsec-class mechanism, and semantically honest — a remote user starting a stream IS a user arriving at this machine. - hid_kick(rect, bounds): newest-wins kick slot + condvar, serviced by the keeper thread that owns the ONE process-wide VirtualMouse (a second open() would squat the bootstrap mailbox). Not-ready (opt-out, driver missing, not yet attached) returns false → the capture crate falls back to SendInput. - perform_kick: park the pointer at the target display's center, dwell 35 ms (Stage-W3: DWM samples cursor position at the next vsync tick; the gaps also keep reports from coalescing in the driver's 8 ms timer), wiggle ~2 px, restore the saved position. Desktop→HID coordinates normalize against pf_win_display::desktop_bounds() (CCD union — correct from any session, unlike per-session GDI metrics). - ensure_resident registers the hook (pf_capture::HID_COMPOSE_KICK) — the one-way-edge inversion: pf-capture never reaches into inject. - keeper loop: condvar wait (250 ms tick) so a kick executes immediately, not at the next tick; publishes MOUSE_READY from driver_proto. Paired with pf-frame's DisplayWakeRequest (held by the capturer from before the first-frame gate): the power request keeps the display from going dark mid-session, the HID kick wakes it when it already is. Verified on winbox: combined-tree cargo check + clippy for punktfunk-host, pf-capture, pf-frame, pf-win-display all EXIT 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 11:30:32 +02:00
enricobuehlerandClaude Opus 4.8	94ca4041ca	refactor(host/W6.2): extract the frame-capture backends into the pf-capture crate ... capture/linux (PipeWire portal) + capture/windows (IDD direct-push: dxgi mechanics, idd_push + submodules, synthetic_nv12) + pwinit move into crates/pf-capture behind the Capturer trait + synthetic sources (plan §W6). The crate speaks pf-frame (CapturedFrame/PixelFormat + the DXGI identity), pf-zerocopy (CUDA import), and the pf-win-display leaves, and NEVER pf-encode — the capture->encode edge is one-way. This completes the deliberate capture/encode crate split (the invasive path the plan had merged into one pf-media): capture and encode are now separate subsystem crates sharing only pf-frame. Four seams keep the capturer off the orchestrator: - VirtualOutput is EXPLODED into primitives (remote_fd/node_id/preferred_mode/ keepalive) by the host facade, so pf-capture never depends on the vdisplay type; - FrameChannelSender: the sealed-channel delivery is a Send+Sync closure the host facade builds from the pf-vdisplay control device + send_frame_channel IOCTL and hands in; ChannelBroker holds the closure instead of the control HANDLE (the whole-desktop handle-duplication security boundary is byte-for-byte unchanged); - console_session_mismatch + desktop_bounds live in pf-win-display (leaf peers); - pwinit moves here (audio caller -> pf_capture::pwinit). The host keeps capture.rs as a thin BRIDGE: it re-exports the vocabulary + capturer types (every crate::capture::* path is unchanged) and keeps open_portal_monitor / capture_virtual_output, which resolve the ZeroCopyPolicy + FrameChannelSender and call into pf-capture. verify_is_wudfhost + install_gpu_pref_hook are re-exported (the gamepad-channel bootstrap + the main.rs subcommand consume them). Co-developed: the resident-HID-mouse compose-kick hook (HID_COMPOSE_KICK + the HID-first cursor kick + _display_wake) rides this commit into pf-capture; the host mouse_windows registration side lands separately on top. Verified: Linux clippy -D warnings (pf-capture + host nvenc,vulkan-encode,pyrowave --all-targets) + host tests 299/299; Windows clippy -D warnings (pf-capture --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 11:28:56 +02:00
enricobuehlerandClaude Fable 5	845a97601d	feat(pf-frame,pf-win-display): leaf primitives for the lid-closed first-frame fix ... Three leaf-crate additions the IDD-push capturer (pf-capture, plan §W6 C6) builds on — committed ahead so the capture-crate extraction and the HID compose kick can land on top: - pf-frame session_tuning::DisplayWakeRequest — RAII PowerCreateRequest/ PowerSetRequest(PowerRequestDisplayRequired + SystemRequired), the service-grade 'someone is watching this screen' assertion (visible in powercfg /requests), held for a capture session so the console cannot drop into display-off mid-stream. Object-lifetime, unlike the thread-bound ES_* flags in on_hot_thread. Prevention only: no power request turns an already-off display back on — that wake is input's job (the virtual-mouse compose kick). - pf-win-display win_display::desktop_bounds() — the virtual-desktop bounds as the union of every ACTIVE CCD path's source rect. From the CCD database (global), NOT GetSystemMetrics (a per-session view), so a non-console-session host still aims HID absolute coordinates at the console's real layout. - pf-win-display console_session_mismatch() — the session guard from 3d9b3290, copied into the leaf so pf-capture reads it as a peer instead of reaching into the orchestrator (relocation authored by the W6 extraction session). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 11:17:29 +02:00
enricobuehlerandClaude Fable 5	85dd2bb077	feat(host/windows): resident virtual HID mouse (pf-mouse UMDF minidriver) ... Headless Windows hosts (no dongle) stream an INVISIBLE cursor: with no pointing device present win32k reports SM_MOUSEPRESENT=0 and DWM never composites a pointer into the pf-vdisplay frame, even though SendInput moves it. Keep ONE virtual HID mouse devnode alive for the host's lifetime — the Sunshine/Parsec-class fix, zero client changes. - pf-mouse: UMDF2 HID minidriver, one fixed identity (PF:MO 5046:4D4F, obviously virtual, nothing fingerprints it), one 8-byte input report (5 buttons + absolute 15-bit X/Y + wheel + AC-pan). Transport is the sealed pad channel verbatim (Global\pfmouse-boot-0 mailbox + unnamed MouseShm DATA section) so pf-umdf-util's audited layer serves it unchanged; report delivery is event-driven (idle = no HID traffic). - host: inject::mouse_windows — VirtualMouse (SwDeviceCreate'd devnode + channel), ensure_resident() keeper thread started by every InjectorService (process-wide, PUNKTFUNK_NO_VIRTUAL_MOUSE opts out), vmouse-spike on-glass validation (cursor sweep via HID reports). - proto: mouse module (magic, boot-name, identity, report layout, unit-tested input_report packing). - SwDeviceProfile grows container_tag so the mouse's ContainerId family (PFMO) never groups with a pad's (PFDS) in the Devices UI. - packaging: pf-mouse rides the gamepad-driver build + install pipeline (build-gamepad-drivers.ps1, windows-drivers.yml, driver install --gamepad picks up every staged .inf). On-glass validated on winbox: devnode + HID child bind, SM_MOUSEPRESENT=1 with no physical mouse, cursor sweeps via HID reports (vmouse-spike). This work was implemented in a parallel session; committed here as the build prerequisite for the HID compose kick that follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 11:02:10 +02:00
enricobuehlerandClaude Fable 5	3d9b329084	fix(host): name the lid-closed/no-frames failure — display-write decode, console-session guard, driver-truth attach diagnostics ... Field report (Windows laptop, lid closed, Tailscale): v0.12.0's activation fix works — the pf-vdisplay target activates in ~200ms — but the session still dies at the first-frame gate: 'driver_status=1 but no frame published within 4s'. Triage showed three independent blind spots; this names all of them at their source instead of guessing downstream: - pf-win-display: decode ChangeDisplaySettingsExW failures (-1 FAILED — a display write rejected, the wrong/remote-session signature — vs -2 BADMODE, which the old 'mode not advertised?' text conflated), and WARN on every non-zero SetDisplayConfig rc in the CCD isolate even when verification passes vacuously (the lid-closed case: nothing else active, so the INFO swallowed rc=0x5 ERROR_ACCESS_DENIED while the load-bearing COMMIT_MODES → ASSIGN_SWAPCHAIN re-commit silently never applied). Access-denied rcs get the remedy appended (console session / installed service). - host: console-session guard (interactive::console_session_mismatch) — a host outside the active console session (a hand-launched host after an RDP round-trip) fails every display write, reads the wrong session's GDI view, and its SendInput compose kicks go nowhere. Named ERROR at vdisplay acquire + appended to the first-frame timeout, instead of the misleading generic failure. (The idd_push diagnosis half of this landed in 9a36ea21; this commit adds the proto helpers + session guard it references, healing the windows-cfg build.) - proto + driver: while OPENED, driver_status_detail now carries a live packed word (bit31 live-marker | offered 15-bit | mismatch-dropped 16-bit) maintained by the publisher, so the host's first-frame timeout can tell apart: never-attached (no swap-chain worker ran), attached-but-DWM-composed- zero-frames (undamaged/powered-off desktop, kicks blocked on the secure desktop), and composed-but-every-frame-mismatched (ring sized from a stale/ foreign-session GDI mode). Zero layout change, old drivers read as 'no detail'; unit-tested pack/unpack in pf-driver-proto. Verified on winbox: cargo check + clippy -p punktfunk-host -p pf-win-display -p pf-driver-proto EXIT 0, drivers ws cargo check -p pf-vdisplay EXIT 0 (Version_Number=10.0.26100.0), cargo fmt --all --check clean; pf-driver-proto tests 13/13 pass locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 10:47:47 +02:00
enricobuehlerandClaude Opus 4.8	9a36ea2132	refactor(host/W6.2): extract the video encode backends into the pf-encode crate ... encode.rs + encode/* (NVENC, VAAPI, native AMF, AMF/QSV ffmpeg, direct-SDK NVENC/CUDA, raw Vulkan-Video, PyroWave, openh264) move into crates/pf-encode behind one Encoder trait + open_video selector (plan §W6). The crate speaks the shared frame vocabulary (pf-frame: CapturedFrame/PixelFormat + the DXGI identity D3d11Frame/make_device) and pf-zerocopy (CUDA context/buffers), and NEVER pf-capture — the capture→encode edge is one-way (ZeroCopyPolicy, prior commit). Dep moves: the heavy encoder deps (ffmpeg-next, the NVENC SDK, openh264, pyrowave-sys) move from the host to pf-encode; the host's nvenc/amf-qsv/vulkan-encode/pyrowave features now FORWARD to pf-encode/*. The host keeps a mod-encode shim (pub use pf_encode) so every crate::encode::* path (negotiator + GameStream/native/mgmt planes) is unchanged. resolve_render_adapter_luid moves from the host's windows/win_adapter.rs into pf-gpu (both pf-encode and pf-capture need it as a peer of GPU selection); its 5 call sites (encode amf/nvenc, capture idd_push/synthetic_nv12, vdisplay manager) rewire to pf_gpu::resolve_render_adapter_luid and win_adapter.rs is deleted. pf-frame's make_device gains a # Safety section (public-unsafe-fn lint, latent since the pf-frame carve — a full-workspace -D warnings clippy catches it). Verified: Linux clippy -D warnings (pf-encode + host nvenc,vulkan-encode,pyrowave --all-targets) + 13/13 pf-encode + 299/299 host tests; Windows clippy -D warnings (pf-encode nvenc,amf-qsv --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:42:51 +02:00
enricobuehlerandClaude Opus 4.8	1de83ba51d	refactor(host/W6.2): make the Linux capture→encode edge one-way via ZeroCopyPolicy ... The PipeWire capture thread re-derived three encode-backend facts by calling encode::{linux_zero_copy_is_vaapi, resolved_backend_is_gpu, pyrowave_capture_modifiers} — a capture→encode back-reference that would force pf-capture to depend on pf-encode (and vice versa, since encode already speaks the frame vocabulary). Resolve them ONCE in the host capture facade (which may reach crate::encode) as a ZeroCopyPolicy { backend_is_vaapi, backend_is_gpu, pyrowave_modifiers } and thread it into PortalCapturer::open / from_virtual_output → spawn_pipewire → pipewire_thread. capture/linux/mod.rs now makes ZERO crate::encode calls — the edge is one-way (plan §2.4 / §W6), so pf-capture can be extracted depending only on pf-frame (not pf-encode). pyrowave_modifiers is computed by the facade whenever the encoder pref is pyrowave (which implies the VAAPI backend); the thread still consumes them only inside its existing vaapi_passthrough guard, so behavior is unchanged. Verified: Linux clippy -D warnings (host nvenc,vulkan-encode,pyrowave --all-targets); Windows clippy nvenc,amf-qsv --all-targets Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:20:17 +02:00
enricobuehlerandClaude Opus 4.8	ccc4b08d45	refactor(host/W6.2): extract the Windows display-topology cluster into the pf-win-display leaf crate ... windows/{win_display,monitor_devnode,display_events}.rs move into crates/pf-win-display: the CCD/GDI path-activation + mode-set + HDR advanced-colour + source-rect helpers, the PnP monitor-devnode enable/disable lever, and the WM_DISPLAYCHANGE / device-arrival watch. The coming pf-capture crate's IDD-push capturer consumes all three; the host's pf-vdisplay backend consumes win_display + monitor_devnode. A leaf lets both depend on them as a PEER instead of the capturer reaching back into the orchestrator (plan §W6). win_display's one external tie (crate::vdisplay::Mode) becomes the underlying punktfunk_core::Mode; the cluster is otherwise self-contained (pf-paths for the state file, serde_json for it, windows). pub(crate) items bump to pub at the boundary; win_display carries a module-level allow(missing_safety_doc) to keep the pre-carve behavior (the FFI helpers were pub(crate) unsafe fn with prose safety docs — the lint only fires once they're pub, and this is an internal publish=false leaf). The host imports the three modules at its crate root, so every crate::{win_display,monitor_devnode,display_events}::* path is unchanged. Verified: Linux clippy -D warnings (leaf empty + host nvenc,vulkan-encode,pyrowave --all-targets); Windows clippy -D warnings (pf-win-display --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:14:17 +02:00
enricobuehlerandClaude Opus 4.8	b168790e0a	refactor(host/W6.2): extract the shared frame/format vocabulary into the pf-frame leaf crate ... The captured-frame types both capture (producer) and encode (consumer) speak — PixelFormat, OutputFormat, CursorOverlay, CapturedFrame, FramePayload, DmabufFrame, drm_fourcc — move into crates/pf-frame, alongside the small pure helpers that ride the same seam: hdr (HDR static metadata / in-band SEI), metronome (the metronomic-stall detector), thread_qos (per-thread scheduling QoS), session_tuning (Windows process tuning), and the Windows DXGI capture IDENTITY (WinCaptureTarget, D3d11Frame, pack_luid, make_device + the GPU scheduling-priority hardening it applies) (plan §W6). This is the crate that breaks the capture<->encode cycle: FramePayload's GPU variants own their backends from BELOW (Cuda -> pf_zerocopy::DeviceBuffer, D3d11 -> dxgi::D3d11Frame), so encode can speak the vocabulary without a path to capture, and vice versa. The Windows DXGI identity moving here lets capture, encode, and pf-vdisplay share ONE WinCaptureTarget/device factory instead of the old capture<->encode<->vdisplay reach-in. The host keeps thin facades: capture.rs re-exports the vocabulary (crate::capture::{PixelFormat,…} unchanged); capture/windows/dxgi.rs keeps the win32u GPU-preference hook + HDR/video-engine converters + self-test and re-exports the identity; native.rs re-exports boost_thread_priority from pf_frame. crate::hdr/metronome/session_tuning callers rewired to pf_frame::*. metronome's Metronome::new gained a Default impl (new_without_default fires once the type is public across the crate boundary). Verified: Linux clippy -D warnings (pf-frame --all-targets + host nvenc,vulkan-encode,pyrowave --all-targets) + 9/9 pf-frame tests; Windows clippy nvenc,amf-qsv --all-targets Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:03:56 +02:00
enricobuehlerandClaude Fable 5	6824c1cc0c	feat(core): Automatic bitrate climbs only through validated territory — utilization gate + proven-throughput cap ... The controller's target is only a promise: on calm content the encoder emits a fraction of it, every window looks clean while proving nothing, and the climb drifts the target into rates the decoder has never seen. The first motion spike is then the first real test — it fails, and the decoder is overloaded for the two-window backoff latency (the reported settle-calm-then-spike stutter). Three changes, all client-side (no wire/ABI impact, old hosts unaffected): - Climb gate: a clean window authorizes a climb only when its ACTUAL delivered throughput reached 3/4 of the current target — the target was genuinely tested. Calm windows still bank clean credit; the first loaded window after a clean run climbs immediately. - Proven-throughput cap: climbs step at most x1.5 past the session's high-water mark of delivered-and-digested (decode-latency-flat) throughput, so slow start becomes a bounded experiment instead of a blind doubling. High-water never decays: calm periods keep a validated target, so returning motion gets the full rate instantly; shrinking capacity (thermals) stays the reactive decode signal's job. - Severe decode excursion: a >45 ms-over-baseline decode spike backs off after ONE window instead of two — the overload is already on screen. The pump feeds the window's wire-byte throughput; the byte baseline is rebased when the startup capacity probe completes so FLAG_PROBE filler can't poison the proven mark with the link rate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:55:09 +02:00