2 Commits

Author	SHA1	Message	Date
enricobuehler	de7b54d4e0	fix(core): remaining 15 sweep lows — client, clipboard, C ABI (v10), FEC, GSO, GTK ... Second and final batch from the 2026-07-20 core-sweep lows: client: - connect() timeout now sets `quit` before shutdown, so a handshake that completes after the deadline closes with QUIT_CLOSE_CODE instead of leaving the host lingering (virtual display up) for a reconnect that never comes. - probe_result: saturating_add on the wire-supplied wire_packets + send_dropped counters (debug-build overflow panic / release wrap). - the standing-latency bleed no longer sets flush_in_window: that flag is the ABR's SEVERE (×0.7) verdict, and the bleed fires only on provably loss-free windows the controller itself scores as fine. clipboard: - fetch_cancels pruned on every new fetch (was: one dead oneshot per paste for the session). - serve chunks gated on a parked waiter + capped at CLIP_FETCH_CAP with an Error event (was: unbounded silent accumulation under any req_id). - serve_inbound park bounded by FETCH_STALL_SECS + send.stopped() (was: an unanswered FetchRequest parked the task, waiter, and bi-stream forever; ~100 of them exhaust the connection's bidi budget). C ABI (ABI_VERSION 9 → 10, header regenerated, additive only): - new punktfunk_connection_clock_offset_now_ns — the LIVE re-synced offset (Swift/Kotlin latency math read the frozen connect-time value ~40ms wrong after a wall-clock step). - to_config: checked u64→usize narrowing of max_frame_bytes (32-bit armeabi truncated >4GiB to a plausible residue). - host_poll_input: no &mut held across the embedder callback (re-entry aliased it — UB under noalias); mid-drain callback clears now stick. - next_audio_pcm: DTX (empty) payloads skipped — decode synthesized 120ms of concealment per 5ms slot and grew the playout ring forever. - next_clipboard releases the parked payload on an empty poll (a one-off 50MiB paste stayed resident all session). - frames_dropped / wants_decode_latency write their documented 0/false defaults before the NULL-handle check. - gamepad constant docs match pick_gamepad() reality (DualSenseEdge/ SwitchPro landed; DualSense/DS4 honored on Windows UMDF too). FEC: - gf8 reconstruct/reconstruct_into reuse the (k,m) codec cache like encode_into (was: fresh 230×200 generator + decode inversion per lossy block on the pump thread). - vendored fec-rs: the 8 safe wrap_mul_slice shims assert equal lengths (x86 SIMD callees bound stores on input.len() — safe-code OOB write); ReconstructShard's safety contract gains the len()==get().len() clause and reconstruct_internal sizes raw slices from the slice. transport/GTK: - Linux GSO super-buffer capped at the real UDP payload ceiling (65487) not 65535 — seg sizes ≥1024 could EMSGSIZE and latch GSO off process-wide, blamed on the network. - GTK settings dialog no longer rewrites an unlisted-but-valid stored gamepad preference to "auto" on close. Already fixed on main (verified stale, skipped): the reassembler FEC ceiling, wants_decode_latency's third term, request_probe rollback + the generalized probe watchdog. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:26:43 +02:00
enricobuehler	4ef90d586d	feat(clipboard): wire protocol + client-core task for shared clipboard (Phase 0) ... The portable shared-clipboard plane in punktfunk-core, all behind the `quic` feature (design/clipboard-and-file-transfer.md §3): - Control messages 0x40–0x44 (ClipControl / ClipOffer / ClipFetch...) and the HOST_CAP_CLIPBOARD capability bit, negotiated in the Welcome caps. - Per-transfer QUIC bi-streams ("PKFs" magic) for lazy fetch of offered content, with ClipFetchHdr status/size framing (quic::clipstream). - The §3.5 portable wire-MIME vocabulary (text/plain;utf-8, text/html, text/rtf, image/png) shared by both ends. - Client-side clipboard task (client.rs) + C ABI surface bumped to v8 (abi.rs, regenerated include/punktfunk_core.h). - Loopback transport tests (quic::tests). No OS clipboard integration yet — that is the host backends (Phase 1/3) and the macOS client (Phase 1). Ported from feat/shared-clipboard (af3a7d8c, pre-W6 base) onto current main; three deliberate deviations from the original commit: - ABI v6 → v8: main took v6 (reanchor gate) and v7 (typed connect rejection) in the meantime; the clipboard C surface re-lands as v8. - CLIP_CANCELLED_CODE 0x60 → 0x70: main's pairing-rejection close codes claimed the 0x60–0x67 block; the vocabularies stay disjoint on purpose. - Negotiated.host_caps coexists with main's 6-tuple host_caps plumbing: main needs the worker-local copy for gamepad snapshots, the clipboard path needs it across ready_tx to build the NativeClient handle (punktfunk_connection_host_caps). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:50:37 +02:00