1587 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	87d7eceabf	fix(encode/qsv): write the colour VUI unconditionally + Intel-lane colour diagnostics ... The native QSV encoder only attached mfxExtVideoSignalInfo on HDR sessions — an SDR stream carried no colour description at all (NVENC writes 709-limited unconditionally; qsv.rs now mirrors it). Diagnostics for the field-reported blue/magenta Intel-host colours: - hdr-p010-selftest takes an optional WxH + GPU vendor (intel|nvidia|amd) and prints which adapter it tested — 64x64 on the default GPU proved nothing on dual-GPU boxes, and the field heights (1080/1400) are not 16-aligned. - pf-capture: ignored live test running the converter at 1920x1080 pinned to the Intel adapter. - pf-encode: qsv_live_p010_1080_colorbars_dump — known P010 bars through the UNALIGNED-height ingest copy (1080 src -> align16 1088 pool, the seam no 640x480 test exercises) to Main10 HEVC, dumped for off-box decode checks. - dxgi.rs: drop the stale 'falls back to the R10 path' claim (no such path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehler	1d4795666e	feat(linux/vulkan-encode): opt-in gamescope producer-native NV12 encode source ... With PUNKTFUNK_PIPEWIRE_NV12=1 (bring-up gate), the PipeWire negotiation offers an NV12 LINEAR DMA-BUF pod (BT.709 limited pinned MANDATORY) ahead of the BGRx one, and gamescope's producer-side RGB->YUV pass replaces the host CSC entirely: the encoder imports the two-plane buffer as a profiled VIDEO_ENCODE_SRC image and the VCN encodes it directly. Contributed measurements: encode p99 2.9 ms (from ~4-4.5 ms via EFC RGB-direct), 60 fps capture, 0 send drops. Hardening on top of the contributed patch: - unaligned modes (1080p!) stage through a padded aligned NV12 copy (edge rows/columns duplicated, transfer-only) instead of direct-importing the visible-size buffer -- a direct import would make the VCN read past the producer allocation, the exact OOB class behind the 2026-07-20 field GPU reset; the encode extents return to the aligned coded extent everywhere - the UV plane layout honors the producer's plane-1 chunk (offset/stride) when the SPA buffer carries one (same-BO verified by inode), with the contiguous-plane contract as fallback - PyroWave sessions are excluded from the gate (their Vulkan compute CSC ingests packed RGB), and a native-NV12 session that resolves to libav VAAPI (H264 codec, PUNKTFUNK_VULKAN_ENCODE=0, feature off, or a failed Vulkan open) refuses at open instead of streaming garbage chroma - pad staging images carry TRANSFER_SRC (the width-padding pass self-copies the staging image -- previously missing on 1366-wide modes) - metadata-cursor one-shot warn (parity with RGB-direct) and a padded-NV12 PUNKTFUNK_PERF split label; the padded RGB copy gets its timestamps too Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 11:57:42 +02:00
enricobuehler	58b27acbd5	fix(vdisplay/session): scrub the dead desktop's WAYLAND_DISPLAY from the user-manager env ... settle_desktop_portal pushes the live desktop's WAYLAND_DISPLAY into the systemd --user manager (import-environment) so a re-activated portal inherits the right session — but the import PERSISTS after that desktop dies. Every later user unit then inherits the stale socket, including gamescope-session.target: gamescope sees WAYLAND_DISPLAY, runs NESTED, and aborts with "Failed to connect to wayland socket: wayland-0" — observed live on a Deck, where Game Mode could not start at all (autologin crash-looped) until the var was unset by hand. Two-layer fix, mirroring the protection launch_session already gives its transient unit: - observe_session_instance: when a desktop compositor instance goes away, unset WAYLAND_DISPLAY/DISPLAY from the manager env (a desktop bounce is harmless — the next portal settle re-imports). - write_steamos_dropin: UnsetEnvironment=DISPLAY WAYLAND_DISPLAY on the takeover drop-in, unit-scoped belt-and-suspenders for host-initiated restarts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 11:06:55 +02:00
enricobuehler	333c8979e9	fix(vdisplay/gamescope): capture-loss rebuild probes must not steal the box session ... Observed live on a Deck host: the user switched Game Mode → Desktop, KDE came up in 0.8 s — and the capture-loss rebuild's FIRST detection ran inside that gap, still said Gaming, and its gamescope re-acquire restarted gamescope-session.target. On SteamOS that steals the seat: the user was yanked out of the KDE session they had just chosen, the two session managers fought (job canceled / dependency failed), no gamescope node appeared within 30 s, and the stream died at the 40 s rebuild budget. A rebuild probe acting on possibly-stale detection must never stop, relaunch, or take over box sessions. New pf_vdisplay::rebuild_probe_scope (RAII, counted): while held, the gamescope managed/takeover create paths only attach to a live node and fail fast otherwise — no stop_autologin_sessions, no session-plus relaunch, no gamescope-session.target restart. The capture-loss loop holds it for the first 4 s after a loss (the detection-ambiguity window); after that, destructive rebuilds are allowed again, so a genuine switch INTO Game Mode still gets its headless takeover. Probe failures are instant, so the loop now paces itself at ~2 Hz instead of spinning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 11:00:02 +02:00
enricobuehler	46d09ed973	fix(host/linux): stop burning retry budget on doomed pipeline builds ... Two session-transition stalls found live on a SteamOS Deck host, one cause: the pipeline retry loop couldn't tell a wait-it-out failure from a retry-now-and-it-works one. - Gamescope first-frame race: a PipeWire stream connected while gamescope re-initializes its headless takeover negotiates a format, reaches Streaming, and never receives a buffer — while a fresh connect delivers within ~0.5 s. Every gamescope bring-up ate the full 10 s first-frame budget on attempt 1 (17 s bring-ups; KWin: 1.2 s). The retry loop's FIRST attempt now waits 2.5 s (Capturer::next_frame_within), so the reconnect that fixes the race happens at ~3 s. Later attempts keep the patient 10 s — the documented 30-60 s Big Picture cold start still fits the budget. - Capture-loss rebuild vs session switch: the rebuild loop re-detects the active session between build_pipeline_with_retry calls, but each call burned 8 attempts (~13 s) against a compositor that no longer exists (a Desktop→Gaming switch spent 13 of its 27 s retrying gone-KWin). The capture-loss path now passes max_attempts=2, turning the outer loop into ~1 s detect-and-retry cycles that follow the box to the new session. The resize path's direct build_pipeline call keeps the default budget (no retry wrapper there to absorb an early bail). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 10:34:49 +02:00
enricobuehler	946f1b3d69	fix(steamdeck): build the host with vulkan-encode, and wire up what it needs to actually engage ... The SteamOS scripts built the host featureless, so PlatformAuto could never pick the Vulkan Video backend (default-on since 84329205) and every session silently ran libav VAAPI — unlike the deb/arch/rpm/sysext builds, which all pass the feature. Three gaps, found live on a Deck host: - install.sh/update.sh: cargo build with --features punktfunk-host/vulkan-encode (matches the packaged builds; pure-Rust ash, no new system dep). - host.env: RADV_PERFTEST=video_encode — Van Gogh RADV still gates VK_KHR_video_encode_* behind it, so without it the backend can't open and falls back to VAAPI. Harmless where encode is exposed by default. - io.unom.Punktfunk.Host.desktop (Exec rewritten to this install's binary): KWin only grants zkde_screencast_unstable_v1/org_kde_kwin_fake_input to an exe a .desktop authorizes — without it Desktop-Mode capture fails outright and a mid-stream Game↔Desktop switch strands the stream on the old backend. update.sh retrofits the last two idempotently so existing installs get them without a reinstall. Validated on a SteamOS 3.8.14 Deck (Van Gogh): Vulkan HEVC opened on both the KWin and gamescope paths at 5120x1440 — in-place ABR reconfigure (no IDR, no encoder rebuild) vs the VAAPI path's full teardown per ABR step, and Desktop capture came up without a re-login. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 10:14:31 +02:00
enricobuehler	7c0313a7cb	fix(web): flush card content, so a full-bleed table stops doubling its inset ... `<CardContent className="p-0">` never removed the padding it looked like it removed: tailwind-merge resolves conflicts within a variant, so `p-0` cancels `p-4` but leaves `sm:p-6` standing. Every call site that used it nests a CardHeader inside, which brings its own `sm:p-6` — so at >=640px the title sat 24px further in than its neighbours'. Visible on the Plugins page as 'Installed plugins' not lining up with 'Plugin runner'. Give CardContent a `flush` prop that omits the padding outright, and use it at the three call sites (Store, Pairing, Stats) rather than fixing the symptom three times and leaving the footgun in place. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.17.0	2026-07-21 00:25:31 +02:00
enricobuehler	04c975e9cb	fix(store): uninstall must refuse a plugin's framework, not just odd names ... The guard checked the package NAME shape, and `@punktfunk/plugin-kit` — the framework every kit-built plugin depends on — matches `@scope/plugin-*` exactly. Windows on-glass accepted an uninstall of it; bun no-ops removing a non-dependency so nothing broke, but the store was offering to pull a library out from under the plugins using it. Require membership in the top-level dependency list, the same authority that already keeps plugin-kit out of the installed listing. Same blind spot, two call sites — the listing was fixed during implementation, this one wasn't. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 00:10:49 +02:00
enricobuehler	402ec90edc	fix(web/store): restore the plugin cards' top padding, and capitalise platform names ... Two things looked wrong in the store: The cards had no space above the icon. `CardContent` zeroes its own top padding (`pt-0`/`sm:pt-0`) because it normally sits under a `CardHeader` that supplies it — but these cards have no header, so the top padding simply vanished while the other three sides kept `p-card`. `p-card` does not undo it: `card` is a custom `--spacing-*` token, which tailwind-merge does not recognise as a spacing value and so never dedupes against `pt-0`, leaving the longhand to win. Both header-less cards in this section now restore it explicitly, at both breakpoints. Platform chips read "windows" / "linux". Those are the catalog's platform IDENTIFIERS (the index validator pins `linux | windows | macos`), which is right for the wire and wrong on screen; the card now maps them to display names — Linux, Windows, macOS. Proper nouns, so deliberately not routed through i18n. Adds Store/StoreCard stories covering the padding, the platform labels, and the installed / update / incompatible / blocked / external states, so the card can be eyeballed without a host or a catalog.	2026-07-21 00:00:37 +02:00
enricobuehler	d783d5445c	chore(release): bump workspace version to 0.17.0	2026-07-20 23:55:51 +02:00
enricobuehler	67b7981096	feat(encode/nvenc-linux): LN1 phase-3 — multi-slice sub-frame encode DEFAULT-ON for Linux direct-NVENC ... Gates recorded (nvenc-subframe-slice-output.md Phase 3): loss-harness curve identical streamed-vs-whole; adversarial security review clean; live .21 3-leg A/B — streamed 0 corrupted frames, p99 8527→5363 µs vs sliced-whole, first_slice_us ~500 µs of a ~1250 µs encode reaching the send thread; wire bytes rate-governed under CBR + 1-frame VBV (the ~1-2 % slice-header cost is absorbed by rate control, not added to the wire). GameStream: plane has zero code diff (own RTP packetizer; shares only untouched send_pacing); a live Moonlight re-test joins the standing owed Moonlight item. - resolve_slices(codec, default): env 1..=32 wins (1 = the NEW explicit single-slice escape), else the backend default — 4 on Linux direct-NVENC, 1 elsewhere. resolve_subframe(default_on): PUNKTFUNK_NVENC_SUBFRAME tri-state (0 = never, 1 = force, unset = backend default). - Linux nvenc_cuda: resolves both ONCE in query_caps — the sub-frame default is gated on the GPU's SUBFRAME_READBACK cap so an unsupporting GPU never has enableSubFrameWrite forced into its init params — and feeds the same resolved values to build_config, build_init_params (open AND in-place reconfigure) and the chunked-poll latch. - Windows: env-only as before (async path untouched, byte-identical config for unset env); LowLatencyConfig.slices + the explicit subframe param replace the shared env reads. - Tests: chunked e2e now runs at the DEFAULTS (no knobs); the fallback test becomes the escape test (SLICES=1 disarms; SUBFRAME=0 disarms while 4-slice encode continues on the plain poll path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:44:41 +02:00
enricobuehler	e6cdd79f71	fix(loss-harness): drop the needless mut on send_wires — workspace clippy is -D warnings ... Slipped through 421e8112: the on-box clippy runs covered punktfunk-core and punktfunk-host but not the tools crates; CI's workspace-wide pass caught it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:44:37 +02:00
enricobuehler	7e5ec7eba9	chore(store): repin the official plugin-index signing key ... The bootstrap key generated during implementation was lost, and its replacement was pasted into the wrong repository's secret store — Gitea secrets neither cross repos nor read back, so neither is usable. The private half of this one lives in punktfunk-plugin-index's own INDEX_SIGNING_KEY, which is the only thing that signs the catalog. Nothing has shipped pinning any of these, so this is a straight replacement of slot 0; the second slot stays reserved for a genuine rotation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:25:16 +02:00
enricobuehler	c6caeca5bc	feat(encode): RGB-direct (EFC) is now the DEFAULT on capable hosts — gated by a session cursor-blend hint ... B2 default-on (design/vulkan-rgb-direct-encode.md): wherever the probe passes, Vulkan Video sessions now take the EFC RGB source by default — direct import on aligned modes, padded-copy staging on unaligned ones (1080p). PUNKTFUNK_VULKAN_RGB_DIRECT becomes the override: =0 disables, =1 forces, unset = the default below. The one session class that must NOT default on: cursor-as-metadata captures (every non-gamescope compositor), where the CSC shader's blend IS the visible pointer — the EFC cannot composite, and defaulting there would silently drop the cursor from the stream. The hint rides the existing plumbing: - SessionPlan gains cursor_blend, resolved once where the compositor is known (gamescope embeds the pointer itself → false; kwin/mutter/ wlroots/hyprland → true), and shows up in the logged plan line. - open_video/open_video_backend thread it through (native pump: all three encoder-open sites read plan.cursor_blend; GameStream monitor capture: true — it negotiates metadata cursor; spike: false). - VulkanVideoEncoder::open resolves: env override, else ON iff the session never hands us cursor bitmaps. The warn-once for a cursor on an RGB session (forced via =1) stays. Verified on-hw box (Linux): pf-encode + punktfunk-host compile, clippy clean, unit suite green. The GPU paths themselves are unchanged from the smoke-validated 96e19986 — this commit only changes which sessions select them by default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 23:24:46 +02:00
enricobuehler	3736bbdc73	fix(core): streamed-AU hardening from the security-review pass ... Review verdict: no exploitable memory-safety / amplification / splice / resurrection issue; nonce order and two-lane seal byte-identical for the legacy path. Actionable findings applied: - explicit per-block data_shards cross-check next to the recovery_shards one (defense-in-depth — the geometry invariants make it unreachable today, but have_data indexing assumes it) - partial delivery skips an UNPINNED streamed frame (frame_bytes still 0) instead of truncating its max-sized buffer to an empty "partial" - regression tests for the two untested load-bearing guards: the final-first out-of-range-sentinel drop (the exact-sized-buffer guard) and second-final-with-different-totals rejection Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:13:59 +02:00
enricobuehler	421e811225	feat(loss-harness): sweep the streamed-AU wire shape alongside whole-AU ... The Phase-2 gate: more, smaller wire units must not regress FEC recovery. Adds a GF16 streamed column (three chunk pushes + finish per AU — sentinel blocks then real totals). Measured: identical to whole-AU at every loss rate (50/50 through 1/6, the same 25%-budget cliff). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:59:09 +02:00
enricobuehler	79913a430e	feat(probe): advertise VIDEO_CAP_STREAMED_AU ... The probe's reassembler is the shared core one, and the probe is the tool that measures the streamed-AU overlap win — advertise the cap so a host with chunked encode streams to it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:55:34 +02:00
enricobuehler	c5402cb1f7	feat(core+host): LN1 phase-2 — VIDEO_CAP_STREAMED_AU streamed access units ... The wire half of sub-frame slice output (latency §7 LN1, planning design/nvenc-subframe-slice-output.md Phase 2): toward a client that advertises the new cap bit (0x20), a chunked-poll encoder session ships each AU's completed FEC blocks while the tail of the frame is still encoding — the AU's last packet leaves the host as the encode finishes instead of after it. Wire semantics (negotiated; zero change for anyone else): - Non-final blocks ride SENTINEL headers: block_count = 0 (a value no legacy sender emits) + frame_bytes = 0 + exactly max_data_per_block data shards, so the receiver's shard-offset formula needs no total. - The final block's headers carry the real frame_bytes/block_count (+ FLAG_EOF) and RETRO-VALIDATE the whole frame: totals under which a received sentinel block is out of range or not full-K kill the frame wholesale (no spliced delivery) and the index can't be resurrected. - Firewall: sentinels are bounded by the negotiated limits (full-K exactly, never the last block the limits allow, no total to lie about); the exact derived-geometry check runs unchanged on every non-sentinel packet and retroactively at pinning. Sentinel opens commit a max_frame_bytes buffer, bounded by the existing IN_FLIGHT_BUF_FACTOR budget (amplification test). - Order-agnostic like legacy: a reversed frame (final block first) opens legacy-shaped and still accepts its sentinels against the pinned totals. - Small/empty streamed AUs degenerate to byte-identical legacy headers. Host: Packetizer::{begin,push,finish}_streamed seal full-K blocks (data + parity per block) as chunks arrive; Session::seal_streamed_* share the pooled-wire + two-lane seal machinery via the new seal_run; the send thread paces each flush under the frame's existing deadline (pace_sealed split out of paced_submit) and runs the whole-AU accounting at the last chunk; the encode pump forwards poll_chunk output as ChunkMsg when the client has the cap AND the encoder chunks (re-queried per AU — an escalation falls back seamlessly). Probes never run mid-AU. PUNKTFUNK_STREAMED_AU=0 = host escape hatch. Client core ORs the cap into Hello (the shared reassembler carries the support). Sampled first_slice_us vs encode_us PERF log measures the overlap; the 0xCF stage-field extension stays a follow-up. Core tests: streamed round-trip (clean/loss/reorder/duplicate, both orders), sentinel firewall bounds, lying-final wholesale kill + no-resurrect, open-amplification budget, header-shape pins. Gates still owed before default-on: security review pass, loss-harness curve, GameStream smoke (plane untouched structurally), bitrate A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:53:53 +02:00
enricobuehler	9d3b114fd6	feat(encode/nvenc): LN1 phase-1 — slice-boundary chunked encoder poll (poll_chunk/AuChunk) ... The encoder half of sub-frame slice output (latency §7 LN1, planning design/nvenc-subframe-slice-output.md Phase 1): with PUNKTFUNK_NVENC_SLICES=N + PUNKTFUNK_NVENC_SUBFRAME=1 on a sync depth-1 session, Encoder::poll_chunk hands the in-flight AU out as slice-boundary chunks read through doNotWait sub-frame locks while the tail is still encoding — the readback loop the on-hw probe validated (~200 µs slice spacing on the 5070 Ti), productionized. - codec.rs: AuChunk (AU metadata on the first chunk, `last` closes the AU; chunks concatenate to exactly the poll() bytes) + supports_chunked_poll / poll_chunk trait surface. Default impl wraps poll() as one self-closing chunk, so a chunk-driven consumer works against every backend. - nvenc_cuda: chunked readback cut at slice boundaries only (bitstream size at n reported slices = end of slice n, Annex-B contiguous); completion is NEVER numSlices alone — one finishing BLOCKING lock is the authority and the wedge watchdog, so the final chunk blocks exactly like sync poll (the depth-1 pump contract; 6dc195f9 bug class). Keyframe on early chunks is the submit-time IDR prediction (exact under P-only/infinite-GOP), cross-checked at finish. Debug builds shadow-check emitted chunks against the finished AU prefix. Mutually exclusive with pipelined retrieve (gated off when async_rt exists, dropped by the escalation rebuild); composes with stream-ordered submit. - nvenc_core: slices_env/subframe_requested shared parses so the config author and the chunked-poll arming can't disagree. - TrackedEncoder forwards both new methods (the set_wire_chunking trap class). Host loop untouched — Phase 2 (VIDEO_CAP_STREAMED_AU seal/send) consumes this. On-hw: nvenc_cuda_chunked_poll_end_to_end + nvenc_cuda_chunked_poll_fallback_whole_au. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:53:32 +02:00
enricobuehler	411c6dc06a	fix(encode): forward set_pipelined through TrackedEncoder — the LN3 escalation no-oped through the wrapper ... Every session encoder is boxed in TrackedEncoder (open_video), and the wrapper never forwarded Encoder::set_pipelined — so the host loop's contention escalation (ae673158) hit the trait default, which returns false ("backend can't pipeline, stop asking"), and the pipelined-retrieve stage could never engage adaptively. Only the explicit PUNKTFUNK_NVENC_ASYNC=1 open-time path worked. The exact defaulted-method trap the wrapper's own comment documents for set_wire_chunking. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:53:32 +02:00
enricobuehler	833f3348a0	feat(store): console plugin store, index repo, and the fixes on-glass found ... Console: a Plugins section (Browse / Installed / Sources) on a static nav entry, with install friction proportional to trust — a plain confirm for a verified entry, a warning naming the curator for an external one, and a danger dialog that makes you retype the spec for a raw package. Tier badges are permanent and follow the plugin onto its own UI page. Index: unom/punktfunk-plugin-index published and served from Gitea's raw endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is publish, which resolves the design's open hosting question. Four things only running it could find: - runner discovery matched @punktfunk/plugin-* only, so a third-party scoped plugin (which D8 requires) would install and never run - ...and that convention also matches @punktfunk/plugin-kit, a plugin's own framework: it listed as installed and would have been imported as a unit. Both now key off the plugins dir's top-level dependencies, with an emptied dependency list meaning 'nothing installed' rather than falling back to the naming convention - the store must not pass new flags to the runner: the scripting package ships separately and an older one reads an unknown flag's value as a package name. The host writes the bunfig scope mapping itself - ureq reports only >= 400 as Err, so a conditional request's 304 arrives as Ok with an empty body — handled as an error it made every refresh after the first verify a signature over zero bytes and sit stale Also: the console's first Tabs use exposed an @unom/ui theme gap that rendered inactive tabs invisible (caught in a browser pass, not by types). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:48:02 +02:00
enricobuehler	45c3b96907	feat(store): plugin store host module — signed catalogs, tiered trust, install jobs ... The index is the verification gate: a catalog entry pins one exact version plus that version's tarball integrity hash, so 'verified on every release' is a property of the data rather than a promise about process. Nothing can express 'track latest' for a catalogued plugin. - store/index.rs signed index parse + ed25519 verify (ring), validate-and-drop per entry, semver minHost/advisory ranges - store/sources.rs built-in unom source (compiled-in URL + two key slots for rotation) + operator sources in plugin-sources.json - store/catalog.rs https fetch with size/timeout/redirect caps, signature before parse, last-good disk cache (stale-but-usable when offline) - store/jobs.rs single-flight install/uninstall: registry-integrity preflight against the pin, spawn the runner CLI with live log capture, post-install version check with rollback, provenance record, runner restart (discovery is startup-only) - store/manifest.rs install provenance; absence means CLI-installed - mgmt/store.rs 12 routes under /api/v1/store, denied to the plugin token (a plugin that can install plugins is an escalation primitive) Also generalizes runner discovery and listInstalled from @punktfunk/plugin-* to ANY scope's plugin-*: catalog entries must be scoped so the scope can map to that entry's registry, so a third-party plugin necessarily arrives under its own scope and would otherwise install but never run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:48:02 +02:00
enricobuehler	96e19986bc	feat(encode): RGB-direct padded-copy — unaligned modes (1080p) get the EFC path safely ... Lifts 3aacec53's alignment gate into a mode select: an aligned mode keeps the true zero-copy direct import; an unaligned one (1080p!) now blits the visible frame into a per-slot ALIGNED BGRA staging image and duplicates the edge rows/columns into the 64x16 padding — transfer-only regions in one vkCmdCopyImage (1080p: visible + 8 row regions; width padding adds a second self-copy pass in GENERAL), no compute shader. The encode reads the staging image, never the capture buffer, so the EFC can never read past a producer allocation (the field GPU hang). Still one ~8 MB copy vs the CSC path's ~17 MB + dispatch + plane copies. Verdict line: active(padded-copy). The staging import drops the video profile entirely (TRANSFER_SRC only). CPU-payload paths made honest on the way (they were the smoke baseline AND the software-capture fallback): - rgb mode: the staging upload is padded CPU-side (edge duplication) so the aligned encode-src is fully defined; - CSC mode: the sampled image is now SOURCE-sized with a matching copy extent — the old aligned-size image + tightly-packed buffer sheared rows and left garbage rows at unaligned modes (black-bar artifacts; YMIN=16 in every smoke frame), which also masked as a 24 dB PSNR 'regression' against the (correct) padded output. On-glass (780M, host Mesa 26.0.4): all four smokes pass at 256x256 (direct) AND 250x250 (padded); padded-EFC frames decode perfectly uniform (YMIN==YMAX) at the exact 709-narrow values (79/148/60 for the first three fills); CSC-vs-padded PSNR 49.9 dB avg after the baseline fix. clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 20:38:55 +02:00
enricobuehler	3aacec53d8	fix(encode): RGB-direct must not engage on unaligned modes — the EFC reads past the capture buffer (GPU hang) ... Field report (commit 25624443, RDNA2/VCN3 host, 1080p): repeated VCN0 VM protection faults from punktfunk-host, vcn_enc_0.0 ring timeouts, two ring resets, then a failed reset escalating to a full MODE1 GPU reset with VRAM loss. Root cause is B1's RGB-direct source: the session's coded extent is 64x16-aligned (1920x1088) but the captured dmabuf is only the real mode size (1920x1080) — the VCN EFC reads the 8 padding rows past the end of the buffer (8 x 7680 B = 61 KB, matching the faulting page span exactly). The CSC shader absorbs alignment by clamping reads and duplicating edges; RGB-direct has no such stage. Every prior validation surface happened to be aligned (256x256 smoke, 1440p live box) — 1080p is the common mode that is not. The stall watchdog's rebuild-and-refault loop then turned a per-session fault into the GPU death spiral. Two layers: - Open-time gate: RGB-direct engages only when the real mode equals the aligned coded extent (720p/1440p/4K yes, 1080p no); otherwise the CSC path runs and the verdict line says why (unaligned-mode). The padded- copy variant that re-enables 1080p is design-doc B2 work. - Submit-time check: an RGB-direct frame that does not cover the coded extent errors out (encoder-rebuild path) instead of importing an undersized source. On-glass (780M, host Mesa 26.0.4): all four smokes pass aligned; at PF_SMOKE_W/H=250 the gate refuses RGB-direct and the rgb smokes soft-skip. clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 20:23:29 +02:00
enricobuehler	84e1e5aeb4	fix(web): restore the Dashboard status tiles' top padding ... CardContent is shadcn's header-adjacent variant (`p-4 pt-0 sm:p-6 sm:pt-0`), but the four Live-status tiles use it with no CardHeader. tailwind-merge lets the call site's unprefixed `p-4` cancel the base `pt-0`, yet nothing cancels `sm:pt-0` — so the tiles lost their top padding at >=640px only, and the content sat against the top edge. Restores the top inset at the sm breakpoint and lets the content fill the stretched grid cell so it stays centred when a sibling tile is taller. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:13:34 +02:00
enricobuehler	1262fec2ae	perf(zerocopy/vulkan): LN4 — global-priority VkBridge queue for the LINEAR/gamescope CSC ... The RGB→NV12 compute CSC shares the SMs with the game; request an elevated global-priority queue (VK_KHR/EXT_global_priority) so the driver can schedule it ahead. PUNKTFUNK_VK_QUEUE_PRIORITY = off|high|realtime (default realtime), downgrading REALTIME→HIGH→none on NOT_PERMITTED/INITIALIZATION_FAILED — a refused class never fails the bridge. Mirrors PyroWave's ac0e7332 (same honest caveat: WDDM didn't move; the Linux driver may — contended-tail lever, correct and harmless either way). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:12:42 +02:00
enricobuehler	ae67315804	perf(encode/nvenc-linux): LN3 — pipelined-retrieve escalation replaces the depth-1 async foot-gun ... PUNKTFUNK_NVENC_ASYNC gains a real tri-state: 1 = always (as before, now documented as ~+1 tick at depth-1), 0 = never (vetoes escalation), unset = ADAPTIVE — off until the session loop's cadence-overrun detector escalates. The host loop's adaptive-depth leaky bucket grows a second stage: once the capturer's depth is maxed (Linux portal is permanently depth-1), it asks the encoder for pipelined retrieve via the new Encoder::set_pipelined hook (asked exactly once; default impl declines, Windows untouched). nvenc_cuda engages at a safe point via a clean session rebuild WITHOUT the IO-stream binding: with input==output stream bound, later stream work waits on prior encode completions and would serialize a pipelined session — stream-ordered submit and two-thread retrieve are mutually exclusive. The ordered gate now also requires async_rt absence (belt-and-braces for the runtime switch). Re-open's first frame is the standard session IDR. On-hardware test: escalate mid-session → retrieve thread live, binding gone, all AUs deliver, first post-escalation AU is the IDR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:10:24 +02:00
enricobuehler	256244430b	feat(encode): Vulkan Video B1 — RGB-direct encode source via VCN EFC (PUNKTFUNK_VULKAN_RGB_DIRECT=1) ... design/vulkan-rgb-direct-encode.md B1: when the probe passes AND PUNKTFUNK_VULKAN_RGB_DIRECT=1 (default OFF until the B2 on-glass A/B), the session opens with pictureFormat=B8G8R8A8 and the captured RGB frame becomes the encode source — the VCN EFC front-end does the 709-narrow CSC inline during encode. Deleted from the per-frame path: the compute CSC dispatch, both NV12 plane copies, the semaphore hop and one queue submit (dmabuf frames are ONE encode-queue submit; ~17 MB/frame of GPU traffic gone). The DPB stays NV12; RFI/RC/quality-level machinery is untouched. Shape: - probe_rgb_direct now returns the chroma-siting bits to create the session with (midpoint preferred, else cosited-even per axis); the open verdict line gains "active" / "available(off; ...)" states. - RgbProfileStack: the rgb-chained video profile rebuilt on the stack per profiled-image creation after open (profile identity is by value) — dmabuf imports become profiled VIDEO_ENCODE_SRC images (import cache unchanged), the CPU staging image likewise (concurrent encode+compute). - record_submit_rgb: steps 2–4 twin (dmabuf: single submit; CPU: staging copy on the compute queue, semaphore-ordered); shared step-1/bookkeeping. - begin_encode_cmd takes a SrcAcquire (CSC general / fresh-import FOREIGN QFOT / cached visibility-only / staging TRANSFER_DST) so both paths share the encode recording. - RGB-direct frames skip the CSC per-slot resources entirely (make_frame split into csc/common halves); cursor bitmaps warn once (EFC cannot composite; gamescope — the flagship — embeds the cursor itself). On-glass (780M RADV PHOENIX, host Mesa 26.0.4): all four smokes pass (vulkan_smoke{,_av1,_rgb,_rgb_av1}); the EFC-encoded H265 stream decodes clean and matches the CSC-encoded stream at 49.9 dB average PSNR (min 48.9) — within the design's ±1-code-value tolerance. (Raw-OBU ffmpeg probing of the tiny AV1 dumps fails identically for BOTH paths — pre-existing dump quirk, not a stream defect.) check+clippy+full unit suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 20:05:56 +02:00
enricobuehler	589d48a975	fix(plugin-kit): SSE keepalive must outpace Bun's idle timeout (0.1.4) ... servePluginUi's Bun.serve leaves idleTimeout at Bun's 10s default, so the old 15s keepalive could never arrive — an idle status feed was closed before its first ping, which is exactly what a live host showed. Default is now 5s. Also adds the regression suite that should have caught it: the original test only covered a finite, self-driving stream. The new one exercises the production shape (PubSub-backed, published after the response opens) plus the keepalive — with a reader that does not re-enter read(), which is what made the first version of this test lie. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:59:04 +02:00
enricobuehler	424bab1c3a	fix(plugin-kit): soften @unom/ui's card ring for the brand palette (0.1.3) ... @unom/ui rings cards ring-2 ring-accent, sized for its own subtle accent; in this palette --accent is the brand violet, so every card shouted. The console already softens the same ring in its Card wrapper — plugin UIs now inherit that instead of each wrapping AnimatedCard themselves. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:47:51 +02:00
enricobuehler	5a27c02738	feat(encode/nvenc): LN1 phase-0 — slice-count + sub-frame-readback knobs and the slice-timing probe ... PUNKTFUNK_NVENC_SLICES=N (2..=32, default off) splits H.264/HEVC frames into N slices (sliceMode 3); PUNKTFUNK_NVENC_SUBFRAME=1 (default off) arms enableSubFrameWrite + reportSliceOffsets on sync sessions only. Both experimental groundwork for sub-frame slice output (plan §7 LN1). nvenc_cuda_subframe_slice_probe (on-hardware, ignored) answers the LN1 go/no-go: spins lock_bitstream(doNotWait) against an in-flight frame and prints the (t_us, status, numSlices, bytes) timeline — incremental slice availability and its spacing, or all-at-completion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:44:54 +02:00
enricobuehler	d5a0f5012b	fix(encode): RGB-direct probe — accept cosited-even chroma siting (what VCN EFC actually offers) ... On-glass B0 result from the 780M (RADV PHOENIX, host Mesa 26.0.4): the probe returned no-709-narrow-midpoint because RADV advertises xChromaOffsets = COSITED_EVEN only — the VCN EFC does canonical H.26x left-cosited x-chroma, while the requirement was written to bit-match our 2x2-average (midpoint) shader. The delta is a half-pel chroma-x phase, imperceptible and unsignalled in our bitstream; EFC's siting is arguably the more correct one. Accept either siting bit per axis (model + range stay exact: 709 narrow); B1 will pass the preferred available bit. With this the 780M probes rgb_direct=available; both GPU smoke tests (H265 + AV1) pass on that box against host Mesa 26.0.4 — the first real-RADV validation of the poll fix, the quality-level control, and B0. (Container mesa alone can't run the H265 smoke: Fedora ships RADV with H264/H265 encode compiled out — AV1 only. Use the host ICD via VK_ICD_FILENAMES on Atomic boxes.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 19:44:33 +02:00
enricobuehler	d833cff470	fix(plugin-kit): resolve the --secondary text/surface collision in theme.css (0.1.2) ... @unom/ui reads --secondary as muted TEXT; this palette (like the console's) uses it as a dark SURFACE, so EmptyState captions, badge text and table headers rendered dark-on-dark. Tailwind derives both utilities from one token, so the text lane is re-pointed at --muted-foreground here — once, for every plugin, instead of in each plugin's stylesheet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:44:01 +02:00
enricobuehler	34ec57cb52	test(encode/nvenc-linux): on-hardware assertion that stream-ordered submit arms ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:38:22 +02:00
enricobuehler	cd36c46388	perf(encode/nvenc-linux): LN2 v1 — stream-ordered submit via NvEncSetIOCudaStreams ... Bind the session's IO streams to the encode thread's high-priority copy stream: in sync-retrieve depth-1 use the per-frame input copy and cursor blend now enqueue with NO cuStreamSynchronize and encode_picture orders after them on the stream. Same stream both directions, so the encode's completion is inserted into the stream and later work (the next frame's copy into a reused ring slot) waits for it. Soundness gate: the fast path engages only when pending is empty (true depth-1 usage) — every prior encode was drained by a blocking poll, and the caller holds the frame payload across the matching poll (contract now documented on Encoder::submit; both host loops already comply). Pipelined callers and PUNKTFUNK_NVENC_ASYNC mode keep the blocking copies. True zero-copy input registration (registering the worker-owned IPC buffer directly) stays the LN2 v2 follow-up — it needs a contiguous worker-pool NV12 layout and a registration<->IPC-mapping lifetime tie. PUNKTFUNK_NVENC_STREAM_ORDERED=0 restores the old blocking behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:38:22 +02:00
enricobuehler	59b6d3796b	perf(encode/nvenc-linux): LN0 — sampled submit/retrieve-lock split, sub-frame caps, zeroReorderDelay ... Latency plan §7 LN0 (Linux/NVIDIA encode follow-on): - sampled PUNKTFUNK_PERF submit split (copy/blend/map/pic) in nvenc_cuda — the host loop's submit_us folds all four together; the D2D input copy is the LN2 zero-copy target and now measurable on its own - sampled blocking lock_bitstream timing on pf-nvenc-out — in two-thread mode the host loop's wait_us wraps a non-blocking poll, so the real encode wait was measured by no timer - caps probe + log SUPPORT_SUBFRAME_READBACK / SUPPORT_DYNAMIC_SLICE_MODE (LN1 sub-frame slice-output prerequisites, fleet visibility) - explicit zeroReorderDelay=1 in the shared low-latency config (P-only + no lookahead has no reordering anyway; pins the bit against preset or driver drift; shared with the Windows backend) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 19:38:22 +02:00
enricobuehler	78dba293a8	feat(encode): Vulkan Video B0 — vendored VK_VALVE_video_encode_rgb_conversion + RGB-direct probe telemetry ... First phase of design/vulkan-rgb-direct-encode.md (punktfunk-planning): make the captured BGRx dmabuf the direct encode source with the VCN EFC front-end doing the 709-narrow CSC — deleting the per-frame compute CSC, both plane copies, the semaphore hop and one queue submit. B0 changes nothing about the encode path. It vendors the extension surface (vk_valve_rgb.rs — ash 0.38 predates it; same rationale and style as the vk_av1_encode module) and probes at open whether this host qualifies: extension present (Mesa >= 26.0 + EFC hardware) → feature bit → conversion caps cover the compute shader's exact math (709 / narrow / midpoint both axes) → encode-src format set offers B8G8R8A8 with DRM-modifier tiling. The verdict is one INFO line (rgb_direct=available | first missing requirement) — the field telemetry that decides where B1 can default on. Verified: cargo check + clippy clean + unit tests green (Linux box); the probe short-circuits to no-ext on non-RADV drivers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 19:29:22 +02:00
enricobuehler	cfdec2729d	perf(encode): Vulkan Video — explicit VCN preset, persistent bitstream map, CSC split timing ... Field follow-up to 6dc195f9 (the AMD host whose H265 encode sits at ~5 ms): the remaining time is the VCN ASIC preset, and we never chose one. 1. Explicit encode quality level. RADV only emits a VCN preset op when the app issues ENCODE_QUALITY_LEVEL — we never did, so every session ran the firmware's default preset. Install the resolved level on the first frame's RESET control (chained ahead of the CBR state, which satisfies the spec's quality-change-carries-rate-control rule) and bake the same level into the session-parameters object (the spec requires the match). Default 0 = the fastest tier the driver exposes (RADV: SPEED, except H265 on pre-RDNA4 which the driver pins to BALANCE); clamped to the profile's maxQualityLevels. PUNKTFUNK_VULKAN_QUALITY=0..3 overrides for quality-biased setups. Logged at open so field logs show the tier. 2. Persistent bitstream mapping. read_slot vkMapMemory/vkUnmapMemory'd the host-visible bitstream buffer every frame; map each ring slot once at build instead (coherent memory; vkFreeMemory implicitly unmaps). 3. PUNKTFUNK_PERF CSC split. GPU timestamps bracket the compute batch (import barriers + cursor prep + CSC dispatch + plane copies) and a sampled csc_us line logs every ~2 s — separating shader/copy time from the ASIC encode inside the pump's wait_us, the VAAPI submit-split analog for this backend. Off (and unrecorded) unless PUNKTFUNK_PERF. Verified: cargo check + clippy + DPB/RPS unit tests green (Linux box). The GPU smoke tests still need a RADV host (NVIDIA driver fails session open on the build box, pre-existing). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 19:17:34 +02:00
enricobuehler	6dc195f982	fix(encode): Vulkan Video poll() must block per the depth-1 pump contract ... The session pump's depth-1 loop (capture → submit → poll) treats a poll() None as "the backend holds the frame internally, re-poll next tick" — true only of the libav AMF/QSV wrappers, whose codecs genuinely hold ~2 frames. The Vulkan Video backend probed its slot fence with get_fence_status instead, so the AU of every frame — finished on the ASIC in ~5 ms — sat unharvested until the tick AFTER the next frame was submitted: encode_us read as one full frame period (~17 ms at 60 Hz vs VAAPI's ~5.3 ms on the same VCN, the AMD field report) and every frame shipped a frame period late — one frame of avoidable glass-to-glass latency on the path that exists to beat libav VAAPI. Wait the oldest in-flight slot's fence in poll() instead, matching the sync NVENC backend's blocking lock_bitstream and the documented Capturer::pipeline_depth contract ("capture → submit → poll-blocks"). Bounded by ENCODE_FENCE_TIMEOUT_NS like enqueue()'s backpressure wait, for the same reason: poll runs on the thread the stall recovery runs on, so a wedged GPU must surface as an error, not park it. None now only means "nothing submitted". Covers H265 and AV1 (shared poll). Verified: cargo check + DPB/RPS unit tests green (home-worker-5); the GPU smoke tests fail at session open on that box's NVIDIA driver identically on unmodified origin/main — pre-existing, needs the RADV box for on-glass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 18:53:21 +02:00
enricobuehler	da259d5b79	feat(plugin-kit): browser-safe ./wire subpath for provider schemas (0.1.1) ... Plugin contracts share ProviderEntry/Artwork/LaunchSpec/PrepStep with their UIs; the kit root stays node-only (reconcile keeps the HostClient transport). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:49:13 +02:00
enricobuehler	4094f6208d	fix(web): load the inlang plugin from node_modules, not a CDN ... `web/project.inlang/settings.json` pointed `modules` at https://cdn.jsdelivr.net/npm/@inlang/plugin-message-format@4/dist/index.js — inlang's stock `paraglide-js init` scaffolding, which nobody had a reason to keep. It made `bun run codegen` need the network at build time, so in a sandbox that has none (the Nix build; any air-gapped CI) the plugin import failed and paraglide compiled ZERO messages. That failure is silent by design: the inlang SDK logs a PluginImportError as a WARNING, paraglide still prints "Successfully compiled" and exits 0, vite bundles the empty message set, and the console only dies at request time inside renderToReadableStream because every `m.foo()` is undefined. Reported from a NixOS host running punktfunk-web-server. The plugin is a normal npm package, so depend on it like one: add @inlang/plugin-message-format as a devDependency and reference it by relative path. `loadProjectFromDirectory` (which both `paraglide-js compile` and the vite plugin use) imports non-`http` modules straight off disk, and the shipped dist/index.js is a self-contained bundle with no imports of its own, so it loads from the data: URL exactly as the CDN copy did. Compiles 268 messages offline, with no project.inlang/cache round-trip. Add tools/check-i18n.mjs, run at the end of `codegen`, so this can never ship silently again: it fails the build on a remote `modules` entry, a module that does not resolve, or a compiled message count below what messages/en.json defines. Verified it catches all three (remote URL, missing plugin, corrupt plugin that compiles to 0 messages) and passes a healthy build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 18:43:39 +02:00
enricobuehler	0ed8ca90f2	fix(plugin-kit): regenerate bun.lock (duplicate package path after react devDep add) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:41:34 +02:00
enricobuehler	8d72e1d27e	feat(plugin-kit): @punktfunk/plugin-kit 0.1.0 — the Effect plugin framework ... The ~80% of every plugin that was copy-pasted (rom-manager ↔ playnite), extracted as one Effect-v4 package: - runtime: definePluginKit — async-main boundary hiding a ManagedRuntime (two-effect-instances discipline), signal-driven interruption with a bounded shutdown grace - config: Schema-driven raw round-trip (defaults only in the Schema via withDecodingDefaultKey + encodingStrategy omit; file stays authored-shape), atomic writes, world-writable refusal, changes stream - cache-store: disposable derived state, corrupt→empty, write-through - reconcile: kit-owned provider wire schemas + typed client over the skew-safe untyped pf.request seam - sync-engine: generic poll/watch/debounce/single-flight-coalesce/ fingerprint-skip engine with a status PubSub (the SSE feed) - ui-server + sse: effect/unstable/httpapi behind servePluginUi with core-only env layers (validated by the phase-0 spikes); raw SSE route (httpapi has no event-stream media type) - cli: minimal command dispatcher reusing the plugin layer graph (deliberately not effect/unstable/cli — it needs platform packages) - react subpath: plugin router (path→hash→fallback deep-link restore + pf-ui:navigate bridge), ResultGate, sseAtom, resolvePluginBase - theme.css: the console's violet identity packaged for plugin UIs 18 bun tests incl. the two phase-0 spikes; publish workflow mirrors sdk-publish (tag plugin-kit-v*; 0.1.0 published manually). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:41:11 +02:00
enricobuehler	c15c80718a	chore(sdk): bump @punktfunk/host to 0.1.2 ... Manual publish (no sdk-v tag — the version was published directly so the plugin-kit and rewritten rom-manager can consume pluginStateDir/pluginIngestDir from the registry; the previously published 0.1.1 predates the security-tiers merge and lacks those exports). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:41:11 +02:00
enricobuehler	bb58fde369	feat(plugin-kit): scaffold @punktfunk/plugin-kit + phase-0 spikes ... Two spikes validating the riskiest seams of the plugin-kit design before implementation: - HttpApi (effect/unstable/httpapi) served on Bun behind the SDK's servePluginUi using ONLY effect-core layers (Etag.layerWeak, Path.layer, HttpPlatform.layer + FileSystem.layerNoop) — no platform package. Auth, schema validation, and static fallthrough all verified end-to-end. - Browser client prefix strategy for the console proxy: both transformClient+prependUrl AND baseUrl preserve the /plugin-ui/<id> path prefix. Nested Schema.withDecodingDefaultKey defaults confirmed (Effect-valued defaults; encodingStrategy "omit" restores raw shape on encode). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:41:11 +02:00
enricobuehler	de7b54d4e0	fix(core): remaining 15 sweep lows — client, clipboard, C ABI (v10), FEC, GSO, GTK ... Second and final batch from the 2026-07-20 core-sweep lows: client: - connect() timeout now sets `quit` before shutdown, so a handshake that completes after the deadline closes with QUIT_CLOSE_CODE instead of leaving the host lingering (virtual display up) for a reconnect that never comes. - probe_result: saturating_add on the wire-supplied wire_packets + send_dropped counters (debug-build overflow panic / release wrap). - the standing-latency bleed no longer sets flush_in_window: that flag is the ABR's SEVERE (×0.7) verdict, and the bleed fires only on provably loss-free windows the controller itself scores as fine. clipboard: - fetch_cancels pruned on every new fetch (was: one dead oneshot per paste for the session). - serve chunks gated on a parked waiter + capped at CLIP_FETCH_CAP with an Error event (was: unbounded silent accumulation under any req_id). - serve_inbound park bounded by FETCH_STALL_SECS + send.stopped() (was: an unanswered FetchRequest parked the task, waiter, and bi-stream forever; ~100 of them exhaust the connection's bidi budget). C ABI (ABI_VERSION 9 → 10, header regenerated, additive only): - new punktfunk_connection_clock_offset_now_ns — the LIVE re-synced offset (Swift/Kotlin latency math read the frozen connect-time value ~40ms wrong after a wall-clock step). - to_config: checked u64→usize narrowing of max_frame_bytes (32-bit armeabi truncated >4GiB to a plausible residue). - host_poll_input: no &mut held across the embedder callback (re-entry aliased it — UB under noalias); mid-drain callback clears now stick. - next_audio_pcm: DTX (empty) payloads skipped — decode synthesized 120ms of concealment per 5ms slot and grew the playout ring forever. - next_clipboard releases the parked payload on an empty poll (a one-off 50MiB paste stayed resident all session). - frames_dropped / wants_decode_latency write their documented 0/false defaults before the NULL-handle check. - gamepad constant docs match pick_gamepad() reality (DualSenseEdge/ SwitchPro landed; DualSense/DS4 honored on Windows UMDF too). FEC: - gf8 reconstruct/reconstruct_into reuse the (k,m) codec cache like encode_into (was: fresh 230×200 generator + decode inversion per lossy block on the pump thread). - vendored fec-rs: the 8 safe wrap_mul_slice shims assert equal lengths (x86 SIMD callees bound stores on input.len() — safe-code OOB write); ReconstructShard's safety contract gains the len()==get().len() clause and reconstruct_internal sizes raw slices from the slice. transport/GTK: - Linux GSO super-buffer capped at the real UDP payload ceiling (65487) not 65535 — seg sizes ≥1024 could EMSGSIZE and latch GSO off process-wide, blamed on the network. - GTK settings dialog no longer rewrites an unlisted-but-valid stored gamepad preference to "auto" on close. Already fixed on main (verified stale, skipped): the reassembler FEC ceiling, wants_decode_latency's third term, request_probe rollback + the generalized probe watchdog. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:26:43 +02:00
enricobuehler	76ac3cf867	fix(core): five sweep lows — seal-lane fallback, flush partial, codec echo, idle clamp, pair-name UTF-8 ... From the 2026-07-20 punktfunk-core quality sweep's adjudicated lows (~/punktfunk-sweeps/punktfunk-core-2026-07-20.json), each with a regression test: - session: the two-lane seal's dead-worker fallback dropped the frame's back half and returned Ok with half an access unit; the corpse lane was also never respawned. The send-failure arm now reclaims the tail (single-lane seals the WHOLE frame) and both failure arms drop the lane so the next large frame respawns it. A recv-side death now surfaces as an error instead of silent truncation. - reassemble: Reassembler::reset() left pending_partial parked, so a pre-flush stale partial survived Session::flush_backlog and was delivered as the first "frame" after a jump-to-live. - caps: resolve_codec echoed a non-conformant multi-bit preferred byte verbatim (downstream from_wire folds it to HEVC — possibly outside the shared set). It now isolates one bit of the intersection. - endpoint: stream_transport_idle only floored the value; an absurd operator-supplied idle timeout blew past QUIC's VarInt ms ceiling and panicked host startup through the expect. Clamped to 1s..1h. - pairing: PairRequest::encode cut the device name at a raw byte-64 boundary, splitting multi-byte UTF-8 (host showed U+FFFD forever); it now shares Hello's char-boundary truncate_to. The frozen-FEC-ceiling finding (reassemble.rs:109) was already fixed on main by the sweep's high-severity commit — skipped as stale. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:16:02 +02:00
enricobuehler	f4ec18d528	chore(core): fix build.rs + crate-doc drift left by the W7/W8 splits ... - build.rs: drop the stale `rerun-if-changed=src/client.rs` (the file became client/ in W7; the path never fires). - lib.rs: the crate doc's module list named 6 of ~19 modules — add the missing ones (config/error/stats/input/reject/reanchor/render_scale/ audio/wol + the quic-gated control-plane group), without intra-doc links to feature-gated modules. - quic/mod.rs: the module doc still described the deleted `msgs` module; list the actual post-split module set. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:08:39 +02:00
enricobuehler	ce51a2ba74	refactor(core): decompose the client run_pump monolith into pump/ submodules ... client/pump.rs was a single 1192-line async fn stacking six concerns. It is now a 190-line orchestrator (same spawn order, same channel wiring) over five focused modules: - pump/handshake.rs — connect + Hello/Welcome/Start + skew handshake + hole punch + Session construction (HandshakeOut) - pump/input_task.rs — the gamepad snapshot/removal/arrival re-send state machine + passthrough input forwarding - pump/control_task.rs— the control-stream select loop (renegotiation, probes, bitrate acks, clock re-sync, clip metadata), bundled as ControlTask - pump/datagram_task.rs — the datagram tag demux + rumble reorder gate - pump/data.rs — the blocking data-plane pump (loss reports, ABR + capacity probe, jump-to-live detectors, standing-latency bleed), bundled as DataPump Every body moved verbatim (dedent + arg-struct destructures aliasing the original binding names); no per-frame indirection added — the pump loop, its locals, and the hot-path shape are byte-equivalent. The Ctrl/DataPump arg structs exist only to stay under too_many_arguments. 196 lib tests pass; clippy clean on --features quic AND --no-default-features (--all-targets); include/punktfunk_core.h byte-identical; fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 18:07:14 +02:00
enricobuehler	eacaaa5cd8	refactor(core): peel session.rs anti-replay, perf telemetry, and seal lane into submodules ... session.rs (1203) sharpens down to the two hot-path state machines + lifecycle (887): ReplayWindow + seq_of + their tests -> session/replay.rs; the PUNKTFUNK_PERF trio PumpPerf/SealPerf/TimedCoder -> session/perf.rs; the Phase-1.5 lane machinery SealLane/SealJob/seal_wire_slice/ TWO_LANE_MIN_PACKETS -> session/seal.rs. Facade pattern (session.rs stays the parent file); pub use keeps session::{PumpPerf,SealPerf} stable and lib.rs re-exports are untouched. Pure code motion + pub(super) bumps — seal_frame_inner/poll_frame/poll_input bodies unchanged; the wire-equivalence tests stay co-located with the seal path they pin. 196 lib tests pass, clippy --features quic --all-targets clean, fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 17:56:26 +02:00