100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehlerandClaude Sonnet 5	c4e80fd455	docs(release): v0.21.0 notes should only cover its own delta ... Duplicated the entire v0.20.1 fix bundle verbatim instead of following house convention (each vX.Y.Z.md covers only what changed since the immediately preceding release file — see v0.19.1 -> v0.19.2, neither restates the other). v0.20.1 is a real, already-tagged release with its own notes file; 0.21.0 only needed to add the monitor-streaming feature, the KDE registry fix found while building it, and the CI-only winget fix, with a pointer back to v0.20.1 for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 09:08:47 +02:00
enricobuehlerandClaude Opus 5	d08893383a	chore(release): bump workspace version to 0.21.0 ... 42 commits since v0.20.0 (v0.20.1 was tagged but never announced; superseded by this release rather than repointed, since real new functionality landed after it was cut). Minor, not patch: the headline is streaming one of the machine's own physical monitors instead of always creating a virtual display — pick it from a new console card or pin it in host.env, on KWin, Mutter, sway and Hyprland, in both the Punktfunk app and Moonlight. Also folds in the full v0.20.1 fix bundle: three Windows install blockers found within hours of 0.20.0, GameStream/Moonlight compat back to opt-in on fresh installs, three gamescope Game Mode takeover faults, a laptop-panel stall misdiagnosis, and the PyroWave high-bitrate latency-creep bundle — plus a KWin 6.7 regression found while building the monitor feature (silent kscreen-doctor fallback on every session) and a winget release-verification CI fix. Wire protocol stays at 2, the embeddable C ABI at 13 and the Windows virtual-display driver protocol at 6. GET /display/monitors is a new additive endpoint; the display policy gains an optional capture_monitor field. No embedder rebuild required. Notes authored ahead of the tag per docs/releases/README.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 00:03:44 +02:00
enricobuehlerandClaude Sonnet 5	74179c4c2e	fix(ci/winget): envs: must live under with:, not as a step sibling ... 24d2f97e added envs: GITHUB_REF_NAME to fix "Verify the served catalogue" failing on every tag with `GITHUB_REF_NAME: unbound variable` — but placed it as a sibling of with:/env: on the step, which is not part of the step schema and is silently ignored by Gitea's runner. appleboy/ssh-action never received it as an input, so the step kept failing identically on v0.20.1's first tag run. docker.yml and deploy-services.yml already forward REGISTRY_TOKEN this way correctly: envs: nested inside with:. Moved to match. Confirmed by parsing the workflow and checking envs lands in the step's with: dict, not as a bare step key. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 00:01:45 +02:00
enricobuehlerandClaude Opus 5	8fe71be424	fix(web): applying a saved preset kept switching the streamed screen off ... `applyCustomPreset` builds a FRESH policy object instead of spreading the draft, so every field it doesn't name is dropped. `capture_monitor` was not named — so picking one of your own saved presets silently took a host that was mirroring a real monitor and put it back on a virtual display. The same omission in the Custom switch would have done it there too. Found on-glass against a running serve on .136: the PUT is whole-object, so the console is the only thing keeping the orthogonal axes alive, and these two sites were the ones building a policy from scratch rather than from what was already in force. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	a98174ebfa	feat(host): anchor-test, and libei says which output absolute input landed on ... The absolute-region ladder existed for one case a unit test can only simulate — two heads of the SAME size, where matching a libei region by the streamed mode is a coin flip — and that case had never been run against a real compositor. It was also unobservable: the log said which regions the EIS server offered, never which one a coordinate went into, so "the pointer is on the wrong monitor" could only be discovered by looking at a monitor. libei now reports the chosen region once per distinct answer, beside the existing miss warning: one covers an anchor that named nothing, this one covers an anchor that matched something, by saying which. `anchor-test` is the gate that reads it, in the shape mirror-test established: it enumerates the heads, SAYS whether the rig actually has two of the same size (a green run on a single-head box proves nothing), anchors at a named one (or `--none` for the A/B that makes the anchored run mean anything), and walks the corners. It refuses to run off libei rather than emitting a green result about a ladder that isn't there. On-glass on KWin 6.7.3 with `kwin_wayland --virtual --output-count 2` (regions 1920x1080+0+0 and +1920+0): unanchored picks +0+0, anchored at Virtual-1 picks +1920+0, anchored at Virtual-0 picks +0+0. That is open item 3 of design/per-monitor-portal-capture.md §8b, closed. Clearing the pin now logs too — setting one always did, and the streamed screen going back to virtual is the same size of change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	ea0c61fb0f	docs: streaming a real monitor, and the CLI that names one ... The console grew a "Streamed screen" card and the host grew a PUNKTFUNK_CAPTURE_MONITOR knob and a list-monitors command, and the docs knew about none of it — a control with no explanation anywhere. virtual-displays.md gets the feature section: what it is for, that the monitor is never touched, that its resolution wins and a client scales, that a bad name is a hard error rather than a different screen, and that there is no chooser dialog on any of the four backends (which is what makes it work unattended). Plus the three troubleshooting entries the shape of the feature predicts: settings that do nothing while mirroring, a console card the env var has locked, and a pin that names no head. host-cli.md documents list-monitors and mirror-test; configuration.md gets the knob, including that it outranks the console on purpose; running-as-a-service.md gets the desktop-session drop-in and states that the host needs nothing exported to find its session. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	19deac75fe	feat(packaging): a desktop-login host restarts with its desktop ... The shipped unit's PartOf=punktfunk-kde-session.service covers the APPLIANCE route, where we start the compositor ourselves. A host on a machine somebody logs into has no such unit: when Plasma or GNOME restarts, the daemon keeps running while holding a Wayland socket and a portal D-Bus connection that both died with the old compositor, and it cannot recover either in-process. It fails quietly — the host still listens, still answers, and every session it then serves dies at capture. A host that mirrors a monitor idles for days between sessions, which is the shape that finds this at the worst moment. The drop-in binds the host to graphical-session.target: PartOf takes it down with the session, WantedBy brings it back with the new one. Shipped under /usr/share rather than as an active drop-in, because it is wrong for the appliance route (which may never reach that target at all, and would then leave the host permanently stopped) — the operator opts in. Closes the restart half of design/per-monitor-portal-capture.md §6. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	45f04f50fe	test(mgmt): gamescope reports no monitors, and that is not a missing explanation ... /display/monitors must never answer empty AND silent — the console reads that as "the host is broken". But gamescope is nested: it owns no physical heads by construction, so empty-and-silent is the correct answer there, not an unexplained one. Any dev box that has ever been in game mode keeps gamescope-0 sockets in its runtime dir, so detect() resolves gamescope and the test failed on the machine rather than on the code (found running the suite on .136). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	6afc05155b	feat(vdisplay/session): derive SWAYSOCK — the last session var a --user host lacked ... Session detection already hands every backend the live session's env: WAYLAND_DISPLAY from a socket scan, XDG_RUNTIME_DIR from the uid, the session bus, XDG_CURRENT_DESKTOP, and Hyprland's instance signature. sway was the exception — SWAYSOCK had to be INHERITED from the login shell, so a systemd --user host that never saw one had no sway IPC at all: no output enumeration, no capture chooser, no wlroots backend (its is_available() keys off that very variable). It is derivable, and by identity rather than guess: sway names its socket sway-ipc.<uid>.<pid>.sock, and detection already knows the compositor PID. Ladder: a valid inherited value, then the exact PID's socket, then the newest one we own (a sway re-exec can leave the name pointing at a PID we didn't see). None on river — the other wlroots desktop ships no sway IPC, and saying so is what stops apply_session_env exporting a SWAYSOCK that points at nothing. Closes the session-env half of design/per-monitor-portal-capture.md §6 for a desktop-login host: nothing has to be exported for the host to find its session. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	829bcb7962	fix(gamestream): the streamed-screen pin applies to the portal source too ... PUNKTFUNK_CAPTURE_MONITOR is documented as "instead of creating a virtual display OR taking whichever head the portal hands back", and the console presents it as a host-wide setting. The compat plane's portal source did neither: it went straight to the chooser, so a Moonlight client on a pinned host silently got whatever screen the portal picked. That is the one outcome the whole feature exists to prevent — showing the wrong monitor is worse than showing none. The portal arm now mirrors the pinned head instead, through the same MirrorDisplay the virtual source reaches via vdisplay::open. It launches nothing and creates no virtual output, so it needs neither the game-lifetime machinery nor the registry (External ownership passes through it anyway). Which screen a pooled capturer is showing is now the third reuse key beside HDR-ness and cursor mode. The pin is a LIVE setting — the console can re-aim the host between two connects — so without it in the key the second connect would keep streaming the previous screen, which is the same silent-wrong-monitor failure by another route (§7.3, open item 5). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	de3ef50434	fix(native): a mirrored monitor has a fixed mode — refuse to resize it ... A physical head runs at the mode its owner set, and MirrorDisplay::create ignores the requested one on purpose. So a mid-stream Reconfigure against a mirror could only ever tear the cast down and rebuild the identical one at the identical size — a hitch that buys nothing, and an invitation to the worse reflex of reconfiguring the display someone is sitting at. reconfig_allowed grows a third gate beside gamescope and per-client-mode identity, and the session captures it at bring-up like the others: this session opened its display under whatever the pin said then, so a console change mid-session must not retroactively change the answer it gives. Linux-only, because vdisplay::open only routes to the mirror there — a pin left in a Windows host's settings streams nothing different and must not disable resize as a side effect. design/per-monitor-portal-capture.md §7.3, open item 4. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	b08226dbf1	feat(vdisplay): mirror a pinned monitor on sway and Hyprland ... P5 of design/per-monitor-portal-capture.md, and the end of a hole worth naming: the pin was accepted, persisted and offered in the console while `create` bailed on these two backends, so a sway or Hyprland host with a monitor selected failed EVERY session. Both already ship the mechanism — a managed portal-chooser config plus a per-session selection file (xdpw's `Monitor: NAME`, xdph's `[SELECTION]screen:NAME`) — so mirroring is that same chooser pointed at a physical connector instead of a headless output we created. The keepalive stops the cast and nothing else; the monitor is the compositor's. The selection write is now serialized against the handshake that reads it (SELECTION_LOCK, applied to the virtual-output paths too). That file is one per-user path: whoever writes last before the portal reads wins, and the loser does not fail — it silently captures the other session's output. `managed` is no longer grounds for refusal everywhere. It is conclusive only where the name is ours by construction (KWin's `Virtual-punktfunk`, Hyprland's `PF-N`); sway names EVERY headless output `HEADLESS-N`, its own included, so the old rule would have refused to mirror any output on a headless sway box — exactly the remote setup this feature serves. Found on-glass, and now a test. Verified on a two-output headless sway: asking for HEADLESS-1 yields 1280x720 frames and HEADLESS-2 yields 1920x1080, so the chooser really does steer per request. Hyprland is compile-only — no Hyprland box exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	d461d889c3	feat: the streamed screen is a persisted setting, pickable from the console ... P4 of design/per-monitor-portal-capture.md. The pin was an env var read once at startup, which a console picker can never write — so it becomes a field of the display policy (orthogonal to presets, like game_session), and `vdisplay::capture_monitor()` resolves env-over-policy: an appliance that pinned in its unit's host.env stays pinned there, and a console click cannot re-aim a machine whose operator already declared the answer. Read per `open` rather than cached, so a picker change takes effect on the next session instead of the next host restart. The host re-resolves the input anchor on every policy write — including clearing it when the pin is cleared, or a later virtual-display session inherits an anchor aimed at a monitor it is not showing. `with_manual_layout` carries the pin through like the other orthogonal axes: without that, saving a display ARRANGEMENT would silently swap the streamed screen back to virtual. Console: a "Streamed screen" card listing the host's real monitors beside "Virtual screen (default)", saving on selection. A disabled head is listed but not selectable (so "why isn't it here?" has an answer), and an env-pinned host renders read-only with the reason rather than offering controls that silently lose to the environment. Verified on GNOME/Mutter: pinning via the policy file alone (no env) routes sessions to the mirror and anchors input; setting the env to a different connector overrides it, exactly as documented. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	358cfa4be4	feat(host): mirror-test — the on-glass gate for per-monitor capture ... Opens the display backend exactly as a session would, attaches a capturer and reports the frames a named head actually produces, with no client involved. `--monitor` names the head explicitly (it cannot go through PUNKTFUNK_CAPTURE_MONITOR: pf_host_config parses the environment once and startup already read it, so a tool setting it for itself would still see the old snapshot — hence vdisplay::open_mirror); with no argument it exercises the production routing through the pin. A frame timeout is NOT treated as failure. Compositor capture is damage-driven — the host's own capture diag logs new_fps=0 for virtual outputs on an idle desktop for exactly this reason — so the first version of this tool ended its measurement on the first idle gap and made a working mirror look like a 2-frame stall. Verified on KWin 6.7.3 (home-nobara-1), mirroring HDMI-A-1: 346 frames in 20s at 1920x1080, arriving while input was injected and pausing when the desktop went quiet, on both the CPU (BGRx/MemFd) and zero-copy (NV12 dmabuf) paths, ownership=External. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	045deaf77a	fix(vdisplay/kwin): bind the output-device REGISTRY — KWin 6.7 stopped ... advertising per-output globals Found on-glass while testing monitor enumeration: KWin 6.7.3 advertises kde_output_device_registry_v2 and NOT one kde_output_device_v2 global per output. This module only ever bound the globals, so on a current KWin it saw zero devices. That is not just an enumeration gap — it silently disabled the whole in-process output-management path, which exists precisely because kscreen-doctor wedges. The live 0.19.2 host on the test box logs "kde_output_management unavailable — kscreen-doctor fallback" on EVERY session, so every topology apply there has been going through the tool this module was written to stop using. Both models are supported now: the per-output globals older KWin sends, and the registry's `output` events. Devices from the registry arrive a round later than globals do, so the handshake takes one more barrier — skipped when nothing is still awaiting its `done`, so the classic path costs nothing. Verified on KWin 6.7.3: enumeration now reports HDMI-A-1 1920x1080@60 at +0,+0 scale 1.35 primary, matching kscreen-doctor exactly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	bf2f54a5fe	feat(vdisplay): mirror a pinned monitor on Mutter, and scope the HDR probe ... P3 of design/per-monitor-portal-capture.md. Mutter's mirror is the same private ScreenCast session the virtual path already drives, one call different — RecordMonitor instead of RecordVirtual — so it inherits what makes that path work headlessly: a direct D-Bus API that needs no interactive approval, unlike the xdg portal a background service could never answer. Deliberately not under TOPOLOGY_LOCK: that serializes operations which add or remove a monitor or apply a monitor configuration, and mirroring does neither. Nothing is created, no layout changes, and teardown is just Stop — the SIGSEGV-adjacent ordering the virtual path must observe cannot arise when no monitor is being removed. The GNOME HDR probe now honors the pin. Asking "is ANY monitor in BT.2100 mode" was fair while capture took whatever head it was handed; once the operator names one, an HDR TV on the next connector must not talk the host into offering PQ formats for the SDR panel it is actually streaming. A pin that names no live head reports SDR rather than falling back to "any" — the session is about to fail on that same missing monitor, and an over-claimed HDR offer would be a second, quieter wrong answer. ⚠️ RecordMonitor's exact signature is read from the interface, not yet confirmed against a live gnome-shell; no GNOME box was reachable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	53c772702f	feat(host): list-monitors CLI, and two bugs it caught on-glass ... An operator configuring an unattended host has to learn the connector names from somewhere, and "curl the management API before the host is configured" is not it. `punktfunk-host list-monitors` prints them with geometry and flags the pinned one. Running it under a real sway immediately caught two defects the unit tests could not: - the query used the `swaymsg` command helper, which inserts `--`, so `-t get_outputs` came back as "Unknown/invalid command '-t'". Queries now go through a `swaymsg_query` helper that cannot make that mistake. - compositors write the literal "Unknown" rather than leaving make/model empty, so the picker label read "Unknown Unknown". One `describe` helper now treats that as absent, for all four backends. Verified on a headless two-output sway: names, modes, positions, scale and the case-insensitive pin all resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	93c2765db7	feat(vdisplay): mirror a pinned physical monitor on KWin ... P2 of design/per-monitor-portal-capture.md. zkde_screencast's stream_output records an output KWin already has — the connector name IS the selection, so there is no dialog, no portal and no chooser for a background service to answer. It arrives as a VirtualDisplay reporting DisplayOwnership::External, which already means "someone else's display, merely mirrored: no keep-alive, no topology, no reuse". So the rule that we must never disable, move or "restore" a monitor the user is sitting in front of holds by construction rather than by everyone remembering it — and create() ignores the client's requested mode for the same reason: a panel runs at the mode its owner set. Routing lives in vdisplay::open, the one place every session opens a display, so the pin cannot be honored on one plane and ignored on another. The host sets the libei anchor from the same pin (pf-vdisplay must not depend on pf-inject), which is what makes absolute input land on the mirrored head instead of a same-sized neighbour. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	2eeee650b9	fix(inject/libei): absolute coordinates resolve by identity, not by size ... libei hands the injector one region per logical monitor with no output name attached, so picking one meant matching the streamed mode's SIZE — a coin flip the moment two heads share a mode, and it already resolved wrong on-glass once (GNOME, a dummy HDMI beside the virtual primary: the seat cursor never entered the streamed monitor, so neither cursor path could see it). The ladder is now mapping_id -> origin -> size -> first. Two outputs can share a size but never a top-left, and a mirrored head's region is not the client's size at all, so the size rung cannot find it — this is what makes per-monitor capture land its input on the monitor it is showing. An anchor that matches nothing falls back down the ladder rather than stranding input: the region set is the truth and the anchor is our belief about it. It warns once per distinct anchor, because the failure this exists to prevent is a pointer that silently lands elsewhere. P1 of design/per-monitor-portal-capture.md — mechanism and tests only. Nothing sets an anchor yet; the pin wires it in P2, and the doc comment records why it is host-level and not per-session. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	95e3314d9a	feat(vdisplay): enumerate the host's physical monitors ... P0 of per-monitor capture (design/per-monitor-portal-capture.md): nothing in the tree could answer "what heads does this host have?", which both a monitor pin and a console picker need first. One read per compositor, each beside the code that already speaks that dialect: KWin's kde_output_device_v2 (the topology session now also records geometry + scale), Mutter's DisplayConfig.GetCurrentState, swaymsg get_outputs, hyprctl monitors. Logical geometry throughout, because x/y is what identifies a head — two monitors can share a size but never an origin. PUNKTFUNK_CAPTURE_MONITOR parses here and is reported at startup, loudly including that it is not yet enforced: a knob that is read but inert has to say so, or "it didn't work" reads as a bug. GET /display/monitors always answers 200 with an explained empty list, so a compositor-less host renders as "nothing to pick", not as a broken console. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Sonnet 5	3721b6816d	chore(release): bump workspace version to 0.20.1 ... 24 commits since v0.20.0. Patch, not minor: entirely fixes and hardening on top of last release's session⇄game work, nothing new to opt into. Headline fixes: three Windows install blockers reported within hours of 0.20.0 (a false conflicting-host detection, a broken winget log-path switch, missing package-source instructions), GameStream/Moonlight compat flipped back to opt-in on fresh installs, three gamescope Game Mode takeover faults that could black out a Linux machine or strand it on a host restart, a deactivated laptop panel misdiagnosed as a blind spot instead of a named stall cause, and the PyroWave high-bitrate latency-creep bundle (clock re-sync starvation, wire bitrate overshoot, backlog buildup, ABR probe false-congestion). Wire protocol stays at 2, the embeddable C ABI at 13 and the Windows virtual-display driver protocol at 6, unchanged from 0.20.0 — no embedder rebuild required, 0.18/0.19/0.20 hosts and clients mix freely. Notes authored ahead of the tag per docs/releases/README.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-27 19:25:47 +02:00
enricobuehler	0e0d5b8b4d	chore(api): regenerate openapi.json — the stats description drifted ... `2c69cbda` rewrote StatsSample::mbps's doc comment (goodput → attempted sealed wire bytes) without regenerating the snapshot, so `openapi_document_is_complete_and_checked_in` fails on main today. Pure regeneration, no API surface change: the description and the version stamp are the only differences.	2026-07-27 19:04:20 +02:00
enricobuehler	6be865f33f	fix(host): a host that is stopped hands the box's session back first ... Until now the host had no signal handling at all: SIGTERM killed it outright. That is fine for a host that owns nothing — but a managed gamescope takeover owns the box's session, and on a mask-fragile display manager (Nobara's plasmalogin) it has STOPPED that display manager for the length of the stream. Killed there, the host leaves a box with no graphical session and nothing left to restart it: the crash-restore state lives in $XDG_RUNTIME_DIR, which logind removes along with the user manager, so not even the next host start can heal it. `systemctl --user restart punktfunk-host` mid-stream — or a package update doing it for you — was enough to strand a box until someone reached a VT. So SIGTERM and SIGINT now restore first and exit after. The restore runs on a blocking thread (it shells out) under a 20s grace, well inside systemd's TimeoutStopSec, and a host that took nothing over exits immediately. `restore_takeover_now` is the synchronous sibling of the debounced disconnect restore, and deliberately ignores the keep-alive policy the latter honors: `keep_alive=forever` pins a session for the NEXT client, which means nothing once the host that would serve them is exiting. Both paths now share one `takeover_live()` predicate instead of repeating the four-way "is anything ours" test. Checked on Linux: clippy -D warnings on punktfunk-host + pf-vdisplay, tests, rustfmt.	2026-07-27 19:04:20 +02:00
enricobuehler	f3615f83a5	fix(gamescope): the takeover no longer kills the host it is running in ... Field report, Nobara + 0.20.0: switching into Game Mode mid-stream disconnects the client and the box never lights up again. His journal has the whole mechanism, ten seconds apart: 12:34:18.9 freed Steam: stopped the display manager for this stream 12:34:29.0 systemd[1685]: Stopping punktfunk-host.service Stopping the display manager ends the user's last login session. The packaged host is a `systemd --user` unit, so logind then stops user@1000.service once UserStopDelaySec elapses — 10s by default on Nobara — and takes the host with it. The stream dies, the scheduled restore never runs, and the display manager stays down with nothing left to restart it: a black box that needs a VT to recover. Exactly the two symptoms reported, and the intermittency is just whether an active Gaming Mode session was there to trigger the takeover at all. It never showed on the repro VM because lingering was enabled there for the earlier sessionless tests (`Linger=yes` — confirmed on the VM today), which is precisely the thing that breaks the dependency: logind keeps the user manager alive with no session. Our KDE/GNOME/Arch setup guides already ask for it; his box, following the KDE route, did not have it. So the takeover now ensures lingering BEFORE it touches the display manager: `loginctl enable-linger` directly (allow_active in logind's own policy — verified working unprivileged on Nobara), else the packaged helper gains a `linger` verb that enables it for PKEXEC_UID alone, never a caller-named user. If neither works the takeover is refused with an actionable error and managed degrades to attach — mirroring the box's own session is strictly better than a screen that needs a VT. Hosts that cannot be reached this way (root, a system unit) skip the check: the cgroup test is a pure `cgroup_under_user_manager` with a unit test, matched against the real shapes on a Nobara box (`user@1000.service/app.slice/...` vs a `session-N.scope`). Also documents the requirement in the gamescope guide's Nobara section. Checked on Linux: clippy -D warnings, 78 tests, rustfmt; helper verified with `sh -n`, and the linger enable/disable round-trip run live on the Nobara VM.	2026-07-27 19:04:20 +02:00
enricobuehler	eae1837a3a	fix(gamescope): a managed takeover never waits on a dialog nobody can see, nor acts on a months-old sentinel ... Two ways the Nobara DM-stop takeover could end a session and leave the box dark, both found while triaging a 0.20.0 field report (managed round-trip: "my client disconnects and my monitor doesn't turn back on", intermittent). 0.20.0 is the first release where that box runs the takeover for real — before it, no package shipped the polkit privilege, so managed always degraded to attach and never touched the display manager. Privileged verbs are non-interactive now. `try_stop_display_manager` and `restore_display_manager` try a plain system-bus `systemctl` first, and without `--no-ask-password` that asks polkit for INTERACTIVE authorization. On a box where the host runs inside the user's graphical session, polkit hands that to the session's agent: a password dialog on the box's own screen, which during a takeover is off or mid-switch. Nobody sees it, nobody answers it, and the call blocks on the stream's own thread — the capture-loss rebuild, or the restore worker — while the rebuild budget burns. The takeover then lands after the session it was for already ended. With the flag it fails immediately ("interactive authentication required"), which is what both callers are already written for: the packaged pkexec helper (allow_any, no agent needed) takes it from there. A sentinel with no baseline is not a request. `session_select_requested` read "no baseline recorded" as "the sentinel appeared during the session" — but `~/.config/steamos-session-select` is a permanent file, so every box whose user has ever switched sessions has one. The baseline was recorded only after a SUCCESSFUL launch, leaving a real window: takeover succeeds, launch fails, the client retries inside the 5s restore debounce (which the retry cancels), and the honor gate fires on a months-old write — pushing the box to the desktop the user never asked for, plus a 120s grace refusing to relaunch game mode. Now the baseline is taken at takeover too (setting STOPPED_DM is what arms the gate), and "never baselined" reads as no request. `SESSION_SELECT_BASELINE` carries both states explicitly, and the decision is a pure `sentinel_advanced` with a unit test for all six cases. Checked on Linux: cargo check --all-targets, clippy -D warnings, 77 tests, rustfmt.	2026-07-27 19:04:20 +02:00
enricobuehlerandClaude Fable 5	ba89b9fcd0	feat(tools): display-disturb learns the bench moves the field sessions needed ... Three upgrades from the on-glass rounds on .173/.221: - `ddc-open` timing: the handle-ACQUISITION cost per monitor is reported even when it yields no physical handles — the poller's first contact with a virtual display, exactly what the DDC-fail-fast driver work changes; the old code silently skipped handle-less monitors, which on a streaming host in exclusive topology is every monitor there is. - Monitors are labeled by GDI device name (\\.\DISPLAYn) so a virtual display and a panel are tellable apart in the correlation log. - `extend` mode: one SDC_TOPOLOGY_EXTEND poke — re-activates every attachable display, i.e. the exact 'non-managed display re-activated' event the exclusive watchdog evicts. One shot, not a loop: trigger a reassert round, observe the recovery. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 17:52:31 +02:00
enricobuehlerandClaude Fable 5	622817954a	fix(capture/win-display): a deactivated laptop panel is a named stall suspect, not a blind spot ... Field A/B (reporter, Legion 5 Pro hybrid, 2026-07-27): the ~2 s capture-stall metronome IS the exclusive isolate's own doing — deactivating the laptop panel leaves a dark-but-connected eDP head whose driver-level servicing disturbs the capture path (~1.7-2.8 s period); `topology: primary` (panel stays active) stopped it outright (16.3 stalls/min → 0). Our own .221 logged the identical signature the day before. The detector then steered AWAY from the cause: connected_inactive filtered to EXTERNAL physicals only, so the one display that mattered — on a hybrid laptop, the default config — reported as `none`. - TargetInventory: new `internal_panel` class bit (eDP/LVDS/embedded). - connected_inactive_externals → connected_inactive_physicals: internal panels join the suspect list (virtual/indirect stay excluded); a nameless panel renders as "laptop panel". - The below-OS METRONOMIC warn names the dark-panel case and its actual cures (`topology: primary`, `pnp_disable_monitors`) — the old text's "unplug it" prescriptions are impossible for an internal panel. - ddc_power_off: a zero-ack sweep now says at INFO that the axis did nothing (internal panels have no DDC/CI) instead of silently no-op'ing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 17:04:08 +02:00
enricobuehlerandClaude Fable 5	ab58fd2f0e	feat(vdisplay/driver): DDC/CI against the virtual monitor fails fast ... In exclusive topology the virtual display is the ONLY monitor on the desktop, so monitor-control software (the Twinkle Tray / PowerToys PowerDisplay / Monitorian class) aims its entire DDC traffic — brightness polls, capabilities-string requests — at OUR monitor. There is no bus and no sink; the only wrong answer is a slow one (a timeout-shaped failure occupies win32k's physical-monitor path, serialized per monitor, for its full duration). Register EvtIddCxMonitorI2CTransmit/Receive and answer every probe with an immediate STATUS_NOT_SUPPORTED, making the virtual monitor the cheapest thing on the "bus" to poll. (The receive DDI has no out-arg at the callback — refusing synchronously refuses the whole transaction.) EDID needs no equivalent: the OS serves descriptor queries from the blob supplied at monitor creation without calling the driver. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 15:37:06 +02:00
enricobuehlerandClaude Fable 5	1945052e66	fix(capture/vdisplay): descriptor-following defers while a topology reassert is in flight ... The exclusive-topology reassert's forced re-commit transiently bounces the virtual display's mode; the descriptor poller can sample that EVICTION state and recreate the ring at a mode the recovery chain is about to undo (field log 2026-07-27 10:30:44Z: hdr=true → false → recreate → recovery restores true → second recreate). New pf-win-display::topology_churn latch (deadline semantics — self-expiring, so a lost release can never wedge descriptor- following off): the watchdog holds it for interval+3s each fighting round and releases on "stable again"; poll_display_hdr consumes samples but acts on nothing while held — which also keeps the negotiated-depth pin-back from issuing a CCD write mid-eviction, where it would fight the reassert itself. The deliberate recreate_ring_in_place recovery path is unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 15:37:05 +02:00
enricobuehlerandClaude Fable 5	9e1a686795	feat(tools): display-disturb — deterministic display-stack disturbance generator ... The stall-immunity bench needs both stall classes on demand, without a standby TV or a monitor-tool storm: `ddc` replays the Twinkle-Tray/PowerDisplay-class DDC/CI traffic (VCP reads, optional capabilities-string requests) through the win32k I2C path; `modeset` re-commits the current mode with CDS_RESET — the Level-Two modeset entry that idles the whole adapter with nothing Win32-visible changing. Every op prints an epoch-stamped took_ms line so host.log stall reports correlate line-for-line, and the op duration itself measures the driver's service time per disturbance. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 15:24:20 +02:00
enricobuehlerandClaude Fable 5	19d6f79d2d	feat(vdisplay/driver): the frame pump survives MMCSS refusal and outranks GPU contention ... Two stall-immunity hardenings for the swap-chain drain thread (branch-2 of the disturbance-immunity program — failures in OUR delivery leg, as opposed to adapter-wide display servicing, which no priority survives): - MMCSS registration fails under the restricted WUDFHost token on some boxes; the drain thread then ran UNPRIORITIZED — the whole display's frame pump at normal priority, starvable by DDC/HPD-servicing DPC pressure into multi-hundred-ms delivery holes. Fall back to TIME_CRITICAL. - IddCxSetRealtimeGPUPriority (IddCx 1.9) raises the processing device above every regular application's GPU priority. Slot availability comes from raising the exported IddMinimumVersionRequired 4 → 10, which was overdue independently: the drain loop already calls ReleaseAndAcquireBuffer2 (1.10) unconditionally, so binding a pre-1.10 framework would dispatch past the populated IddFunctions table — with 10 an old framework fails the bind cleanly instead. The product floor is already Win11 22H2 (installer MinVersion=10.0.22621, whose framework is 1.10), so no supported system changes behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 15:24:10 +02:00
enricobuehlerandClaude Fable 5	94f0207cbd	feat(windows/client): logs persist — %LOCALAPPDATA%\punktfunk\logs\client.log ... The shell is a windows_subsystem binary and spawns punktfunk-session with CREATE_NO_WINDOW + inherited stderr: a normal GUI/MSIX launch has no console, so every log line — the shell's and the session's whole receive/decode/present forensic trail — evaporated exactly when a user hit something worth reporting. The 2026-07 PyroWave latency-sawtooth report had to be triaged from host logs alone; the deciding evidence (clock re-sync vs backlog-flush lines) lives client-side. - New logfile module: %LOCALAPPDATA%\punktfunk\logs\client.log, the host's rotation convention (10 MB cap -> .old at next start, one generation), best-effort (no dir -> plain stderr, never a startup failure). - The tracing subscriber tees to stderr AND the file (ANSI off — the file is what users send); startup logs the path. - The spawned session's stderr is piped through the same tee, line-buffered — dev-terminal runs keep their interleaved output, GUI runs finally keep anything at all. - The --console path and the punktfunk-console.exe MSIX shim forward the same way (a couch launch has no console either). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehlerandClaude Fable 5	2c69cbdab9	docs(host/stats): say what the stats actually measure — three field-triage traps ... Three lines that each sent the 2026-07 PyroWave field triage down a wrong path, made honest: - The 'client accepts streamed AUs … will stream per-slice' log fires before the encoder exists and regardless of backend support (only Linux direct-NVENC implements chunked polling) — it now states the client capability only. - StatsSample::mbps was documented as 'transmit goodput'; it is attempted sealed wire bytes at seal time — AU bytes + shard framing + FEC parity (+ PyroWave window padding), not reduced by socket send drops. - The per-stage split's 'encode' stage is the poll() duration, which is ~0 by construction for synchronous backends (PyroWave encodes inside submit → its time shows as 'submit') — documented at the split's definition so 'encode 0.00' stops reading as an instrumentation hole. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehlerandClaude Fable 5	d8d8c6c43d	fix(core/abr): the capacity probe's own overload no longer reads as session congestion ... The startup speed-test probe deliberately overloads the link (2 Gb/s for 800 ms) to measure capacity. The report tick is suppressed while it runs and the window anchors are rebased when it ends — but two residues leak past the rebase: probe frames still pending in the reassembler age out as frames_dropped for another ~120 ms (the loss-window fuse), and the burst can latch flush_in_window (a jump-to-live it caused itself). Either one reads as a SEVERE window: the controller backs off ×0.7 and — worse — slow start ends at the first congestion signal, permanently. That is precisely the 2026-07 field report's Automatic session: 20→14 Mb/s exactly one report tick after the probe, then a purely additive +6 %/4.5 s crawl that took the whole 4.5-minute match to reach 308 Mb/s on a link the probe had just measured at ~1.2 Gb/s. Slow start (doubling per clean window to the probed ceiling, 'seconds instead of minutes') never got to run. The first post-probe report window is now discarded outright: no LossReport (probe residue would also spike the host's adaptive FEC), the standing-latency detector closes it as not-loss-free (its clean-run just resets), and the ABR is fed nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehlerandClaude Fable 5	b8b8ac336c	feat(core/client): all-intra streams drain the frame channel to the newest AU ... The pre-decode FrameChannel is strictly FIFO because H.26x reference chains forbid mid-stream drops — falling behind is only recoverable via the coarse jump-to-live thresholds (depth ≥6 sustained, or 400 ms behind the capture clock) at the cost of a keyframe round-trip. PyroWave has no reference chains: every AU decodes independently, so a slow consumer can skip straight to the newest queued AU with zero recovery cost. The pump now flags the channel all-intra for PyroWave sessions and pop() drains to the newest, which caps any standing pre-decode queue at ~1 frame structurally — the 2026-07 field report's 780M client could otherwise ratchet a real multi-frame backlog (and with it the OSD latency) between those coarse thresholds. Skips are counted separately from losses (they were delivered, just superseded) and surfaced at debug on the report tick — the OSD 'lost' line keeps meaning wire loss. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehlerandClaude Fable 5	6d1baa0add	fix(pf-encode/pyrowave): the bitrate pin holds on the WIRE, not the raw bitstream ... A datagram-aligned PyroWave session inflates the codec bitstream ×1.2–1.3 on its way to the wire — greedy packing of few-hundred-byte atomic block packets into 1408 B windows zero-pads most window tails, plus the 4-byte prefixes and FRAG chains. The 2026-07 field report's 1440p60 10-bit "Automatic" pin of 407 Mb/s put a measured 550 Mb/s on a 1 GbE link; nothing enforced the pin past the rate controller. New shared WireBudget (pyrowave_wire.rs, both backends): tracks the real per-frame AU/bitstream ratio as a ×1024 fixed-point EMA (prior ×1.25, weight 1/8, clamped ×1.0–×2.0) and deflates the budget handed to pyrowave's rate control by it, so the windowed AU lands on the configured rate. Sealed-datagram framing (+4.5%) and FEC parity stay uncompensated — H.26x sessions carry those on top of the configured bitrate too, and the pin must mean the same thing for every codec. Dense (non-chunked) sessions are untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehlerandClaude Fable 5	53640b8754	fix(core/clock): re-sync survives loaded links — floor baseline, spaced rounds, bounded staleness ... The mid-stream clock re-sync starved on high-bitrate LAN sessions (2026-07 PyroWave-sawtooth field report, RX 9070 XT -> 780M @ 550 Mb/s): every batch was judged against the CONNECT-TIME RTT, measured before the video data plane existed, with a 2 ms floor — mid-stream control RTTs on a loaded GbE link sit above that almost permanently, so batches were rejected for minutes while the wall clocks drifted apart and the OSD e2e figure ramped 19->150 ms before snapping back on a lucky batch. Three changes: - Rounds are spaced 7 ms apart (stamped at send time, so the spacing never lands in the RTT). An 8-round batch used to complete inside ONE ~6 ms video burst — all rounds sampled the same congestion state; spacing walks them across the frame cycle so the min-RTT round finds a quiet gap. - ResyncGuard replaces the static baseline: the guard band follows the best RTT the session has evidenced (connect RTT, then min over every completed batch — rejected ones included). - Rejection streaks are bounded: after 3 consecutive rejections the best (min-RTT) batch of the streak is applied anyway. Its queueing bias is at most ~half its RTT; unbounded wall-clock drift costs more per minute. Rejections now log at warn with the streak and floor — the starvation signature is grep-able in exactly the logs users send. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 12:51:11 +02:00
enricobuehler	94b7a834cb	fix(installer/windows): GameStream is opt-in, not on by default ... A user found this in their log and had never been offered a choice: WARN GameStream/Moonlight compat ENABLED (--gamestream): its pairing runs over plain HTTP and its legacy control encryption can reuse GCM nonces (security-review #5/#9) — an on-path LAN attacker could MITM pairing or recover input. Enable only on a TRUSTED network. They were right. The `gamestream` task carried no `Flags: unchecked`, so it was pre-ticked; and since a silent install takes the wizard's own task defaults (1839d756), a winget install turned it on with no checkbox ever shown. The host warns that this plane is a security downgrade on every single start, so having the installer enable it by default cannot be squared with our own advice — least of all on the path where nobody sees a wizard. Now unchecked, matching `allowpublicfw`, the other task with a security consequence. A default install therefore lands `PUNKTFUNK_HOST_CMD=serve`, the native-only host; Punktfunk's own clients are unaffected, since the native punktfunk/1 plane is always on. Unattended opt-in is `/MERGETASKS=gamestream`. Scope, deliberately: this changes FRESH installs only. `GamestreamParam` already omits the flag entirely unless `FreshHostInstall`, so no existing host has its choice touched by an upgrade, and anyone relying on Moonlight today keeps it. `DEFAULT_HOST_CMD` (the service's fallback when host.env carries no PUNKTFUNK_HOST_CMD line at all) is deliberately NOT flipped here: the installer always writes the line explicitly, so it does not affect a normal install, and inverting it would silently disable Moonlight for anyone whose host.env lost that line — a runtime regression that belongs in its own change, if at all. Docs corrected everywhere they stated the old default, since three of them now told users the opposite of what ships: the winget Agreement shown BEFORE install (it said "enabled by default" and gave the opt-OUT override), the Windows packaging README, and host.env.example. The `--override` example in the installer manifest is inverted with it (`/MERGETASKS=gamestream` to add, `!` to remove). Verified: [Tasks] + [Code] compile with ISCC 6.7.1 on the windows-amd64 runner (all optional features defined), and the winget catalogue rebuilds and passes 29/29 with the edited manifests.	2026-07-27 12:26:47 +02:00
enricobuehler	4114dfeff7	fix(winget): the Log switch used |LOGPATH|, which winget never substitutes ... Second field report on 0.20.0's winget path, and independent of the conflict abort in 37781a61: an INTERACTIVE install through UniGetUI dies before the wizard with Inno's "Error creating log file: The filename, directory name, or volume label syntax is incorrect." `<LOGPATH>` is winget's own token and the only spelling it replaces — the schema this manifest declares says so verbatim ("<LOGPATH> token can be included in the switch value so that winget will replace the token with user provided path"). We shipped `|LOGPATH|`, which is not a token, so winget passed the literal string to Inno; `|` is not legal in a Windows filename, and Inno refuses before doing anything else. Worse than the conflict abort in two ways: it is not confined to silent installs — it fires in EVERY mode for any caller that requests a log — and UniGetUI requests one by default, so a GUI user cannot install at all. Confirmed against the live source, which is serving the broken switch to everyone right now: curl -s https://winget.punktfunk.unom.io/packageManifests/unom.PunktfunkHost → "Log": "/LOG=\"|LOGPATH|\"" Guarded by the suite that exists for exactly this class of defect (a wrong response shape does not fail loudly — winget just says "no package found"). The new check accepts an absent Log switch, requires <LOGPATH> when present, and rejects any |TOKEN| spelling. Mutation-verified: restoring |LOGPATH| fails the check naming the offending value, and the corrected manifest passes 29/29. ⚠ Fixing the template does NOT fix the live catalogue: it is derived from the manifest trio attached to each release, so the corrected switch only reaches users when a release carries it.	2026-07-27 10:28:59 +02:00
enricobuehler	37781a610f	fix(installer/windows): only a host that will actually RUN is a conflict ... Field report within hours of 0.20.0 (HitFrostbite): `winget install unom.PunktfunkHost` fails with "Installer failed with exit code: 1", 0x8A150006, after the hash verifies and the install starts. That is Setup aborting on purpose. `StreamHostPresent` counted a conflicting host as present if its SCM service key existed at ANY start type, OR if a bare Program Files\<Name> directory existed — so a disabled service, or a folder left behind by an uninstall, read as a live conflict. 3d893013 then made the warning a SuppressibleMsgBox defaulting to IDNO so unattended installs could not hang on it; under winget's /VERYSILENT /SUPPRESSMSGBOXES that default aborts InitializeSetup, and Inno exits "failed to initialize" = code 1. Net effect: anyone with Sunshine on disk — the exact audience most likely to migrate — could not install via winget at all, with no visible reason. The other candidate for exit 1 is excluded rather than assumed: the manifest declares MinimumOSVersion 10.0.22621.0 matching the script's MinVersion, so winget refuses an unsupported OS BEFORE downloading, and the report shows the hash verified and the install starting. The conflict check is also the only `Result := False` in InitializeSetup. Detection now keys on the service's `Start` value (0 boot / 1 system / 2 automatic / 3 manual / 4 disabled), counting only 0-2 — a host that comes up on its own is the only kind that can take the GameStream ports or load a second virtual-display driver. Directories no longer count at all: they were the noisiest signal and the one that survives an uninstall. This makes the installer agree with the tray, which dropped its always-on warning over a merely-INSTALLED Sunshine in this same release (3e782852) for exactly the same reason. The message now says "installed and set to start automatically" and offers disabling the service as a remedy, both of which are what is actually detected. A conflicting host running as a plain user process is deliberately not detected: pure Pascal cannot enumerate processes, it is a runtime rather than install-time condition, and the host already reports it via the `punktfunk::detect` startup warning, `detect-conflicts`, and /api/v1/local/summary. Verified by compiling the [Code] section with ISCC 6.7.1 on the windows-amd64 runner (WithWeb defined, as CI does). That caught two defects in my own first draft that review would not have: a continuation line STARTING with #13#10, which ISPP reads as a preprocessor directive ("Unknown preprocessor directive", compile aborted), and `{commonpf}` written inside a `{ }` comment, which closes it early since Inno comments do not nest. Both are noted at the sites so they are not reintroduced.	2026-07-27 09:00:34 +02:00
enricobuehler	ec9aa415f6	chore(web): override brace-expansion to 5.0.8 — clears GHSA-mh99-v99m-4gvg ... bun-audit has been red since the advisory published, so it was already failing before v0.20.0 was cut (same failure on 0323158a). High-severity DoS: unbounded expansion length causing an OOM crash. All three paths are dev tooling — orval→typedoc→minimatch, @storybook/react-vite→glob→minimatch, and nitro-v2-vite-plugin→nitropack→archiver→archiver-utils→glob→minimatch — so nothing shipped to a user was exposed, but the leg gates every lockfile change. Done as an `overrides` entry, joining the eight already there for exactly this purpose. `bun update brace-expansion` is NOT the fix and was reverted: for a package that is only transitive it adds a spurious DIRECT dependency, and it does not even resolve the advisory — it hoists 5.0.8 for the new direct dep and leaves `minimatch/brace-expansion` pinned at the vulnerable 5.0.7. The advisory's affected range is `<= 5.0.7` across ALL majors with 5.0.8 the only patched version, so the two nested 2.1.2 copies had to move too — a major bump for consumers declaring ^2.0.1/^2.0.2. Checked rather than assumed: 5.0.8 is dual ESM/CJS with a real `require` branch in its exports map (2.1.2 was plain CJS), so those consumers still resolve. Proven by building: the nitro build is itself one of the forced consumers. Verified: `bun audit` reports no vulnerabilities, both nested entries are gone from the lock, and the full CI web sequence is green — `bun install --frozen-lockfile --ignore-scripts`, `bun run build`, `bun run lint`.	2026-07-27 07:32:08 +02:00
enricobuehler	24d2f97eae	fix(ci/winget): forward GITHUB_REF_NAME into the remote shell ... The catalogue-verify step has failed on every stable tag since it landed, v0.20.0 included: `bash: line 6: GITHUB_REF_NAME: unbound variable`, twice, then exit 1. `env:` populates the RUNNER's environment. appleboy/ssh-action executes its `script` on the REMOTE host over SSH, which inherits none of it — the action has a separate `envs:` input naming the variables to forward. Without it the `set -u` at the top of the script turns the first expansion into a fatal, and the two `curl`s either side report only the collateral: `Failed writing body` is curl losing its pipe when the `grep` it was feeding died. The failure is maximally misleading, because everything it guards ALREADY WORKED: the catalogue is built, tested and shipped in the preceding steps, and only the proof-of-serving fails. Confirmed by hand against the live source during the v0.20.0 release — it serves unom.PunktfunkHost 0.20.0 correctly. The pattern was already right everywhere else: both "Pull and start docs" steps (deploy-services.yml, docker.yml) pair `env:` with `envs:`. A sweep of the other three ssh-action steps found no further instance — the remaining two pass no variables at all.	2026-07-27 07:31:55 +02:00
enricobuehler	c9b8f666cd	docs(release): winget needs its source added first — say so ... Reported within an hour of the announcement: `winget install unom.PunktfunkHost` answers "no package found". That is correct behaviour, not a broken package — Punktfunk is served from its own REST source, and winget only searches sources it has been told about. The notes said "after adding Punktfunk's package source once" without ever giving the command, so there was no way to act on it. Both commands are now spelled out, the `winget source add` one flagged as needing an Administrator terminal (it does), and the failure mode is stated explicitly so someone who hits it recognises it rather than filing it as a bug. The lead-in is untouched, so the Discord embed for v0.20.0 stays accurate and this needs no re-announcement — the release body is re-synced from this file.	2026-07-27 07:31:37 +02:00
enricobuehler	35b6c835fd	docs: on a gamescope session the display outranks the end-game setting ... On-glass on .41: with `game_on_session_end: keep` — "leave it running, nothing is ever closed" — a deliberate stop ended the game, and a drop ended it ~14 s later. Both times the LEASE did the right thing (no `ending the launched game` line); the game died because the virtual display was torn down, and a nested launch runs inside that gamescope. So on a dedicated gamescope session the game's lifetime IS the display's, and keep-alive decides it — not this setting: * a deliberate stop skips the linger by design, so the game goes at once, * a drop lingers the keep-alive window, then takes the game with it, * only keep-alive Forever actually keeps it — and `always` still ends it at the reconnect window, which is the documented precedence and was verified (a `forever`-pinned display released at grace expiry, 60.006 s). That makes the console's promise untrue on the most common Linux setup, so the card now says so for every option rather than only warning about `always`, and the docs get the three cases as a table. Worded so a non-gamescope host reads it and moves on — a desktop-session launch is an ordinary process and none of it applies. Not changing behavior here: making `keep` pin the display would pit it against "a stop must not leave a ghost display", and which wins is a product call rather than something to decide silently mid-test. web: codegen + tsc + biome clean, en/de complete. docs-site: build + tsc clean.	2026-07-27 01:43:40 +02:00
enricobuehler	39a9f09f04	fix(mgmt/web): the running-game cover slot says "game" when there is no art ... Rendered the Dashboard stories headlessly and looked at them, which is how this turned up: with no cover the slot was an empty grey rectangle, reading as something that failed to load rather than something absent. Plenty of rows will never have art — an operator-typed command has no catalog entry behind it, a custom entry may carry none, and nothing does until `/library` has loaded. The slot keeps its fixed size so rows stay aligned when only some titles have covers; it just holds a gamepad glyph instead of nothing.	2026-07-27 00:47:05 +02:00
enricobuehlerandClaude Opus 5	f57fc85d34	chore(release): bump workspace version to 0.20.0 ... 117 commits since v0.19.2. Minor rather than patch: the headline is the session⇄game lifetime binding on both planes and both platforms — the stream ends when the game does, and optionally the reverse — plus library metadata, winget packaging for the Windows host, a 64-bit ARM Linux client, headless `--pair` enrolment, DRM card selection for the compositor-less presenter, and the ABR/latency de-escalation work, which changes runtime behaviour on every session. Wire protocol stays at 2, the embeddable C ABI at 13 and the Windows virtual-display driver protocol at 6, so 0.18/0.19/0.20 hosts and clients mix freely and no embedder rebuild is required. The new GameMeta library fields are optional and flat on the wire. Notes authored ahead of the tag per docs/releases/README.md, so the release is born with a body. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 00:33:45 +02:00
enricobuehlerandClaude Fable 5	0323158a3e	fix(vdisplay/gamescope): a fresh dedicated launch streams from the first second ... A freshly spawned headless gamescope never delivered a single PipeWire buffer when a game was launched: gamescope only composites (and only on a composite pushes a capture buffer) when a client paints, and a nested Steam bootstrap paints nothing until its UI's first frame — far longer than the 10 s first-frame budget. The native plane's retry ladder then killed the half-booted Steam on every attempt and started from zero; the GameStream plane died on its single wait. Reused live displays worked, which pointed away from the real cause (root-caused on .41 with a raw pw_stream probe: `sleep infinity` nested → 0 buffers ever, `vkcube` nested → 60/s immediately). Every bare spawn now backgrounds the host's own splash client (`gamescope-splash`, hidden subcommand) beside the nested app: a dark window with a subtle breathing bar painted at ~2.5 Hz — damage from the first second, so capture gets its first frame within the budget on both planes. In `--steam` mode gamescope composites only windows whose appid is in the root `GAMESCOPECTRL_BASELAYER_APPID` list (live-proven: even a painting vkcube gets zero composites without it), so the splash declares itself as the Steam UI (STEAM_GAME=769) and seeds the baselayer iff unset; Steam's own rewrite at game launch hands composite focus to the game with no action on our side. PUNKTFUNK_GAMESCOPE_SPLASH=0 is the escape hatch. The dedicated Steam launch is also shaped with `-gamepadui` instead of `-silent`: the nested Steam is Big Picture — the identity gamescope's `--steam` integration is built around — so the boot shows the gamepad UI instead of the desktop client window flashing through the stream, and gamescope's focus rules (game outranks the Steam UI appid) cover what `-silent` was working around. On-glass on .41 (Bazzite, RTX 5070 Ti, gamescope c31743d): cold connect + Balatro launch delivers frames on the first attempt on both a cold and a torn-down-then-fresh spawn; Big Picture boot → game handover confirmed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 00:28:59 +02:00
enricobuehler	980b399ea8	test(session/gamelease): the live-process test waits out the shim window ... Its child is `sh` running a script that `exec`s a binary outside the install dir, so neither the image path nor the command line carries the directory — the host's own child is the only signal there is. Which is exactly the case the shim window now gates: a live child that might still turn out to be a launcher is not called the game until that window passes. So "running" legitimately arrives up to SHIM_WINDOW later than it used to, and the assertion at 1.5 s was asserting the old behavior. Waiting it out is the point now, not an accident of timing. The delay is the deliberate cost of the fix: until the window passes there is no way to tell "the child IS the game" from "the child is about to hand off". It shows as a few seconds of `launching` in the console, and only for a title whose store gave us signals. .25: the ignored live test passes (Child -> Running -> terminate via the SIGTERM->SIGKILL group ladder -> Exited, session-end action correctly NOT fired), full suite 305 passed.	2026-07-26 22:33:42 +02:00
enricobuehler	d5857abd91	fix(session/gamelease): a launcher handing off is not the game exiting ... On glass (.41), launching any Steam title over the compat plane ended the session ~7 s later, before the game had started: launched app command=steam steam://rungameid/2379780 pid=12699 watching the launched game kind="child" the launched game is running kind="child" procs=0 <- 3 ms in, zero game procs the launched game exited -> session ended Linux launches are `Child` leases: the host spawns the launcher itself. The watcher counts "my child is alive" as the game running, so the lease left the waiting phase on its FIRST poll — and the shim reclassification lives in that phase, so it never got to run. When `steam` handed off and exited, that read as the game exiting. The design always called for the shim window ("never fires B from a shim exit") and the code implements it; the lease had simply moved past where it applies. So when the store gave us signals to recognize the real game by, a bare live child no longer counts as the game until that window has passed. With no signals the child is all we have and still counts immediately — custom commands are unchanged. Windows could not reproduce this: it holds no child, so its leases are always `Matched`, and the whole .173 pass was structurally blind to it. Both planes on Linux were affected — which is most of the audience for this feature. Also fixes the live-process fixture, which was CI-red for an unrelated reason: it copied `/bin/sleep` to a file named `game`, and modern coreutils (uutils on Ubuntu 25.10+, busybox elsewhere) is a MULTI-CALL binary dispatching on argv[0] — under any other name it exits instantly, leaving nothing in /proc and looking exactly like a broken matcher. Verified by A/B: the same test fails identically on a tree predating these changes. .25 (Ubuntu 26.04): 305 passed, 0 failed.	2026-07-26 21:24:12 +02:00
enricobuehler	0c261de636	ci(plugin-kit): quote the step name that contains a colon ... `- name: Repair the file: dependency (…)` is not valid YAML — the unquoted `file: ` reads as a second mapping key — so the workflow has been unparseable since it was added, which is why re-pushing the tag never triggered a run and a manual dispatch 500'd. I had put that down to a Gitea tag quirk; it was this. The failure is invisible from the repo side: nothing validates workflow YAML on push, and an unparseable workflow simply never runs.	2026-07-26 20:45:58 +02:00
enricobuehler	6e07d063c3	fix(session/gamelease): Windows had no launch reference, so it adopted old games ... On glass (.173), with a copy of Buckshot Roulette already running: a session launched the same title, Steam focused the existing instance rather than starting one, the lease adopted THAT process — and a deliberate stop closed the player's pre-existing game. That is the one thing the design says must never happen. The rule was written and the matcher implements it; the reference instant it filters against just never arrived. `procscan::launch_stamp` supports Windows, but the wrapper every launch site calls was gated `#[cfg(target_os = "linux")]` and answered `None` everywhere else — and `None` doesn't fail, it turns the filter OFF (`find` skips it), so every process under the install dir became adoptable. Windows is where this matters most: the host runs as SYSTEM and can see every process on the box, which is why `procscan/windows.rs` calls rule 1 load-bearing rather than a nicety. Both planes were affected. No unit test could have caught it — the Linux fixtures pass an explicit `min_start`, and the Windows live test passes `None` deliberately. So the guard added here asserts the reference EXISTS wherever processes can be matched, which is the shape of the failure: silent, and invisible from downstream. .133: 282 passed (+1), same 4 environmental native::tests failures.	2026-07-26 20:30:20 +02:00
enricobuehlerandClaude Fable 5	dff63b2a29	fix(encode/nvenc): a visible cursor no longer serializes submit — the blend goes stream-ordered ... Report: iPad on a gamescope/NVIDIA 120 fps session capped at ~80 fps with repeat_fps 0, zero loss, capture 0 µs, ASIC 15 µs — and submit p50 at 10.2 ms, ~81 % of the loop period. Under gamescope the host composites the live pointer into EVERY frame, and a cursor-bearing frame forced the CPU-synced submit path: a blocking CUDA copy plus a fence-waited Vulkan blend, both exposed to the running game's GPU load. The "games hide the cursor" assumption the gate relied on does not hold under gamescope. The blend is now stream-ordered end to end. VkSlotBlend exports a timeline semaphore (VK_KHR_timeline_semaphore + external_semaphore_fd) into CUDA (cuImportExternalSemaphore, new dlopen entries): the enqueued copy signals it on the encode thread's copy stream, the blend submission waits for and advances it on the Vulkan queue, and a CUDA-side wait orders the encode after the blend on the session's bound IO stream — no CPU sync anywhere, so cursor frames keep the stream-ordered fast path. Each ring slot gets its own command buffer + descriptor set (written once) so several ordered blends can be in flight; cursor-bitmap uploads and teardown quiesce through the timeline. Drivers without the timeline export keep the previous CPU-synced blend, and any bring-up or per-frame failure still degrades to "no cursor", never a dropped frame. Also: the blocking multi-plane copies (the escalated/pipelined mode and the non-stream-ordered fallback) now enqueue every plane and pay ONE stream sync instead of one per plane (NV12 2→1, YUV444 3→1) — each exposed wait costs scheduling latency under GPU contention, which is what makes the escalation's blocking copies self-reinforcing. Verified on the RTX 5070 Ti box (driver 610.43.03): all 12 nvenc_cuda on-hardware smokes green, including the new nvenc_cuda_cursor_blend_stream_ordered (6 cursor AUs, all ordered, across a bitmap-serial flip); host suite 301/301; clippy --all-targets -D warnings clean; struct layouts of the hand-flattened cuda.h params asserted in tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 20:05:27 +02:00
enricobuehler	02b94b828d	fix(gamestream): the termination type comes from the version we advertise ... Still -1 on glass. The message was going out; the client was ignoring it. Which packet-type table a client reads is decided by exactly one thing — moonlight-common-c sets `encryptedControlStream = APP_VERSION_AT_LEAST(7, 1, 431)` — and we advertise 7.1.431, so every client reads the ENCRYPTED table, where termination is 0x0109. We were sending 0x0100. Deriving that from the nonce scheme was the error: `NonceKind` describes how the GCM nonce is built and nothing else. The two look like the same "is this encrypted" axis and are not. The HDR message could never have caught it either, since 0x010e is identical in both tables — so the only symptom was the silence this whole chain has been about. Pinned with a test asserting APP_VERSION still clears 7.1.431, because if it ever drops below, the correct type silently becomes 0x0100 again and the stream goes back to ending as an error with nothing failing to explain why. .133: 281 passed (+3), same 4 environmental native::tests failures. The Linux box is off the network, so the full Linux suite is owed.	2026-07-26 20:04:54 +02:00
enricobuehler	e44f2b1024	fix(gamestream): say "the app quit", not just goodbye ... Disconnecting the ENet peer stopped the freeze but the client then reported the session as error -1: a bare disconnect is indistinguishable from the host falling over, so Moonlight called it a connection failure. Which, from its side, was a fair reading — we never said otherwise. The protocol has a word for this. Send the TERMINATION control message with `NVST_DISCONN_SERVER_TERMINATED_CLOSED` first, then disconnect; the client maps that to a graceful termination (given it has seen a frame, true of any real session) and lands the player back in the app list. Constants verified against moonlight-common-c `ControlStream.c` rather than recalled, because every way of getting this wrong is silent — the client ignores an unparseable control message, which reads on glass as the same freeze: * the type comes from the table the CLIENT chose, so it is derived from the negotiated nonce scheme (plain 0x0100 / encrypted 0x0109) instead of guessed, * the reason is BIG-endian (the >=6-byte branch; the short branch is a little-endian u16, which is GFE's older shape). `disconnect_later` rather than `disconnect`, so the queued message actually reaches the wire instead of racing the teardown — which would land us back at -1. The session's GCM key is cached per tick because ending a session clears the launch state the key lives in, and this is precisely the message that has to be sealed after that.	2026-07-26 19:58:25 +02:00
enricobuehler	ddc28de32a	fix(gamestream): tell the client when the HOST ends the session ... On-glass on .173: a launched game exited, the host tore the session down correctly — and the client froze on its last frame instead of returning to its app list. The host's half was right; it just never said anything. On the native plane ending a session closes the QUIC connection with APP_EXITED, which every client renders as "game ended". The compat plane has no such channel: `end_session` stops the media threads, and stopping a UDP sender is silence, not a signal. Moonlight holds the ENet control stream for the whole session, so with no word from us it sat there until its own timeout eventually fired. The control loop already reacted to the CLIENT disconnecting; it had no path for the reverse. It now watches for its session being cleared out from under it and disconnects the peer, which is what Moonlight reads as "the session is over" — landing the player back in the app list, the same place quitting puts them. This is the signal every host-side end needed, not just a game exiting: the management stop and a `/cancel` racing another connection had the same silence.	2026-07-26 19:44:55 +02:00
enricobuehlerandClaude Opus 5	1839d7566b	feat(packaging/winget): install the Windows host with winget, from our own source ... `winget install unom.PunktfunkHost` after adding the source, and `winget upgrade` from then on. Windows had no update path at all before this — no self-update, no package manager — so keeping a host current meant noticing a release and re-running an installer by hand. Ships the manifest trio in winget-pkgs' own format (so submitting upstream later is a copy, not a rewrite) plus a release-time generator that substitutes only version, URL, hash and release-notes link. Everything reviewable — the silent switches, the agreements, the installation notes — stays in the checked-in templates rather than buried in a generator. Silent installs deliberately take the SAME task defaults the wizard shows: a per-channel default is a support trap. The disclosures the wizard puts on screen travel as manifest Agreements instead, shown before install and requiring acceptance — VB-Audio's bundling grant wants the user to see VB-CABLE's origin and donationware status, and a silent install shows them nothing otherwise. The console password can only be pointed at, never printed: it is generated per install and the notes are fixed at publish time. Self-hosted rather than the community repo, which gates on Defender/SmartScreen validation the self-signed installer cert would not clear today. The source is three endpoints — /information, /manifestSearch, /packageManifests/{id}. The reference implementation's other twenty are its admin API for mutating a CosmosDB; a catalogue generated at release time has nothing to mutate. It runs on unom-1 as a stock bun image with the two .mjs files bind-mounted, the same shape as the flatpak server, so there is no image to build or pull. The catalogue is derived from the RELEASES rather than local files: winget resolves --version and upgrade against the version list, so a source that only knew the newest release could neither pin an older one nor show an upgrade path from it. That also leaves no state to drift — re-running the build reproduces it exactly. NormalizedPackageNameAndPublisher is declared unsupported on purpose. winget derives it client-side with its own normalization, and a near-miss silently mis-correlates an installed host; ProductCode is exact and Inno gives us one. 28 checks drive the handler directly, and CI gates on them before anything reaches the box — a wrong response shape does not fail loudly, it just makes winget report "no package found". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 19:09:13 +02:00
enricobuehlerandClaude Opus 5	3d89301336	fix(installer/windows): a silent install can't hang on a prompt, and an upgrade keeps your choices ... Three faults that only bite when nobody is watching the wizard — which is how a package manager always runs us, and how a re-run by hand half-behaves today. The conflicting-host warning used a plain MsgBox. That ignores /SUPPRESSMSGBOXES and displays even under /VERYSILENT, so an unattended install onto a box already running Sunshine/Apollo would sit on a modal dialog nobody can see or click. SuppressibleMsgBox with an IDNO default aborts instead, which is the honest answer for a combination the message itself calls unsupported. The GameStream and Public-firewall choices were re-applied on every run. A silent run has no wizard, so every task falls back to its script default and the installer confidently re-asserted it: a user who enabled GameStream had it turned off again, and one who opened the firewall on Public networks had it quietly revoked (that task is default-unchecked, so the reset ran the other way). Both params are now fresh-install-only, keyed off whether host.env already exists. `service install` already read an absent --gamestream as "keep host.env as-is"; --allow-public-network becomes tri-state the same way, resolving an absent flag from the marker the previous install recorded. It is strict on the value: a typo'd =of must not fall through to a marker that may say true, because that turns a mistyped opt-OUT into leaving Public open. Also brands the installer "Punktfunk Host" in the strings a user actually sees — Add/Remove Programs, the Start Menu group, the wizard task text. Paths are untouched; renaming those would relocate installs and orphan existing config. Verified on the windows-amd64 runner: ISCC compiles the script (with WithWeb defined, so the password page parses too), and cargo check + clippy -D warnings pass for punktfunk-host with nvenc,amf-qsv,qsv. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 19:09:13 +02:00
enricobuehlerandClaude Opus 5	1ee06defa6	feat(library): descriptive metadata on every entry — platform, year, genres, and friends ... Emulation-and-beyond libraries need more than a title and a poster. Every library shape (GameEntry, CustomEntry, CustomInput, ProviderEntryInput) now carries a shared, flattened GameMeta: platform, description, developer, publisher, release_year, genres, tags, region, players. All fields are optional and flat on the wire, so existing library.json files, provider plugins, and clients keep working unchanged. - Installed-store scanners (Steam, Lutris, Heroic, Epic, GOG, Xbox) stamp platform=PC; custom/provider entries carry whatever was authored. - GET /library grows a ?platform= filter (case-insensitive) beside ?provider=. - Console: the add/edit form gets a Details section (round-tripping every field, since update replaces the entry), the poster tile a platform badge (non-PC only — the store badge already implies PC) and the year. - plugin-kit: ProviderEntry accepts the same fields (new GameMeta schema, spread flat); SDK + OpenAPI spec regenerated. - pf-client-core decodes platform for future client badges. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 19:00:30 +02:00
enricobuehler	d8b7a86366	ci(plugin-kit): repair the file: dependency bun 1.3 links to itself ... The publish workflow has been failing at Typecheck with "cannot find module '@punktfunk/host'" — every import of the SDK, in a job whose previous step built that very SDK successfully. bun 1.3 installs a `file:` dependency by copying its DIRECTORIES but symlinking each top-level FILE to itself: `node_modules/@punktfunk/host/package.json -> package.json`, a dangling self-reference. So `dist/index.d.ts` arrives intact while the manifest that points at it does not, and resolution dies at the first step it takes. The types were never missing; nothing could find the front door. Replacing that tree with a real copy is the whole fix, and the step no-ops itself the moment bun links `file:` deps correctly again. Not a regression from anything in the kit — it has been broken since bun updated, and went unnoticed because nothing has been published since 0.1.4. Verified from a clean node_modules: install → repair → typecheck → 20 tests → build, all green.	2026-07-26 18:58:49 +02:00
enricobuehler	f0e71e928a	fix(gamestream): the resolved launch command is what the backend nests ... A Windows/macOS build compiled the resolved-launch parameter out entirely and warned about it, because the two uses left were both Linux-gated. Both platforms want the same value: off Linux `set_launch_command` is a backend no-op and a library title resolves to no command at all (the interactive-session spawner launches it by id), so the cfg split was carrying an older distinction that no longer exists. Also covers the Windows half of `process_name` with a test — the pure name match plus a live scan for this test process, since `find`'s early return would otherwise skip the signal entirely and the test would pass vacuously. Gates: .133 check + clippy --all-targets clean with no warnings, 5/5 procscan (incl. live); .21 299 tests + fmt.	2026-07-26 18:28:13 +02:00
enricobuehler	ee722c2160	docs: what happens when a game ends, and when a session does ... The two behaviors are opt-in-shaped in different directions — one on by default, one off — so the page says which is which, what `always` costs, and that the keep-alive above it is a different clock governing a different thing. The precedence rule (a display kept forever stays up regardless) is spelled out rather than left to be discovered. The dedicated-game-session blurb claimed game-exit-ends-the-session as its own feature; that is now true everywhere, so it moves to where it belongs. Automation gains the `game.running` / `game.exited` rows and a short section on reacting to a game rather than a stream — the two are usually the same moment but not always, and anyone who has been polling the host to find out when a game finished can stop. docs-site: build + tsc clean.	2026-07-26 18:28:13 +02:00
enricobuehler	6a2c127ce9	feat(mgmt/web): show the running game, and who decides when it ends ... The host knows what it launched and, after a disconnect, that it is counting down to closing it. None of that was visible: the console showed a stream with no game, and a game on its way to being closed was something you found out about afterwards. The Dashboard gains a running-game card above the session card — box art matched against the catalog it already fetches, so no new endpoint and no request on the 2 s status poll. "End now" means the two different things the row's state implies: a live game ends by stopping its session (what then happens to the game follows the policy — stopping a session is not licence to close a game), while one already waiting out its reconnect window has no session left to stop and is ended directly. The settings card sits next to the display keep-alive policy because that is the same question one step out: keep-alive decides how long a *display* outlives a disconnect, this decides whether the *game* does. The copy says plainly what `always` costs, that a drop is not someone pressing Stop, and that a display kept forever is unaffected either way — the precedence rule that would otherwise surprise someone. Where a build enforces nothing (macOS, no launch path) the controls are shown disabled rather than hidden: "does nothing here" is information. Also fixes the story fixtures, which had gone stale against the `games[]` field Phase 1 added, and adds a story for the state the card exists for — a game whose client walked away. web: build + tsc clean, biome-formatted; en/de messages complete.	2026-07-26 18:28:13 +02:00
enricobuehler	110eabf281	feat(library/providers): let a provider say how to recognize its games ... A plugin's titles launch through the provider's own client, which hands off and exits — so the host had nothing left to watch, and both lifetime behaviors went quiet for exactly the entries a provider contributes. A `ProviderEntry` (and a manual custom entry) may now carry an optional `detect` hint: install dir, exe, or process name. It is deliberately a subset of what the host tracks internally. A Steam appid or a launcher's environment marker are things the host discovers for itself and would be meaningless — or dangerous — to take on someone's word; where a title is installed is something only the provider knows. The host's own findings win where both exist, so a stale export can never redirect the matcher, and a blank field is treated as absent rather than as "match everything" — an empty install dir would otherwise prefix-match every process on the box, and this feature can end processes. `process_name` is the weakest of the three and the only one typed by hand, so it is matched case-insensitively against the image's file name and nothing else: `retroarch` finds RetroArch, not a helper whose name merely starts the same way, and not a script that happens to live in a `retroarch/` directory. The never-adopt-a-pre-existing-process rule still bounds it. Also: the tray summary gains the running-game row (with the closing-in countdown for a game whose client is gone — visible at the machine without opening the console), the SDK mirrors the `game.*` events, and its generated client catches up with the endpoints Phase 1 added. Gates on .21: check + clippy --all-targets clean, 299 tests, fmt CI-parity, openapi regenerated (GameEntry still carries no `detect` outbound); SDK tsc + 54 tests green.	2026-07-26 18:28:13 +02:00
enricobuehler	98121ccd53	feat(session/gamestream): the compat plane learns a game's lifetime too ... Moonlight sessions had neither direction of the session⇄game binding: a game exiting left the player looking at a desktop, and a session ending never touched the game. The machinery for both landed with the native plane; this wires it up. The compat plane had no way to say "this is over" — RTSP carries no close code — so `/cancel`, the management stop and a game exiting all looked exactly like a client vanishing. They now set a session quit flag, which is what lets the virtual display skip its keep-alive linger for a real stop and what the end-game-on-session-end policy reads to tell a decision from a network blip. A drop still lingers, and still gets its reconnect window. Moonlight can't resume a session, so a client coming back for a game it left behind does it by launching the title again — that reclaims the waiting game before anything starts, rather than letting the old window close on the copy the player is now holding. Both planes now resolve a launch through one lookup (`resolve_launch`), so a GameStream title arrives with the same identity and the same detect signals a native one does; `resolve_session_launch`/`launch_command` were the older, identity-less half of that and are gone. A Moonlight game also has no live-session entry to hang off, so the status surface gains a slot for it — without it the Dashboard would show a stream with no game while one was running. Gates on .21: check + clippy --all-targets clean, 296 tests (293 + 3), fmt CI-parity.	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Fable 5	ed4e3d3ab6	feat(session): end-game/end-session lifetime on Windows ... Phase 2. The lease, the settings, the events and the status surface were already platform-neutral; what Windows lacked was a way to see processes and a way to ask one to close. `procscan` splits per-OS behind one contract. The Windows matcher is a Toolhelp snapshot plus each process's full image path (`QueryFullProcessImageNameW`), with creation times from `GetProcessTimes` enforcing the two rules the module exists for: never adopt a process that predates the launch, never trust a bare pid. Both matter more here than on Linux — the host is SYSTEM, so it can see and signal everything, and Windows recycles pids briskly. Path matching is case-insensitive and separator-aware, and normalizes the `\\?\` prefix `canonicalize` adds, without which a store-derived path would never compare equal to a live image path. There is no reaper argv and no readable environment on Windows, so a spec carrying only a Steam appid or an env marker matches nothing rather than falling through to an empty predicate. Steam's appid instead feeds a **veto**: its per-app `Running` flag in the user's hive can't be trusted to say a game IS running (Steam sets it around updates too, and leaves it stale after a crash), but it is exactly right for refusing to declare one gone. If the matcher can't see a game whose exe sits outside its manifest's install dir, ending the session would be a false positive the player feels immediately; honoring the veto only ever leaves a stream up. Termination asks before it insists, which on Windows needs a detail that fails silently if missed: `EnumWindows` only sees the calling thread's desktop, and the host's is session 0, which holds none of the user's windows. So the terminating thread binds to the input desktop first (the pattern `pf-inject`'s `sendinput.rs` uses), posts `WM_CLOSE` to the game's visible top-level windows, waits, and only then calls `TerminateProcess` on freshly re-verified pids. Without the desktop bind the polite pass finds nothing and every game dies unsaved. Job Objects, planned as WP2.3, are deferred with the reasoning in the design doc: every Windows launch either hands off through a launcher or the shell — where a job would wrap a shim that exits immediately — or is a direct exe whose path we already know, and wiring one in would touch the `CreateProcessAsUserW` token path the UAC and secure-desktop work depends on. Also: the watcher's steady-state poll now re-verifies known pids and only re-scans the whole table once they all vanish (which still catches a game that re-execs). On Windows a full scan is an `OpenProcess` per process on the box, so this is the difference between a negligible and a noticeable poll. Gates: Linux .21 check/clippy/fmt/293 tests green; Windows .133 check + clippy --all-targets clean, and the 4 procscan tests pass — including the live one that finds the test process in the real process table and rejects a wrong creation time. On-glass Windows (Steam/Epic/GOG/Xbox titles, the unsaved-progress check) still owed; it needs a box with games on it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Fable 5	10902f57d0	test(session/gamelease): prove it against real processes, not just fixtures ... The fixture tests establish that the parsing is right; they cannot establish that it describes this kernel. Two tests close that gap. procscan now scans the real /proc for a process it just started, which is the only version that would catch wrong `stat` field ordering, a broken uid check, or a mis-read uptime clock. Writing it found something worth keeping: a wrapper script that `exec`s a binary outside the install dir leaves no trace of that directory in either the image path or the command line, so the install-dir recipe cannot see it. A real game's binary lives under its install dir, so the fixture now models that instead — and the note is in the test for whoever wonders. The gamelease test drives a real child from Running through a host-requested end to Exited, and asserts the session-ending action does NOT fire for it — the difference between "the player quit" (end the session) and "we closed it" (do not). It needs ~12s to outlive the shim window and the exit confirmation, so it is #[ignore]d; run it with `-- --ignored gamelease`. Verified on .21. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Fable 5	a17aa61c5a	fix(session/gamelease): four things the first pass got wrong ... Found reviewing the riskiest paths of the previous commit. - An install dir of `/games/x` matched a process running out of `/games/xyz`. The image-path check was already component-wise and fine; the command-line check compared raw bytes, so it needed the separator. Two library folders where one name prefixes the other is not a contrived case. - Ending a nested game force-releases kept displays, which is not per-display — so with another client streaming it could retire a display that was never ours. Skip it while anyone else has a live session: the failure mode becomes a game that keeps running, which is the default everywhere else anyway. - A lease nothing polls (no detect signals, or a platform without a matcher yet) sat at "launching" forever in the console. Report it as running: the host did just launch it, and with no watcher it is claiming nothing about the exit. - A game ended after its session was already gone reported no `game.exited` at all — its watcher had stopped with the session, so nothing was left to emit it. That is every grace expiry and every `POST /game/end`, i.e. exactly the ones an operator most wants to see. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Fable 5	64c0ff96bc	feat(session): bind a session's life to its game's, in both directions (Linux) ... Two of the most-asked-for behaviors, and until now the host could only manage a sliver of one of them: end the streaming session when the launched game exits, and — when the operator asks — end the game when the session ends. Ending the session on game exit already worked, but only for a Steam title under a bare-spawn gamescope. Everywhere else the host spawned a launch and forgot it: the pid was logged and dropped, so on KWin, Mutter, wlroots or gamescope-attach a finished game left the client staring at a desktop. Ending a game was not possible at all — there was no primitive for it. The missing piece was never plumbing, it was knowledge: a launch says what to run, not what the game looks like once a launcher has handed off. So each store now also reports how to recognize its game (DetectSpec, previous commit's subject matter, folded in here), procscan turns that into live pids on Linux, and gamelease turns pids into a lifetime — with four kinds covering how the game got started: nested gamescope owns it; its display teardown ends the game child the host spawned it, in its own process group matched a launcher owns it; recognized by its store's signals untracked nothing identifies it — both behaviors stay off, and the host says so once rather than guessing A child that exits successfully within 5s was a launcher handing off, not the game: the lease re-resolves to matched (or to untracked) instead of reporting an exit. That single rule is what keeps steam://, epic:// and playnite:// launches from ending a session the moment they start. Ending a game is destructive, so three rules bound it. It is opt-in (game_on_session_end defaults to keep). A drop is not a decision — `always` waits out a reconnect window (5 min) that a returning client cancels by reclaiming its own game, matched on fingerprint and title. And only ever this session's game: a pid is adopted only if it started after the launch, so a copy the player already had open is never touched, and every pid is re-verified against its start time immediately before being signalled, so a recycled pid never is. Termination asks first (SIGTERM to the group, 10s) and only then insists. Also here, because they are the same decision seen from other angles: - A management stop is now a deliberate stop. `DELETE /session` sets quit before stop, so it behaves like a client pressing Stop — the display skips its keep-alive linger instead of lingering for a session nobody is coming back to. - `/status` reports what is running (games[]), including a game whose session has gone and which is waiting out its window, so the console can show it and offer `POST /game/end`. - New game.running / game.exited events, filterable like every other kind, which is the whole polling loop of the community plugin this replaces. - session_status::register takes a named struct: eleven positional arguments, half of them same-typed Arc<Atomic…>, is a transposition waiting to happen. Gates on Linux (.21): check, clippy --all-targets, fmt, and 291 tests green. Windows (Job Objects, Toolhelp matching) and the GameStream plane are phases 2 and 3; both are inert here, as is macOS, which has no launch path at all. Design + plan: punktfunk-planning/design/session-game-lifetime{,-implementation-plan}.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Opus 5	0d9d78398c	fix(drivers/windows): name each virtual pad for what it is — one shared description read as "the setting did nothing" ... `pf_dualsense.inx` gave all four hardware ids a single %DeviceDesc%, so Device Manager labelled an emulated DualShock 4, DualSense Edge and Steam Deck pad "punktfunk Virtual DualSense". The HID layer was always per-type — device_type picks the PID (09CC for DS4), the report descriptor and the product string — but the one place a user goes to check said DualSense for every choice, which reads exactly like the controller-type setting being ignored. Split into four model lines over the same install section, one description each. No binding, service or descriptor change; stampinf's 9.9.MMdd.HHmm DriverVer increments on every build, so pnputil takes the update. InfVerif on the WDK runner: INF is VALID. Also correct the Slot.pref comment from the previous commit: emulating a DualShock 4 gives up adaptive triggers by construction. HidOutput::Trigger is emitted only by dualsense_proto, and a DS4 has no trigger-effect reports — the host never generates any to send. Rumble and the lightbar remain. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 16:56:44 +02:00
enricobuehlerandClaude Opus 5	6edd700910	fix(client/gamepad): honor an explicit controller type — the per-pad arrival was re-declaring the physical pad ... The "Controller type" setting reached the Hello and stopped there. Every pad then opened with a GamepadArrival carrying its DETECTED kind, and the host builds each virtual device from that arrival — the session default is only the fallback for a pad that never declares one. So "emulate my DualSense as a DualShock 4" put a DualSense on the host the instant the controller connected, and no amount of reconnecting helped. Apple and the native clients both; Android already applied the setting per pad. The setting now rides the declaration too: explicit wins for every slot, Automatic keeps per-pad detection so a mixed session stays honest. The physical kind still drives the LOCAL feedback paths — a DualSense emulated as a DualShock 4 keeps its lightbar and adaptive triggers, and a Deck keeps its rumble keep-alive. Regressed in 97c67b26 / 76be4c3e (multi-controller support); ships in 0.19.x. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 16:56:44 +02:00
enricobuehlerandClaude Fable 5	8362d57001	fix(vdisplay/windows): exclusive topology gets re-asserted — a verified isolate is not durable ... The CCD isolate verifies "sole active desktop" at commit time and is never checked again. On a hybrid Intel+NVIDIA box the internal panel is re-activated moments later (the isolated topology is deliberately not saved to the CCD database so teardown can restore the user's layout, and the post-isolate resize/HDR churn — or the panel's own driver, or display-poller software — re-resolves back to the stored layout). Proven on-glass: seconds after the verify, CCD showed the panel ACTIVE beside the virtual display while the host still believed it was exclusive — cursor and windows can land off-stream, and the lock screen can land on the physical panel. A group-scoped watchdog now re-queries every PUNKTFUNK_EXCLUSIVE_REASSERT_MS (default 2 s, 0 disables) while an EXCLUSIVE isolate is live and re-issues the isolate when a non-managed display crept back, logging who-is-fighting escalation (3×WARN → 1×ERROR → DEBUG). Gated on a new GroupState.ccd_exclusive flag so a Primary group's deliberately-lit panels are never "fixed". Cycles take the state lock via try_lock with a sliced sleep, so teardown's stop+join under the state lock cannot deadlock and is bounded by ~250 ms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 16:53:19 +02:00
enricobuehlerandClaude Fable 5	6c2c8b6eab	feat(mgmt/web): surface the host.env encoder pin so a conflicting GPU choice isn't invisible ... listGpus gains encoder_pin (PUNKTFUNK_ENCODER when it actually pins something — unset/auto stay null), and the console's GPU card shows it: a muted note when the pin is compatible, an amber warning naming the pinned vendor and the next session's GPU when it contradicts the selection (the host overrides such a pin at session open — without this field the selection just looked broken). Docs updated to say the adapter wins. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 16:53:19 +02:00
enricobuehlerandClaude Fable 5	751d1de506	fix(encode/windows): a stale PUNKTFUNK_ENCODER pin no longer wedges a conflicting GPU selection ... On a hybrid box, picking a GPU in the web console whose vendor contradicts a host.env PUNKTFUNK_ENCODER pin produced an unrecoverable session: the pin won backend selection while the adapter followed the console, the wrong-vendor encoder failed deterministically at submit, the reset ladder burned its 5 in-place rebuilds on it, and the client reconnected into the identical wall forever (~10 s per cycle, no visible reason). Three legs: - windows_resolved_backend() now reconciles: a hardware pin whose vendor contradicts the selected GPU is overridden by the adapter-derived backend (capture + encode share one adapter, so honoring the pin can only fail); open_video warns loudly when a pin loses. The reconciliation is a pure, unit-tested table (resolve_windows_backend). - the QSV wrong-adapter bind is typed TerminalEncoderError, and the stream loop's reset ladder ends the session immediately on it instead of feeding a deterministic config error 5 futile rebuilds. - the un-pinned path was already correct (verified on-glass: NVIDIA preference + no pin = stable AV1 10-bit HDR on NVENC), so the override simply takes the conflict case onto that path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 16:53:19 +02:00
enricobuehlerandClaude Opus 5	36e566052f	fix(apple/cursor): a pointer whose bitmap has not landed must not vanish ... `resetCursorRects` wore the host shape only when `hostCursors[st.serial]` hit, and fell through to `invisibleCursor` on a miss. But a miss is the ROUTINE case, not a degenerate one, and it is not a reason to hide the pointer: * State (0xD0) is a per-frame datagram and announces the new serial the moment the host QUEUES the bitmap on the reliable control stream, so on every single shape change the client knows a serial before it holds the pixels. * The shape ring drops the NEWEST under burst (CURSOR_SHAPE_QUEUE = 8) and the host never re-sends it — it only sends on a serial CHANGE — so a dropped serial stays un-backed until the pointer next changes shape. Crossing a toolbar flips arrow/I-beam/hand/resize several times a second, and each flip mints a fresh serial and a fresh bitmap, so bursts are ordinary. Either way the pointer BLINKED OUT rather than lagging, and in the dropped case it stayed gone for as long as the pointer held that shape — reported on glass as "the I-beam never appears over text fields, every other cursor is fine". Hold the last worn shape across the gap: only `st.visible == false` (the host says the pointer is hidden) may hide it now, never a missing bitmap. Worst case is a briefly stale pointer. This also makes two comments that already claimed this behaviour true — the shape-rejected warning's "keeping the previous cursor" and CURSOR_SHAPE_QUEUE's healing claim, both of which were fiction. Host side is exonerated: on .221 the poller sees the I-beam handle (0x10005, CURSOR_SHOWING set), and the monochrome AND-over-XOR conversion renders a correct glyph — black beam, white outline — so the bitmap that goes on the wire is good. swift build PunktfunkKit + cargo check punktfunk-core green; on-glass owed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 14:13:08 +02:00
enricobuehlerandClaude Opus 5	6a9b3b0f28	fix(windows/cursor): a re-rendered pointer keeps its handle — re-probe the extent ... The GDI shape poller rasterises only when the HCURSOR VALUE changes. But Windows rebuilds the system cursors at a new size whenever the display scale under the pointer changes, and it does that behind a handle that never moves — the shared arrow is 0x10003 for the whole session. So the cache latched whatever size the pointer happened to have when the poller started and never let go. That window is not rare, it is the norm: a fresh virtual display is created at Windows' RECOMMENDED scale and only picks up the client's saved PerMonitorSettings override a beat later, while the poller starts within a second of the monitor appearing. Sample inside it and the session forwarded — and composited — a 96 px pointer over a 100 % desktop for its entire life, which reads on the client as a pointer 3x too large while every other thing on the streamed desktop is correctly sized. Scaling on the client cannot undo it: the bitmap is proportional to the video, it is just proportional to the WRONG scale. Re-read the bitmap's extent on a slow cadence whenever the handle is unchanged — dimensions only, no pixel copy, 4 Hz — and drop the cache when it moved, so the next tick re-rasterises and publishes a new serial. Observing the extent itself rather than a DPI proxy also covers the accessibility pointer-size slider and any other cause of a same-handle re-render. Windows-side clippy -D warnings green via scripts/wincheck.sh; on-glass owed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 13:22:53 +02:00
enricobuehlerandClaude Opus 5	1421e235f2	fix(host): hdr-p010-selftest silently ignored its size argument ... `args` starts AT the subcommand (main builds it with `env::args().skip(1)`), so a subcommand's own optional arguments begin at index 1 — cf. `args.get(1)` in the `service` arm. This arm read `skip(2)`, swallowing the first optional argument. The documented invocation `hdr-p010-selftest 1920x1080 nvidia` therefore picked up the vendor (it is in the second slot) and ran at the 64x64 DEFAULT. A size-only `hdr-p010-selftest 1920x1080` parsed nothing whatsoever and still printed PASS. Nothing warned, because an unrecognised token is the only thing that errors and no token was ever inspected. The size is the entire point of the flag: the arm's own comment says heights like 1080 are not 16-aligned and exercise a different driver path. So the self-test has only ever validated the one geometry that exercises the least, and the sweep's W7 gate — 1920x1080 and 5120x2880 on the RTX box — could not actually run as written. Found by running that gate: both sizes printed "HDR P010 self-test (64x64 ...)" with byte-identical plane layouts (row_pitch=128, expected_total=12288 — those are 64x64's). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 12:12:20 +02:00
enricobuehlerandClaude Opus 5	28bbaa5250	tools: check and lint Windows-only Rust from a Linux dev box (scripts/wincheck.sh) ... Linux CI never compiles `#[cfg(target_os = "windows")]` code, so a Windows-side edit was unverifiable until the Windows CI job ran or someone tested on a real box. The pf-capture sweep's Phases 3–6 used an ad-hoc version of this harness in a scratch directory; committing it means the next Windows change does not have to rediscover the recipe. The obvious in-tree command fails, and not because of the Windows code: cargo check --target x86_64-pc-windows-msvc -p pf-capture dies in build scripts that compile C for the target — audiopus_sys (cmake wants a VS generator), then ring (needs an MSVC C compiler plus the Windows SDK headers). Both enter through punktfunk-core's `quic` feature. So the script generates a workspace whose members are Cargo.toml copies with `src` SYMLINKED at the real crate directories — nothing to keep in sync, no copies to go stale — plus a ~30-line stub punktfunk-core carrying only `Mode` and `quic::HdrMeta`, which is provably all the Windows capture stack uses. rustls, ring and opus never enter the graph. Every path dep that is not a generated member points at the real crate. Covers pf-frame, pf-win-display and pf-capture with --all-targets, so the Windows `#[cfg(test)]` modules are type-checked too. ~10 s cold, ~1 s warm, into target/wincheck (gitignored). Verified non-vacuous: a deliberate type error planted in a windows-only file (idd_push/stall.rs) is caught and fails the run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 12:07:22 +02:00
enricobuehlerandClaude Opus 5	0d69ebf60b	ci(windows): run pf-capture's tests instead of only type-checking them ... Phase 0 of the sweep added `clippy -p pf-capture --all-targets` to this workflow, which type-checks all 19 Windows `#[test]`s and executes none of them. They were decorative. The workflow's own comment explains why pf-encode's tests cannot run here — nvenc link-imports NvEncodeAPICreateInstance, which resolves only against the driver's import lib. That reasoning does not extend to pf-capture: it has no encoder dependency at all (`cargo tree -p pf-capture` lists no nvidia/ffmpeg/libvpl/pyrowave), so its test binary links against nothing the runner lacks. Confirmed empirically rather than reasoned: `cargo test --release -p pf-capture` was run on a Windows dev box against a workspace checkout — it linked, executed and passed, building in ~51 s off an existing release target dir. --release keeps it in the one C:\t\release tree, so it does not trip the C1069 disk exhaustion a second debug dep tree causes. 18 of the 19 run here (StallWatch + ring-generation masking, the cursor shape→wire truth table, and `f32_to_f16`'s rounding-carry/saturation edges); all are pure — no Win32, no device, no desktop. The 19th, `hdr_p010_selftest_intel_1080_live`, is `#[ignore]`d because it needs a real Intel adapter. This is Windows-only code no other job can execute, so it was the cheapest coverage still on the table. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 12:07:22 +02:00
enricobuehlerandClaude Opus 5	1423b63333	fix(gamestream): the HDR SDR-downgrade latch gated the capture offer but not the negotiation (X6) ... `pf_capture::hdr_capture_failed()` had exactly one consumer: `open_portal_monitor`, which uses it to drop the HDR offer (`want_hdr && !hdr_capture_failed()`). The RTSP negotiation consulted only `gnome_hdr_monitor_active()`. So once the latch was set — an HDR negotiation timed out, the monitor left HDR mode between probe and negotiation, NVIDIA EGL not listing LINEAR for XR30, a pre-50 Mutter — the host kept telling the client HDR while capturing and encoding SDR: `cfg.hdr` flowed to `open_portal_monitor`, which then silently opened the SDR offer. The client renders an SDR stream as PQ. Washed out, wrong gamut, and no error anywhere. The latch is sticky until host restart, so every reconnect repeated it. Consulted at RTSP honor time rather than folded into `host_hdr_capable()` for the same reason as the colour-mode probe next to it: that fn is the STATIC serverinfo capability (it decides whether to advertise SCM_HEVC_MAIN10 at all), and this is a live per-session fact. The native plane needs no equivalent — `capturer_supports_hdr()` is hard-false on Linux, and the latch is a fact about the portal capturer, which that plane never uses. Noted in handshake.rs so it isn't re-derived. Listed in the sweep's confirmed-defect register as cross-cutting/medium, then absent from every phase of its implementation plan. Verification is on-glass (force the latch, reconnect a client that requests HDR, confirm the Welcome/SDP reports SDR). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 12:07:04 +02:00
enricobuehlerandClaude Opus 5	59e33ad11d	Merge origin/main into the pf-capture sweep ... Upstream landed `fc335b39` (negotiate the cursor around what the encoder can blend) on the same files this sweep restructured. Merged rather than rebased: the sweep MOVED ~2,000 lines out of `linux/mod.rs` into `pipewire.rs`/`portal.rs`/`pw_*.rs`, so a rebase would have re-fought the same conflict in up to nine commits; merging resolves it once with both sides in view. The repo already carries merge commits (`land/sweep-all`). Two conflicts, both resolved by keeping BOTH changes: * `linux/mod.rs` — `PortalCapturer::open` gains upstream's `want_metadata_cursor` AND keeps the sweep's `PortalSession` teardown, so the portal threads now take `(setup_tx, quit_rx, want_metadata_cursor)`. The second conflict was upstream editing inside the region Phase 5.1/5.3 moved out; the split wins and upstream's change is ported to where the code now lives: `choose_cursor_mode`'s new `want_metadata` ladder (4 arms — prefer Embedded when the encoder can't blend, and warn-then-take Metadata when Embedded isn't advertised) is now in `portal.rs`, taken verbatim. * `gamestream/stream.rs` — the pooled-capturer slot keeps upstream's third reuse key (`metadata_cursor`, beside HDR-ness) AND the sweep's `result.is_ok() && capturer.is_alive()` re-pool gate. Both guard the same slot against different failures: theirs against reusing a session negotiated for the wrong cursor mode, the sweep's (L2) against reusing a dead one. Everything else auto-merged, including the `want_metadata_cursor` thread through `host/capture.rs`'s facade and `native/stream.rs`'s `session_plan::cursor_blend_for`. Verified after the merge: workspace `cargo test` green, `clippy --workspace --all-targets` clean on Linux AND on x86_64-pc-windows-msvc, `cargo fmt --check --all` clean, pf-capture 38/38. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 11:44:22 +02:00
enricobuehlerandClaude Opus 5	14914bc72f	test(pf-capture): the suite the splits enable — 38 Linux + 19 Windows tests (Phase 6) ... The plan's priority order was "every producer- or OS-controlled parser, blend, geometry guard or negotiation decision", none of which had a test before this sweep (X3). Phase 5's splits are what made most of them reachable without a compositor or a driver. **6.1 `bitmap_extent`** — extracted from `update_cursor_meta`, which is the guard whose own SAFETY proof says a missing bound "SIGSEGVs inside the PipeWire `.process` callback (a segfault `catch_unwind` cannot catch)". Every input except the region size is producer-written. 5 tests: a bitmap that fits (with and without header/pixel offsets); the last-row rule (`stride·(bh−1) + row`, so a bitmap ending flush against the region is accepted rather than rejected by padding that is never read — and one byte short is rejected); anything past the region; degenerate geometry; and four distinct overflow vectors including the near-`i32::MAX` stride the SAFETY comment calls out. One assertion I first wrote was wrong, not the code — with a single row `stride·0 == 0`, so even a `usize::MAX`-wide row is arithmetically in range; the test now exercises the ≥2-row case that really overflows and says why the other is fine (the caller has already capped `bw` at 1024). **6.2 the composite blits** — 8 tests over `composite_cursor` / `composite_cursor_rgb10`: every packed `PixelFormat` arm lands the colour in its OWN channels (so a byte-order slip cannot pass); clipping off all four edges plus six fully-outside positions; zero-alpha, `visible: false` and no-bitmap-yet all drawing nothing; the integer alpha blend; NV12/Yuv444 declined rather than mis-blitted; and for the 10-bit path a bit-exact round trip of an untouched pixel (including the two alpha bits the repack must preserve), the R-at-bit-20 vs R-at-bit-0 distinction between `X2Rgb10` and `X2Bgr10`, and the same clipping. Plus `decode_bitmap_pixel`'s four byte orders. **6.4 the pod builders** — 4 tests. The `dataType` bitmask is pinned per Buffers pod, because each bit is load-bearing in a different direction: the mappable pod MUST include DmaBuf (or gamescope's modifier-bearing format pod wins and the buffer intersection is empty — a link silently stuck in "negotiating"), the SHM-only pod MUST exclude it (or Mutter hands dmabufs and the race-free download path is not), and the dmabuf pod MUST exclude the mappable types (or an HDR session can be handed a MemFd buffer, which Mutter paints 8-bit ARGB32 regardless of the negotiated 10-bit format). Also: every pod parses back through `Pod::from_bytes`; the HDR pods carry MANDATORY PQ + BT.2020 + LINEAR-modifier; and only the NV12 offer pins the colour matrix/range. The `dataType` reader parses the SPA property layout literally (`key, flags, size, type, value`) — a "find the first plausible-looking int" heuristic read the `size` word, which is also 4, and reported the wrong mask. **6.5 `FrameToken` generation masking (W14)** — 2 tests, with `IDD_GENERATION` parked two below the 24-bit boundary so the WRAP is what gets exercised: every minted generation is non-zero, fits the token's field, and survives the pack/unpack round trip `try_consume` performs; and the cleared- `latest` 0 sentinel never matches a live generation. **6.6 the cursor conversion (Windows)** — `convert`'s pixel logic extracted from its GDI plumbing into `mono_planes_to_rgba` / `apply_and_mask_alpha` / `alpha_is_empty`, which is what makes it testable at all (the caller needs a live `HCURSOR` and a screen DC). 6 tests: the four-state AND/XOR truth table in one row; transparency surviving without an invert neighbour; the invert outline covering all eight neighbours, overwriting only TRANSPARENT ones, and clipping at the edges; the alpha-less colour cursor taking alpha from the AND mask; and a short mask not panicking. **6.3 / 6.7** landed with the fixes they guard (`negotiation_plan` in 2.3, `f32_to_f16` in 3.5). 38 Linux tests, up from 6 at the start of the sweep — ci.yml already runs them. 19 `#[test]`s on the Windows side; Phase 0.1's `--all-targets` lint type-checks them all, but note it does not RUN them (the workflow lints only), so the Windows ones execute on a Windows box. clippy --all-targets clean on both targets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 11:31:34 +02:00
enricobuehlerandClaude Opus 5	306f4a514d	refactor(pf-capture): structural splits + collapse the restated signal set (Phase 5) ... Refactors LAST, after every defect fix, so no behaviour change hides in a move diff — and so the newly-exposed review surface was already clean when it landed (the WP7 discipline). 28f8fc71's recorded trap (an inline `use super::X` inside a moved body silently changing meaning) was audited first: every `use super::` in the moved code is either at module level — where `super` still means `linux` — or inside a `mod tests` that moved with its parent. 5.1 `mod pipewire` → `linux/pipewire.rs`. It was 1,900 of that file's lines. `mod.rs` is a directory module, so a plain `mod pipewire;` resolves with no `#[path]`. 5.2 out of that, `linux/pw_pods.rs` (the 7 param-pod builders + `serialize_pod` + the PQ constant and its test) and `linux/pw_cursor.rs` (`CursorState`, `decode_bitmap_pixel`, `update_cursor_meta`, `dst_offsets`, both `composite_cursor*`). The pods are the crate's WIRE surface — a missing property is not a compile error but a link that stalls in `negotiating`; the cursor half is producer-driven and bounds-critical. Both are now pure enough to unit-test without a compositor, which is what Phase 6 needs. 5.3 `linux/portal.rs`: the ScreenCast/RemoteDesktop handshake, the cursor-mode choice and GNOME's BT.2100 probe — the async/tokio/zbus control plane, separated from the realtime half. Zero re-exports changed: `mod.rs` re-exports `gnome_hdr_monitor_active` at its old path. 5.4 `idd_push/open.rs` (the whole one-time construction path + `SharedObjectSa` + `AttachTexFail`) and `idd_push/compose_kick.rs`. Read `open.rs` when a session will not START and the parent when one stops flowing; the steady state stays with the parent by decision. Also moved the ~65-line stall REPORTING block out of `try_consume` (the hot loop) into `StallWatch::report`, taking its two correlation counters with it — they were capturer fields nothing else touched. 5.5 `windows/dxgi/selftest.rs`: `p010_reference`, both self-tests, `hdr_p010_convert_bars_on_luid`, `f32_to_f16` and the two test modules — the validation path, none of which runs in a session. The two `pub` entry points are re-exported, so `main.rs`'s subcommand and pf-encode's live e2e keep their paths. (An explicit `#[path]`, like `idd_push`'s children: this file is itself reached through a `#[path]`, so a bare `mod` would resolve to `windows/selftest.rs`.) 5.6 `CaptureSignals`. The seven shared flags/slots were created in `spawn_pipewire`, `_cb`-cloned one by one, passed as seven of `pipewire_thread`'s parameters, and then re-declared as fields on `PwHandles`, `PortalCapturer` AND `UserData` — the same list written four times, each with its own drifting copy of the doc comment. One `#[derive(Clone)]` struct instead (a refcount bump per field), which also makes it structurally obvious that producer and consumer share ONE set. And `CaptureOpts` for the four trailing `bool`s: four adjacent same-typed positional arguments are a silent-transposition footgun — swap `want_444` and `want_hdr` and it compiles, negotiates the wrong pod family, and surfaces as a black screen ten seconds later. 5.7 trait shape, targeted: `set_active(&self)` → `&mut self` (it took `&self` only because the flag happened to be an `Arc<AtomicBool>` — an implementation detail leaking into the contract); `capture_target_id` ⇒ `resize_output`'s pairing rule stated on both methods and in a cluster note; one-line cluster headers over the 13 methods. NOT done from 5.7: taking the gamescope targets as an `open_*` option instead of the trait method. It would put a Linux-only parameter on the cross-platform `open_virtual_output` and on the host's `capture_virtual_output` facade — a `#[cfg]`-shaped wart in two shared signatures to delete one already-`cfg`'d defaulted method whose lifecycle rule 2.5c had already made harmless. Wrong trade under 5.7's own "no churn for no defect fixed" principle. File sizes: `linux/mod.rs` 2,778 → 770 (target ≤900 ✓), `windows/dxgi.rs` 1,374 → 954, and `windows/idd_push.rs` 2,694 → 1,922. The last two miss the plan's ≤850/≤1,300 targets, which were computed against the ORIGINAL line counts — Phases 1–4 added several hundred lines of SAFETY proofs and defect rationale to exactly these files before the split. The moves themselves are the ones the plan specifies; closing the rest would mean inventing new splits it does not call for. Zero behaviour delta. pf-capture 20/20; workspace clippy --all-targets clean on Linux and on windows-msvc. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 11:25:39 +02:00
enricobuehlerandClaude Opus 5	530909a154	perf(pf-capture): take three per-frame costs off the Windows HDR hot path (Phase 4) ... **4.1 (W10) — the HDR convert allocated two views and mapped a constant buffer per frame, inside the ring slot's keyed-mutex hold.** So the driver's publisher sat blocked on that slot while the host created `CreateRenderTargetView`s and Mapped/Unmapped a 16-byte buffer whose contents never change. Both are lifetime-of-mode facts, not per-frame ones: - the two P010 plane RTVs now belong to the out-ring SLOT, built once in `ensure_out_ring` (`out_ring` becomes `Vec<OutSlot>`). A driver that rejects planar RTVs — the one hard requirement of this path — therefore fails at ring build, where such a failure belongs, instead of on the first frame. - `inv_src` becomes an IMMUTABLE constant buffer filled in `HdrP010Converter::new(device, w, h)`. The converter is already dropped by `recreate_ring` on every mode change, so it cannot go stale. This also deletes the `Map`'s silently-ignored failure: it could leave the chroma pass sampling at a garbage texel size with no error anywhere. **4.2 (W15) — `sdr_white_level_scale` ran inside the keyed-mutex hold too.** It is a CCD query that contends the display-config lock — precisely the contention `DescriptorPoller`'s doc says must stay off the frame path — and `prepare_blend_scratch` called it while holding the slot. Moved to `refresh_sdr_white_scale`, called at open and after each ring recreate (where the scratch is invalidated anyway). "Only on scratch rebuilds" is not the same as harmless when the thing being blocked is the producer. **4.3 (W11) — `VideoProcessorSetStreamAutoProcessingMode(vp, 0, false)`.** The comment claimed "no interpolation/auto-processing" while only setting the frame format; auto-processing's documented default is ENABLED, so vendor denoise/edge-enhancement was free to run inside every SDR `VideoProcessorBlt` — altering the pixels we encode and spending video-engine time on the desktop-capture hot path. Now actually disabled, with each call's purpose stated separately. **4.4 (the Linux CPU-path map cache) is deliberately NOT done.** The plan gates it on measurement ("measure first, and only if the CPU path still matters") and this box cannot measure a live capture session; it also needs a frame-buffer return path through `FramePayload::Cpu`, which is a larger change than the rest of this phase. Left for Phase 7's measured pass. Compile-verified for windows-msvc locally; pf-capture 20/20 on Linux; workspace clippy --all-targets clean on both targets. The GPU-capture check and the measured `cap_us` delta are owed to Phase 7.3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 11:11:46 +02:00
enricobuehlerandClaude Opus 5	bc45287dc6	fix(pf-capture): Windows IDD-push defects — HDR pin, cursor, recreate, handles, f16 (Phase 3) ... Compile-verified for x86_64-pc-windows-msvc locally (a scratch workspace symlinking the real sources against a stub punktfunk-core — the `quic` feature's ring/opus C builds are what blocks an in-tree cross-check). Behaviour is owed the on-glass validation in sweep Phase 7.3. **3.1 (W1/F3) — the HDR pin asserted a flip it never verified.** `poll_display_hdr` discarded `set_advanced_color`'s `bool` and then wrote `now.hdr = self.client_10bit` — the DESIRED state in place of the observed one. On a display that cannot be flipped (the state this file already logs as "Downgrade point D" at open) that broke in both directions: wanting HDR, the fabricated `true` differed from `current`, so two poller samples drove `recreate_ring(true, …)` and rebuilt the ring FP16 while the driver composed 8-bit BGRA — every publish dropped by the driver's format guard, `recovering_since` expiring, `try_consume` bailing: a permanent 3-second reconnect loop. Wanting SDR, the fabricated `false` MATCHED `current`, so no recreate ever fired and the ring stayed BGRA against an FP16 composition — the same dropped-publish outcome, silently. Now it re-reads `advanced_color_enabled` and follows what the display actually composes, with a one-shot error naming want/observed/returned. A not-yet-settled read costs one debounce cycle, never a wrong ring, which is why this does not block the frame path on a settle poll the way `open_on` does. Downgrade point D's error now carries the same pair, so `Some(false)` (display says no) and `None` (the CCD read failed) are distinguishable. **3.2 (W2, W3, W6) — cursor correctness.** - W2: the poller's desktop rect was captured once at open and used forever, for BOTH the desktop→frame offset and the `in_rect` visibility test — while both mid-session mode-change paths (`resize_output`, `poll_display_hdr` → `recreate_ring`) keep the same poller. After an in-place resize the pointer was clipped to the old rect and offset by a stale origin. It is now a SEED: the poll thread re-queries on its existing 250 ms reattach cadence, keeping the last good value on `None` (a transient CCD failure must not park the rect at zero and report every position invisible), which keeps the CCD call off the encode thread as `DescriptorPoller` demands. - W3: `composite_forced` tested `cursor_sender.is_none()`, but §8.6's rationale is "no cursor CHANNEL" — and the delivery just above it is explicitly allowed to fail non-fatally, which is precisely the state needing the rescue. It was the one state that skipped it: a negotiated channel that failed to create or deliver left a cursor-excluded target with NO pointer at all. Now `cursor_shared.is_none()`, evaluated after that binding. - W6: `cursor()` degraded poller→shm correctly, but the BLEND path — the only consumer that matters in the composite model, since the Windows encode loop never attaches `frame.cursor` — read the poller directly with no `alive()` check and no fallback, so the documented fallback and the spawn-failure warning were both untrue for exactly those sessions (a dead poller meant pointer-less frames, not a degraded pointer). One `live_cursor()` now serves all three consumers and LATCHES the source, because the two keep independent serial namespaces and interleaving them poisons the client's shape cache. **3.3 (W4, W5, W14) — recreate hardening.** - W4: `recreate_ring` committed `display_hdr`/`width`/`height` BEFORE the fallible `create_ring_slots` (VRAM pressure at a large new mode — exactly when resizes happen), leaving a failed recreate emitting frames stamped with the new geometry against the old ring, the old generation and an unchanged header. Slots are built first; nothing after the commit point fails. - W5: a recreate never cleared the driver's status words, and `wait_for_attach` — the only classifier of TEX_FAIL/BIND_FAIL and the only source of the LUID rebind — runs at open ONLY. A stale `OPENED` therefore made a failed re-attach look healthy while the recover-or-drop bail reported nothing. Now cleared before the Release generation store (plus `status_logged`), and the 3 s bail prints the live `(driver_status, detail, render_luid)` the way `next_frame`'s 20 s bail already did. The four-field read is one `driver_diag()` helper instead of four copies of the same unsafe block. - W14: `IDD_GENERATION` is a full `u32` but the publish token carries 24 bits and `unpack` masks what it reads, so past 2²⁴ recreates `tok.generation != self.generation` would be permanently true — every frame rejected. Masked at the single mint point, and 0 skipped (it is also the cleared-`latest` sentinel). **3.4 (W8, W9, W12) — handle hygiene.** `shared_object_sa`'s security descriptor is a `LocalAlloc` nobody freed: leaked twice per open and once per ring recreate. It is now an RAII `SharedObjectSa` whose `Drop` `LocalFree`s it and whose `as_ptr()` only lends a borrow — which also makes the "descriptor must outlive the attributes" rule structural instead of a comment. The PyroWave fence's shared NT handle, created per capturer and never closed, becomes an `OwnedHandle` (the encoder holds its own duplicate, so closing ours is safe). `cursor_blend`'s `cbuf_scale` is cached only on a successful `Map` — caching unconditionally wedged the HDR/SDR cursor scale for the session after one transient failure. **3.5 (W7) — `f32_to_f16` swallowed the rounding carry.** `sign | half_exp | (half_mant + round)` ORs a mantissa carry into bit 10, so for every ODD biased exponent (bit 10 already set) the carry vanished and the result came back ~2× low: `1.9998779 → 1.0`, `0.49996948 → 0.25`. Only values one ULP below a power of two are affected — precisely what a gradient test pattern is full of — so this made `hdr-p010-selftest` FAIL a correct shader. Composed additively, with 4 tests (18 asserted bit patterns, a round-trip property over the self-test's scRGB values, saturation) — all verified numerically against a standalone reference on this box, including a scan confirming old-vs-new diverges ONLY on the carry cases. Phase 0.1's `--all-targets` lint is what lets these compile in CI at all. pf-capture 20/20 on Linux; workspace clippy --all-targets clean on Linux and windows-msvc. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 11:06:26 +02:00
enricobuehlerandClaude Opus 5	9a7b3a46d0	fix(pf-capture): gamescope cursor — auth without setenv, frame-space coords, live targets (2.5) ... **2.5a (L4) — stop `set_var`ing `XAUTHORITY` from a live multithreaded host.** The old connect swapped the process-global var around each `RustConnection::connect` under a mutex. That lock serialises this source against itself and nothing else: `getenv` takes no lock, so every OTHER thread's read raced it — and the concurrency is by construction, since `attach_gamescope_cursor` runs while the PipeWire thread is starting up (libspa plugin load, EGL/CUDA init). The primary path now parses the MIT-MAGIC-COOKIE-1 entry out of the given file itself and hands it to `DefaultStream::connect` + `RustConnection::connect_to_stream_with_auth_info` — the same two steps `RustConnection::connect` performs internally, minus its env-derived auth lookup — so nothing in this process touches the environment. The env swap survives only as a fallback for a file we cannot parse, and a wrong cookie pick cannot do damage: the server rejects it and the fallback (which does libxcb's full family/address match) takes over. Sharing `pf_vdisplay`'s process-wide env lock was not the fix — wrong layer, and it would still not fix `getenv`. **2.5b (L6) — publish the pointer in FRAME coordinates.** `QueryPointer` answers in the nested root's space, but `CursorOverlay::x/y`'s contract is frame pixels, and gamescope's `-w/-h` (nested root) and `-W/-H` (output + PipeWire node) are independent knobs — at `-W 1280 -H 720 -w 640 -h 360` they differ by 2×, so the pointer drew at a fraction of its real position. The root size comes free off the setup reply we already parse; the negotiated frame size arrives from the PipeWire thread's `param_changed` through a new `Arc<AtomicU64>` (`0` = not negotiated ⇒ pass through, as before). Scaling is computed in `i64` — a 5K coordinate times a 5K width overflows `i32`. Position only: the bitmap stays at root scale, warned once so a mismatched session is visible. **2.5c (L7) — the targets are a PROVIDER, not a snapshot.** The list was discovered once, before the game launched. gamescope creates the game's Xwayland at launch and advertises only the FIRST in any child's environ (verified on this box: `--xwayland-count 2` makes `:2` and `:3`, only `:2` is advertised), so the game's display was invisible — and when the connected Big Picture display then reported "gamescope is not drawing the pointer here", the source blanked the cursor for the whole game session, which is the exact regression the module doc says it fixed. The worker now re-runs the provider every 2 s: it adopts new Xwaylands, reconnects dead ones, and `spawn` no longer returns `None` on an empty list — a stream that starts before the game converges instead of staying cursorless. The provider is a host-facade closure, same one-way-edge shape as `FrameChannelSender`. **2.5d (L8) — bound the teardown join.** `Drop` joined the worker unbounded while the worker blocks in `RustConnection` replies with NO read timeout, so a peer that stops answering but keeps its socket open hung capturer teardown — on the session path. Now: a completion channel, `recv_timeout(250 ms)`, then detach with a warning (the thread only touches its own X connections and an `Arc`'d slot). 7 new tests, all host-runnable: the cookie reader against a hostile `.Xauthority` (wrong protocol, wrong display, wildcard entry, truncation mid-length-prefix, an over-long length prefix, a missing file), display-string parsing, and the root→frame mapping incl. the 5K overflow. pf-capture 20/20; workspace clippy --all-targets clean on Linux and windows-msvc. Phase 7.2 owes the on-glass nested-gamescope validation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:56:05 +02:00
enricobuehlerandClaude Fable 5	3f4ad08869	test(encode/ffmpeg_win): extract the decision logic and pin it with unit tests ... The QSV open-failure fallback (1,400 lines, 23 unsafe, 0 tests) follows the vaapi.rs treatment: the device-free decisions now live in named functions with their contracts pinned — the per-vendor zero-copy default matrix (AMF on-glass-validated on, QSV opt-in), the PUNKTFUNK_FFWIN_POLL_MS clamp-before-µs-conversion (the 27.7-hour-spin class), the readback routing table with its mid-stream depth-change guard, the swscale source map, the QSV display-remoting latency contract (async_depth=1/low_power=1/ look_ahead=0/forced_idr=1/scenario) and the AMF no-B-frames contract, and the per-vendor zero-copy pool bind flags. A probe smoke rides along #[ignore]d for the runner. No FFI plumbing chased; no behavior changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 10:50:33 +02:00
enricobuehlerandClaude Fable 5	fc335b39e9	fix(host/encode): negotiate the cursor around what the encoder can blend ... EncoderCaps::blends_cursor's contract said the HOST must fall back to capturer-side compositing when a cursor-as-metadata session lands on an encoder that can't composite — but that host half was never built: open_video warned and the session streamed WITHOUT a pointer (confirmed on the VAAPI dmabuf and libav-NVENC CUDA paths; latent on vulkan RGB-direct/native-NV12). The negotiation is now caps-aware, ahead of capture, on both planes: * pf-encode grows cursor_blend_capable() — the pre-open dispatch mirror (sibling of linux_native_nv12_ok) answering whether the resolved backend composites frame.cursor; its pure core is test-pinned arm by arm. * Native plane: handshake::cursor_forward grants the cursor channel only where the resolved backend can blend (the capture-mouse flip makes the host draw the pointer on demand); denied sessions keep the pre-channel path — the compositor EMBEDS the pointer, never cursorless, never doubled. The Welcome's HOST_CAP_CURSOR bit is computed once and read back at both session-wiring sites instead of recomputed. SessionPlan::output_format additionally keeps every cursor-blend session off producer-native NV12 (the arm with no CSC to fold a cursor into), and vulkan RGB-direct now yields to a cursor-blend session even when pinned (EFC cannot composite; the open logs the override). Windows plans cursor_blend=false via the new shared cursor_blend_for() rule — the IDD capturer composites the pointer itself, and asking the encoder anyway fired the blends-cursor warn spuriously on every cursor-channel session. * GameStream plane: the hardcoded cursor_blend=true is gone. The portal source asks for cursor-as-metadata only when the resolved backend blends, otherwise negotiates an Embedded pointer (choose_cursor_mode's new ladder); the capturer pool now also keys on that mode. The virtual-output source passes false — its capture embeds the pointer where it can. The per-arm warns in vulkan_video (RGB-direct, native-NV12) are now structurally unreachable and removed. open_video's post-open check stays as the single backstop for what planning cannot see: a Vulkan-open falling back to VAAPI mid-session, and the gamescope residual (no embedded mode exists there, so a never-blending backend — H.264-on-AMD VAAPI, software — still streams cursorless; fixing that needs a compositing stage, deliberately not built in this pass). Zero-copy is preserved throughout — every fallback is a capture-negotiation change, never a readback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 10:50:33 +02:00
enricobuehlerandClaude Opus 5	759fdf767c	fix(pf-capture): buffer-geometry guards + a genuine drop-oldest hand-off (sweep 2.4, 2.6) ... **2.4 — buffer geometry correctness on the Linux CPU path.** L5: the self-mmap de-pad mapped the fd from offset 0 and then indexed by `chunk.offset()` ALONE, ignoring `spa_data.mapoffset` — where that spa_data's region actually begins inside the fd. For a pooled-memfd producer (every buffer a slice of one fd) it therefore read the WRONG buffer, and the `needed > avail` guard could not catch it: `avail` came from the whole-fd mapping, so it was ample for any single buffer's span. PipeWire's own MAP_BUFFERS slice (the fallback) was always correct because it already starts at `mapoffset` — only the hand-rolled "fix" path was wrong, so the two paths now compute their base separately (checked add; both halves are producer-controlled). L15: when `fstat` failed, the mmap length was invented as `offset + needed` — producer-controlled geometry. That defeats the entire point of the fstat (the "buffer smaller than the frame span" guard then compares against the number the producer just supplied) and can map, and read, past the end of the object — a SIGBUS, not an `Err`. Without a real length we now decline to self-map and let PipeWire's own slice serve, which is bounded by construction. L12: `bytes_per_pixel()`'s catch-all answers 4 for NV12, so a producer-native NV12 buffer computed `row = 4w` against a stride of ~w and ALWAYS tripped the stride guard — reporting "chunk stride < row", i.e. blaming the producer for a host limitation. NV12 cannot be de-padded on this path at all (plane 1 is not even in `datas[0]`'s span), so reject it with a message that says which side is at fault and under what condition the NV12 offer is valid. L14: `spa_meta_bitmap` was read field-by-field through an aligned `*const` at a PRODUCER-controlled offset, with a SAFETY comment asserting an alignment the code never established. One `read_unaligned` of the `Copy` POD instead. **2.6 — hand-off semantics (L9, L10).** The frame channel was `sync_channel(8)` + `try_send`, i.e. drop-NEWEST, while the trait documented drop-oldest. Neither remedy the plan offered works: a `SyncSender` cannot pop, so "drain one and retry" is not expressible, and shrinking the bound makes staleness WORSE, not better (with bound N the queue holds the first N frames of a stall and everything after is discarded, so a larger N actually yields a fresher frame — the defect is the discarding, not the depth). Replaced with a one-deep OVERWRITING mailbox plus a depth-1 wakeup channel: publishing overwrites, so a stalled consumer loses the intermediate frames and is always handed the freshest one. `next_frame` used to return the OLDEST of eight stale frames. Falls out of it: - `wait_arrival` now honours its documented "must NOT consume" contract by peeking the slot. The `pending` field existed only to stash a frame the un-peekable channel forced it to consume; it is gone. - a queued `CapturedFrame` can own a dup'd dmabuf fd or a CUDA buffer, so the old 8-deep backlog could pin eight compositor buffers. One-deep by construction now. - L10: `set_active(false)` flushes the mailbox, so a reused capturer no longer opens the next stream with the previous session's last frame (wrong content, and a `pts_ns` from the old clock). Two lines, where flushing a queue + a `pending` stash was fiddlier. - the producer-liveness signal moves to the wakeup channel's `Disconnected`, and a final frame left in the slot as the thread exits is still served before the error. pf-capture 13/13; workspace clippy --all-targets clean on Linux and windows-msvc. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:48:18 +02:00
enricobuehlerandClaude Fable 5	f495b201e1	fix(encode): delete the write-only EncoderCaps::supports_hdr_metadata ... A caps field nothing reads is a contract nobody honors — and this one shipped write-only: its single reader anywhere in the workspace was a hardware-gated assertion inside pf-encode's own AMF smoke test. Both planes send the static HDR grade out-of-band unconditionally (the native 0xCE datagram per keyframe, the GameStream 0x010e control message), every first-party client reads exclusively that path, and none parse in-band SEI — so the host decision the field was reserved for (suppress out-of-band when the encoder embeds) can never validly exist. The field's doc contract had also rotted in two directions: it claimed set_hdr_meta no-ops when false (native AMF and QSV consume it regardless) and that only Windows direct-NVENC attaches in-band metadata (AMF and QSV do too). The in-band SEI/OBU emission itself is untouched — it stays a bonus for stock decoders, documented at the emit sites; the trait docs now describe the real routing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 10:48:07 +02:00
enricobuehlerandClaude Opus 5	17eb8100a3	fix(pf-capture): portal teardown, observable death, one negotiation resolver (sweep 2.1–2.3) ... **2.1 (L1) — the portal thread leaked a live screencast session.** It parked on `future::pending()` and `Drop` stopped only the PipeWire thread, so every dropped portal capturer permanently leaked a thread + a 2-worker tokio runtime + a zbus connection — and because dropping that connection is what ends the compositor's cast (ashpd's `Session` has no `Drop`), the COMPOSITOR-side session leaked too. GameStream drops the pooled capturer on every HDR↔SDR reconnect flip and opens a fresh one, so the sessions accumulated: exactly the "second conflicting screencast" the pooling exists to prevent. Both portal threads now park on a `oneshot::Receiver` and `PortalSession::drop` fires it, then waits — BOUNDED (750 ms, then detach with a warning) — for a completion signal the thread sends after its runtime has been dropped. Bounded because teardown runs on the session path and the thread may be inside a D-Bus round-trip: an unbounded `join()` there would hang the host rather than leak. Every early-return path in `open` drops the session too, so a failed PipeWire spawn no longer strands a fresh cast. **2.2 (L2) — a dead capturer was pooled forever.** All three of the portal backend's terminal states are sticky and observable only by consuming a frame, and `Capturer` exposed no health predicate, so GameStream re-pooled unconditionally — after `result` was already an `Err`. One zerocopy-worker death or one compositor restart therefore wedged GameStream portal video at 10 s per reconnect attempt, permanently (that path has no rebuild closure). Adds `Capturer::is_alive()` (default `true`), implemented for `PortalCapturer` as `!broken && streaming && !thread.is_finished()` — the third term catches a dead PipeWire thread, which is otherwise indistinguishable from an idle desktop. A static desktop stays `Streaming`, so an idle-but-healthy capture is never reported dead. The host re-pools only on `result.is_ok() && capturer.is_alive()` and logs which of the two retired it. Both halves ship together: either alone leaves the wedge reachable. **2.3 (L3/F1) — a "VAAPI" downgrade latch was really a global zero-copy kill switch.** `spawn_pipewire` hand-mirrored the thread's `vaapi_passthrough` decision and the copy omitted `raw_dmabuf_import_disabled`, so once that latch fired the capturer still believed it had made the passthrough offer while the thread had already fallen back — and its timeout branch then latched a downgrade for an offer nobody made. That downgrade was `note_vaapi_dmabuf_failed`, which fed `pf_zerocopy::enabled()`, so ONE failed negotiation dropped every later session on the host — the NVENC EGL→CUDA path included — to CPU capture until restart. And since the raw-passthrough offer is also the PyroWave one on ANY vendor, a single PyroWave negotiation timeout was enough to do it on an NVIDIA box. Two fixes, both structural: - `negotiation_plan(NegotiationInputs) -> NegotiationPlan` is now the ONE resolver, consumed by the thread AND by `spawn_pipewire` — the mirror is deleted, not re-synced (WP7.6's shape), so the drift class is unrepresentable. It is pure (every env/latch read is an input), which is what makes it testable; the runtime-dependent half stays a method (`want_dmabuf` needs the modifier list the importer's construction actually yielded). The redundant `importer.is_none()` term goes: `build_importer` already excludes the passthrough, and that term is what made the decision look impure enough to "need" a mirror. `PUNKTFUNK_FORCE_SHM` was ALSO read in both places; now once. - the capture-side downgrade becomes `pf_zerocopy::note_raw_dmabuf_negotiation_failed`, which latches `RAW_DMABUF_DISABLED` — gating only the raw-passthrough decision. `enabled()` is now the env var alone, and `VAAPI_DMABUF_FAILED` is deleted. Also (L13, needed by 2.3's plan inputs): `PUNKTFUNK_PIPEWIRE_NV12` honoured only the exact string `"0"`, so `"0 "` or `"false"` read as force-ON — the bug class of ed525c4c. pf-host-config's explicit-off grammar is now exported as `env_on()` and the four in-crate copies (`PUNKTFUNK_ ZEROCOPY`/`_10BIT`/`_444`/`_CHACHA20`) plus this new caller share it. 7 new tests pin the four invariants that were prose-only comments, plus the latch property that made the mirror wrong. pf-capture 13/13; workspace clippy --all-targets clean on Linux and on x86_64-pc-windows-msvc. On-glass validation of 2.1/2.2/2.3 is owed (sweep Phase 7.1). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:41:53 +02:00
enricobuehlerandClaude Fable 5	232b6d6be2	test(encode/vaapi): extract the open-time decision logic and pin it with unit tests ... The fallback backend under Vulkan Video — and the only AMD/Intel H.264 and 10-bit/HDR encoder — had 1,300 lines, 26 unsafe blocks, and zero tests. The device-free decisions now live in named functions with their contracts pinned: the entrypoint ladder + LP_MODE latch round-trip (the cross-GPU session-killer and the 8-bit-pins-10-bit under-advertisement are both key'd tests now), the PUNKTFUNK_VAAPI_LOW_POWER / _ASYNC_DEPTH grammars, the VUI ↔ scale_vaapi colour agreement (the Mesa-BT.601 hue-shift pin), the honest-downgrade depth table, the HEVC-Main10-only explicit profile, and the 10-bit probe gate. Probe + CPU-path encode round-trip ride along as #[ignore]d hardware smokes in the house style. No FFI plumbing was chased; no behavior changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 10:29:31 +02:00
enricobuehlerandClaude Opus 5	54a37aeb46	docs(pf-capture): truth pass over comments, docs and log strings (sweep Phase 1) ... Every item here is prose that actively misdirects a maintainer or an operator. Landing it before the defect fixes means those diffs get reviewed against accurate comments. 1.1 (X5) — split two merged doc blocks that documented the item ABOVE them: `hdr_meta`'s whole contract was glued onto `fn cursor()` in lib.rs (leaving `hdr_meta` undocumented), and `hdr_p010_selftest_at`'s was glued onto `hdr_p010_convert_bars_on_luid` in dxgi.rs. rustdoc for the trait's central HDR contract was simply wrong. 1.2 (L9 doc half) — the `Capturer` trait doc advertised a "bounded drop-oldest channel". The Linux portal's `sync_channel(8)` + `try_send` is drop-NEWEST: under a consumer stall the arriving frame is discarded and the encoder gets the stalest queued one. Say so. (Phase 2.6 changes the behaviour; this commit only stops the doc from lying about today's code.) 1.3 — delete the DONT_FIXATE claim from the dmabuf offer comment. `build_dmabuf_format` emits a plain MANDATORY `ChoiceEnum::Enum` and `param_changed` re-emits nothing, so there is no two-step DMA-BUF handshake here; libspa 0.9's `ChoiceFlags` cannot even express DONT_FIXATE. Recorded as a real follow-up instead of an implemented thing. 1.4 — `mainloop.run()` no longer "blocks until process exit": the quit channel attached above it stops the loop from `PortalCapturer::drop`. 1.5 (L11) — the 6-arm negotiation log ladder told a fully zero-copy PyroWave session "VAAPI encode with the CPU capture path — zero-copy was disabled", one line after logging that it had advertised the PyroWave device's dmabuf modifiers: the passthrough arm was gated on `pyrowave_modifiers.is_empty()`, so the pyrowave case fell through to the CPU warning. Ungate it; the CPU-path arm is now reachable only when no dmabuf is advertised at all, which is what it claims. Its parenthetical also gains the third real cause (the session asked for CPU frames). Control-flow-neutral for every other combination. 1.6 (W13) — `kick_dwm_compose` claimed a "sub-millisecond" round trip while its cursor-on-a-sibling-display branch sleeps 35 ms on the CALLER's thread. State the cost on the function and at both call sites, including which one is on the live frame path. 1.7 (W16) — DDA-era residue, DDA having been removed: - retarget the win32u hook's rationale + all four log strings: its job is no longer "keep DDA on one adapter" but "keep the virtual display on the adapter SET_RENDER_ADAPTER pinned" (a DXGI reparent surfaces as the driver's TEX_FAIL render-adapter mismatch). The hook stays installed. - the per-monitor-v2 DPI awareness rationale likewise: not DuplicateOutput1's E_ACCESSDENIED any more, but keeping cursor/window coordinates in the PHYSICAL pixels the host's CCD geometry (`source_desktop_rect`, `desktop_bounds`) is already in. - `HYBRID_HOOK_HITS` was write-only. Surface it as `hybrid_hook_hits()` on the IDD-push open line, which is the first point where DXGI has actually been exercised — the patch-readback check proves the bytes landed, only this proves DXGI reaches the export. - delete `hdr_p010_selftest()`: an unreachable 64×64 wrapper (main.rs calls `hdr_p010_selftest_at`); its description moves onto the function that survives. - `VideoConverter`'s docs promised a P010/BT.2020 output and a live scRGB input path. It pins `YCBCR_STUDIO_G22_LEFT_P709` unconditionally and its only caller always passes `scrgb_input: false`. 1.8 (X7) — the native handshake's 4:4:4 gate comment stated the OPPOSITE of what `pf_capture::capturer_supports_444` returns on Windows ("delivers subsampled NV12/P010 today, so it returns false there" — it forwards `resolved_backend_ingests_rgb_444()` and the IDD ring passes BGRA through for an SDR 4:4:4 session). No `.rs` behaviour delta: comments, doc comments and log strings, plus 1.5's control-flow-neutral ladder and 1.7's counter accessor. Linux tests 6/6; clippy --all-targets clean on both targets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:27:06 +02:00
enricobuehlerandClaude Opus 5	cc848479c4	test(pf-encode): re-point the cpu_img size-change smoke at the CSC guard's contract ... vulkan_cpu_img_survives_a_source_size_change drove MISMATCHED source sizes through the then-lenient CSC arm as its vehicle for the staging cache hazard (format-only-keyed cpu_img → OOB copy while submit said Ok). e3354b6d's guard — correctly the equality check every sibling arm always had, against the MODE, not the coded extent, so the padded render-vs-coded tolerance in the direct arms is untouched — makes that scenario unrepresentable through submit and broke the test on main (.25 layers baseline read 13/13 instead of 14/12). Replaced by vulkan_csc_refuses_a_mismatched_source: refusal pinned in BOTH directions, plus the property that actually needs proving — a refused submit does not WEDGE the session (the bail lands after step 1's frame-type bookkeeping; the next well-sized frame must still encode, and an AU must come out). Verified on the 780M under validation layers: 8/8 vulkan tests, full-suite baseline restored to 14/12. The WP4.2 size-keyed staging stays as belt-and-braces; the hazard it fixed is now structurally unreachable through submit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:20:37 +02:00
enricobuehlerandClaude Opus 5	6a2a153c0b	chore(pf-capture): make the crate verifiable — Windows CI lint + two denies (sweep Phase 0) ... Gate for the rest of design/pf-capture-sweep.md: today half this crate is compiled by no CI job at all, so the Windows-side findings can't even be type-checked. 0.1 (X1) — windows-host.yml lints `-p pf-capture --all-targets`. The host lint above it builds pf-capture only as a DEPENDENCY, so its `#[cfg(test)]` modules were never compiled anywhere: the 5 StallWatch tests, the DXGI HDR self-tests and the cursor-conversion tables were dead code in CI. The workflow's own comment already diagnosed this blind spot and fixed it for pf-encode; pf-capture never got the same treatment. No features on this crate, so no feature juggling and no extra dep tree. 0.2 (X2) — `#![deny(unsafe_op_in_unsafe_fn)]` beside the existing `deny(clippy::undocumented_unsafe_blocks)`. The crate declares "every unsafe block carries a SAFETY proof; enforce it" in ten file headers, but in edition 2021 that lint has nothing to fire on inside an `unsafe fn` — so the hardest FFI in the crate was exempt from its own program: the ring/slot construction, the fence signal, the blend scratch, and every D3D converter ctor/convert. 119 operations across 16 functions now carry a proof. `shared_object_sa` loses its `unsafe` marker instead (it states no precondition — only its RESULT is a raw pointer, which is the caller's business). 0.3 (X4) — drop the crate-wide `#![allow(dead_code)]`. Verified: zero warnings on either target without it, so it was hiding nothing the lint can see (W16's dead items are `pub`/written-once, so they need Phase 1.7's deletion instead). No behaviour change: only lint attributes, `unsafe { }` scoping and comments. Linux `cargo test -p pf-capture` 6/6, clippy --all-targets clean on both targets (Windows verified by cross-checking x86_64-pc-windows-msvc locally). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:18:48 +02:00
enricobuehlerandClaude Opus 5	bf9386ecb2	test(pf-encode): pin the typed-EINVAL classifier's chain-survival contract (Phase 8) ... Rides on 25765c53 (the concurrent session landed the same typed-errno fix first — this branch's twin commit was dropped in the rebase; these are its surviving residuals): - Two tests pinning what the ladder's step-down rests on: the typed ffmpeg::Error survives with_context layers as a downcastable source (an eager format! anywhere between open_with and the ladder would silently break it), and the phrase WITHOUT the type no longer classifies. - The CudaHw::new eager-format guard note: those bail!s must NOT be converted to typed errors — a hwdevice/hwframes EINVAL is a config error no bitrate can fix, and enrolling it would burn ~10 doomed opens before surfacing the real failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:13:49 +02:00
enricobuehlerandClaude Opus 5	bf9fb3fb22	fix(pf-encode): enable VK_EXT_queue_family_foreign for the dmabuf acquires (Phase 8) ... Both Linux Vulkan encode backends named QUEUE_FAMILY_FOREIGN_EXT as the acquire barriers' src family without ever enabling the extension — spec-invalid on every device, tolerated by RADV. The audit filed vulkan_video's three sites; pyrowave's fresh-import acquire had the identical defect on its own device (critic catch). Enable when advertised (a fresh open-time enumerate — the rgb probe's is a probe-local and skipped entirely on native-NV12, so there was nothing to reuse; pf-presenter/dmabuf.rs is the in-repo precedent that already enables this extension). Not advertised → the core-1.1 QUEUE_FAMILY_EXTERNAL conservative substitute, chosen once at open and warn-logged (no fleet hardware takes that arm; such devices were never valid targets before). All four sites are acquire-only (src=FOREIGN, EXCLUSIVE images, oldLayout=UNDEFINED) — the swap is index-only. On-glass: 780M under validation layers — vulkan smokes + pyrowave smokes green, FOREIGN advertised and enabled, no fallback engaged. Shared ext_advertised helper in vk_util (cfg = the union of both consumers) with a unit test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:08:44 +02:00
enricobuehlerandClaude Opus 5	1cefd37603	fix(pf-encode): arbitrate NVENC split-encode vs sub-frame readback (Phase 8) ... Verified against nvEncodeAPI.h's own splitEncodeMode doc (user-prompted — the audit's 'exclusive for HEVC' one-liner deserved checking): - H.264: split 'is not applicable' — hard-DISABLE the mode so the written config, CeilingKey, the split diagnostic log and the rejection-retry stay truthful (the retry used to re-open a byte-identical session after an H.264 'split rejection'). The libav path's operator arm gains the codec gate its auto arm always had. - HEVC: split 'not supported if … subframe mode' — when WE force split (TWO/THREE/AUTO_FORCED, the 4K120 throughput lever), sub-frame yields with a logged escape (PUNKTFUNK_SPLIT_ENCODE=0 chooses sub-frame). ⚠ Keyed on FORCED modes only, never != DISABLE: AUTO(0) is the resolver's fallthrough for every sub-950Mpix session, and the wider key would have disarmed the Phase-3 chunked-poll feature fleet-wide (critic catch). Under AUTO the driver arbitrates — the shipped state. - AV1: untouched — per-tile sub-frame + split are legal together. The arbitration is a pure nvenc_core fn called by each backend BEFORE the ladder, the ceiling key and the chunked-poll latch — all three see the post-arbitration truth. A drop inside build_init_params would have left poll_chunk busy-polling its whole budget every AU (numSlices stays 0 without reportSliceOffsets; both loop exits dead — critic catch). Linux latches subframe_forced beside subframe_on at query_caps (no env re-reads after open); Windows records the arbitrated state so reconfigure presents exactly the params the open had (also closes the pre-existing mid-session env-flip hazard there). Truth-table tests in nvenc_core; PUNKTFUNK_NVENC_SUBFRAME documented (it never was); PUNKTFUNK_SPLIT_ENCODE row updated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 10:08:44 +02:00
enricobuehlerandClaude Fable 5	25765c53ec	fix(encode): classify libav-NVENC open failures by errno, not English strerror text ... The bitrate-probe ladder stepped down on format!("{e:#}").contains( "Invalid argument") — an English substring over the WHOLE context chain, which also fired on any other wrapped EINVAL (e.g. a CUDA-context errno) and gated a ~10-step ladder on strerror wording. The root ffmpeg::Error survives the anyhow chain; downcast and match Error::Other{errno:EINVAL} instead. Same fix for the intra-refresh ENOSYS probe in the open path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 01:05:24 +02:00
enricobuehlerandClaude Fable 5	36589c39da	fix(gamestream): stall-recovery ladder — a wedged encoder no longer ends the stream ... The backends deliberately turn a wedged GPU into a bounded error so the caller can reset in place, but only the native plane ever did: on the GameStream path every submit/poll error propagated straight out of the video loop, costing Moonlight clients a full disconnect/reconnect. Port the native ladder (bounded resets + backoff + silent-wedge watchdog, same field-lesson backoff curve). Also keep the drop-recovery keyframe armed until it actually EMITS: it was consumed on read, so the coalesce gate could swallow it for good — leaving duplicate wire indices in the encoder's reference table for a later RFI to anchor on, exactly the stale-anchor case rfi.rs exists to prevent, and it opened only under congestion + loss, which is when RFI fires. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 01:05:23 +02:00
enricobuehlerandClaude Fable 5	e3354b6d5d	fix(encode/vulkan): guard the CSC source dimensions, and bound reset()'s wait ... The CSC path was the only backend arm that took frame.width/height on trust: the shader samples with clamped 1:1 texelFetch, so a mismatched frame silently streamed a cropped/edge-padded picture where every sibling errors into the encoder-rebuild path. The import cache now also carries the extent it imported at (a (st_dev, st_ino) hit alone doesn't prove the allocation still matches) and is dropped on reset(). reset() opened with an untimed device_wait_idle on the one thread whose every other wait is capped at ENCODE_FENCE_TIMEOUT_NS for exactly this reason — reset() runs BECAUSE the GPU looks wedged. Both vulkan-video and pyrowave now bound the wait and report "no in-place rebuild" on timeout instead of parking recovery on the suspect device; Drop keeps the unbounded wait (teardown must stay memory-safe against a wedged device). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 01:05:10 +02:00