999 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	f97b5a3783	fix(rpm): drop the moved design/implementation-plan.md from %doc ... The RPM %files %doc referenced design/implementation-plan.md, but the design/ docs live in the separate planning repo now — the file isn't in the public tree, so rpmbuild failed at %files ("File not found: .../implementation-plan.md") once the build got that far. Ship the two docs that actually exist (README.md + packaging/README.md). Pre-existing spec rot, surfaced by the 0.8.3 release run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.8.3	2026-07-08 00:44:28 +02:00
enricobuehler	0052a6ae30	fix(packaging): vulkan-headers build dep + ship punktfunk-session across desktop packages ... The re-architecture split the Linux client into two binaries (shell + Vulkan session streamer) and added the pf-ffvk crate, whose build.rs runs bindgen over FFmpeg's libavutil/hwcontext_vulkan.h (#include <vulkan/vulkan.h>). Two release regressions fell out of that on the desktop-package legs: 1. Missing build dep. The Arch build (archlinux:base-devel + its own pacman list) fatal-errored at `vulkan/vulkan.h file not found`. Add the Vulkan dev headers wherever the client compiles from a self-managed dep set: arch (PKGBUILD makedepends + arch.yml), rpm (spec BuildRequires + rpm.yml + fedora image), deb.yml (belt-and-suspenders; the rust-ci image already bakes libvulkan-dev), and the screenshots job. The flatpak builds offline against the GNOME SDK, so install Vulkan-Headers into /app as a pinned module and point pf-ffvk's bindgen at it via PF_FFVK_VULKAN_INCLUDE. 2. Only the shell shipped. arch/deb/rpm built and installed just punktfunk-client; the shell execs its sibling punktfunk-session for a connect, so desktop streaming would break exactly as Decky's did. Build and install BOTH binaries in all three, and declare the runtime Vulkan loader the session binary dlopens (vulkan-icd-loader / vulkan-loader / libvulkan1 — not a DT_NEEDED, so shlibdeps/auto-requires can't see it). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:41:10 +02:00
enricobuehler	062a54e3a5	style: cargo fmt --all (rustfmt 1.96.0 drift across the re-arch branch) ... `cargo fmt --all --check` (ci.yml) was red on main: the client re-architecture commits and origin's windows-shortcut commit landed with rustfmt violations (e.g. a 104-char .with_context line in hyprland.rs, an unsorted mod block in vdisplay.rs, the input.rs `{`-placement CI flagged). Reformat the tree so the fmt gate passes; no functional changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:33:40 +02:00
enricobuehler	966758e757	chore(release): bump workspace version to 0.8.3 ... Release 0.8.3: the native Linux client is re-architected — the GTK4 shell + GL presenter give way to a two-binary design (phases 0–6). A relm4/libadwaita desktop shell (host discovery, pairing, library) now hands desktop connects to a dedicated Vulkan session binary, punktfunk-session: an SDL3 window + ash presenter carrying a Skia "console" UI — stats OSD, capture HUD, and a gamepad-navigable coverflow library with --browse. The split lands the streaming wins the GL path couldn't: VAAPI dmabuf → Vulkan zero-copy import + CSC (no GL round-trip), Vulkan Video decode on the presenter's own device for NVIDIA hardware decode (via a new pf-ffvk bindgen shim over FFmpeg's Vulkan hwcontext), and HDR10/P010 end to end. The console background is now an animated mesh gradient matching the Apple client's MeshGradient. Along the way: a resize crash fixed (never vkDeviceWaitIdle while the pump decodes), keyframe recovery when the decoder produces no output, decode-stage stats that measure GPU completion, an Alt+Enter fullscreen alias, pointer-lock + per-iteration motion-flush input fixes, and the host-card hover highlight made concentric. Packaging + Decky: the flatpak now builds and ships BOTH client binaries (shell + session) so the Deck's stream/browse paths survive the split — the session binary's Skia is fetched offline from a pinned, sha256-verified archive; the mgmt/library port 47990 is opened on the LAN firewall profiles; and the plugin's install-from-URL uses the unom.io/pf-decky short link. Other clients + core: Windows gains the two missing stream shortcuts (Ctrl+Alt+Shift+S stats, F11 fullscreen) plus an in-stream shortcut reference on both clients; Android promotes the low-latency pipeline to default and attaches its APK to CI; the host coalesces keyframe-request storms into one IDR per cooldown; the core jumps to live on a standing receive backlog instead of ratcheting latency; and two security bumps clear the audits (crossbeam-epoch RUSTSEC-2026-0204, vulnerable web transitive deps). The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; refresh the 14 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag as minor+1 of the latest stable (scripts/ci/pf-version.sh), so with 0.8.3 the newest stable it stays at 0.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:18:12 +02:00
enricobuehler	07afa8ee26	feat(console-ui): mesh-gradient background (Apple MeshGradient parity) ... The console UI's animated background was a port of the Apple client's LEGACY fallback — four drifting radial blobs. Apple's shipping look is a 4×4 MeshGradient. Replace the blob field with an SkSL shader that reproduces it: a smooth bicubic (separable cubic-Bézier) blend of the same 16 sRGB mesh colours, the four interior control points driving a bounded (weight-normalised) domain warp so the bright brand-violet pools drift while the frame edges stay pinned — then the same ±8°/~5-min hue sway, elliptical vignette, and vertical legibility scrim as the Swift composite(). Same [u_res, u_t] uniforms, so the draw path is untouched beyond the rename (draw_aurora → draw_background, aurora → mesh). Verified: the SkSL compiles on Skia's CPU frontend (unit test), and CPU-raster renders at several time points show the dark-cornered field, the centred bright pool, warm-left/cool-right temperature split, and the slow interior drift. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	b2451e6aea	fix(flatpak): ship punktfunk-session so Decky streaming survives the two-binary split ... The re-architected Linux client is now two binaries: the punktfunk-client shell execs its sibling punktfunk-session (ash/Vulkan presenter + Skia console UI) for --connect/--browse. The Decky plugin's stream and browse paths launch the shell with exactly those flags, but the flatpak built and installed only the shell, so streaming and the gamepad library from the Deck failed at exec with "punktfunk-session: No such file" (pair/wake/library still worked — the shell handles them in-process). Build and install both binaries. The session binary pulls in Skia (skia-safe), whose build script downloads a prebuilt libskia — dead in the offline sandbox — so point skia-bindings at a pinned, vendored archive via SKIA_BINARIES_URL=file:// (read directly, no curl); the tarball rides along as a sha256-pinned flatpak source. Widen the flatpak CI path filters to the session binary's crates (linux-session, pf-presenter, pf-console-ui, pf-client-core) and fix the moved library.rs path in the Decky error-classifier comment. All other plugin↔client contracts (flags, pairing/library output, config files, env vars, exit codes, the 47990 mgmt port) already match — no changes needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	8926d82a80	fix(shell): concentric hover-highlight radius on host cards ... The FlowBoxChild draws the hover/selection highlight AROUND the card (it wraps it with its own padding ring), so its default corner radius ran visibly tighter than the card's 12px inside it. The host grids now scope a 15px radius onto their children — card radius + the ring — so the highlight's corners run concentric with the card's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	4543a3f529	feat(video): HDR10/P010 end to end (phase 6) ... The client now advertises VIDEO_CAP_10BIT|HDR and carries the result all the way to glass: - csc_rows is bit-depth exact (10-bit limited code points differ from 8-bit by ~half a code) and folds in the P010/X6 MSB-packing factor; new 10-bit white/black tests. - The CSC shader grows a params block: mode 0 passes the transfer through (SDR as-is, or PQ onto an HDR10 swapchain); mode 1 tonemaps PQ→SDR in-shader (ST.2084 EOTF, 203-nit reference white exposure, BT.2020→709, soft maxRGB rolloff, sRGB encode) for desktops without an HDR surface. PUNKTFUNK_TONEMAP_PEAK tunes the rolloff. - The presenter probes VK_EXT_swapchain_colorspace + an HDR10/ST.2084 10-bit surface format and flips modes in-band with the stream's PQ signaling: fence-quiesce, then CSC pass + video image (10-bit A2B10G10R10 intermediate — PQ in 8 bits bands) + overlay pipe + swapchain rebuild through the deferred-destroy rules. - P010 decodes through all three paths: Vulkan Video (X6 multiplanar pool, R10X6 plane views), VAAPI dmabuf (R16/RG1616 plane imports), software (swscale as before). - session pump advertises the caps; the host still gates Main10 behind its PUNKTFUNK_10BIT policy. Probed on glass hardware: the KDE/NVIDIA surface exposes A2B10G10R10+HDR10_ST2084, so true PQ passthrough is available there. Known v1 gaps: software-decode PQ shows untonemapped (8-bit RGBA carries the transfer baked); the SDR overlay composites unscaled onto an HDR10 surface (dim OSD); no vkSetHdrMetadataEXT yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	c299a41a67	fix(presenter): resize crash — never vkDeviceWaitIdle while the pump decodes ... vkDeviceWaitIdle's external-sync rule claims EVERY queue on the device; with Vulkan Video the session pump concurrently submits FFmpeg decode work to the shared device's video queue, so the resize path's wait-idle (and the video-image/staging rebuilds') raced it — observed as a crash on window resize mid-stream (software/VAAPI never touched the device from the pump, which is why this only appeared now). Mid-session quiescing is now fence-only ( waits the single in-flight fence, which covers every command buffer WE submitted), and the replaced swapchain + its per-image semaphores/overlay targets are parked in a retire list — the presentation engine may still hold the old swapchain's final semaphore wait, which no fence covers — and destroyed after the next present on the successor completes a fence cycle. The one legitimate device-wide idle left is teardown, and the run loop now JOINS the pump thread first (SessionHandle carries the JoinHandle; quick — the pump notices stop within its 20 ms receive timeout). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	349d16382e	fix(stats): decode stage measures GPU completion; Alt+Enter fullscreen alias ... The Vulkan path's receive_frame returns at SUBMISSION (~0.1 ms) — the hardware decodes asynchronously, so the decode stat was truthful but measured the wrong boundary. The pump now ships the frame to the presenter FIRST, then waits the frame's timeline fence (vkWaitSemaphores resolved through the shared device's proc chain) and stamps received→decode-COMPLETE — true NVDEC time at zero pipeline cost, since the presenter's own GPU wait is what actually gates sampling. Software/ VAAPI keep their synchronous stamps. Also: Alt+Enter joins F11 as the fullscreen toggle (some keyboards' Fn layer sends a media key for plain F11 — observed on glass as 'F11 only works with shift'); the shell's shortcuts panel lists both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	a5bb5ec4d5	fix(input): pointer lock + the missing per-iteration motion flush ... Two capture bugs compounding into 'sluggish and not captured': 1. flush_motion was never called from the run loop — the GTK client's frame-clock tick flushed pending motion every frame, and the port lost it. Pure mouse movement only reached the host when a click/key/ scroll happened to flush it; the host cursor simply didn't follow. Now one coalesced MouseMove per loop iteration. 2. Capture forwarded ABSOLUTE letterboxed coordinates with no pointer confinement (GTK parity, the plan's deferred 'stage-2' item): the visible local cursor outran the host cursor by the full e2e and escaped the window. Capture is now real pointer lock — SDL relative mouse mode (hidden, confined, raw deltas) with relative MouseMove on the wire, so the host cursor is the only cursor. Also: focus-gain re-engages after an auto-release (Alt-Tab undoes itself; the startup focus race can no longer strand the session uncaptured) while a chord release stays released until the user opts back in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	6cb97959a2	docs(video): three-backend reality + log software-by-preference ... The silent settings-driven software path cost a debugging round on the first Vulkan Video glass test (stale decoder=software from the VAAPI- broken-on-NVIDIA era) — now it says so. Module docs updated: auto is vulkan → vaapi → software. Validated on glass (RTX 5070 Ti, HEVC 4K@144): decode 11 ms → 0.1 ms, e2e p50 ~115 ms → 8.6 ms (the old number was software-decode queueing, not clock skew), 144 fps locked, 2686 frames, zero errors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	c78ddc40cb	feat(video): Vulkan Video decode on the presenter's device (NVIDIA hw decode) ... FFmpeg's Vulkan Video decoder now runs on the PRESENTER's own VkDevice — the decoded VkImage feeds the existing CICP CSC pass directly: zero copy, no interop, and NVIDIA gets hardware decode for the first time (its VAAPI is unusable by design). One decode architecture for every vendor going forward; VAAPI-dmabuf and software remain the fallbacks (auto: vulkan → vaapi → software; PUNKTFUNK_DECODER=vulkan pins it). Presenter: instance 1.3; probes VK_KHR_video_queue/decode_queue + codec extensions, a VIDEO_DECODE queue family (+ its codec caps via QueueFamilyVideoPropertiesKHR), and the samplerYcbcrConversion/ timelineSemaphore/synchronization2 features — all enabled at device creation when present, exported as a VulkanDecodeDevice handle bundle. Decoder: AVVulkanDeviceContext built over those handles via pf-ffvk (features chain, extension lists, deprecated queue indices + the qf[] map); get_format supplies OUR frames context with MUTABLE_FORMAT so the presenter's per-plane views are legal; output is DecodedImage::VkFrame carrying AVVkFrame/frames-ctx pointers plus the lock fns. Present: R8+R8G8 plane views over the multiplanar image, the live sync state read under the AVVulkanFramesContext lock, a timeline-semaphore wait(sem_value)/signal(sem_value+1) folded into the submit, layout/ queue-family/sem_value written back per FFmpeg's contract, and the frame guard parked in the retire queue until the fence. CSC pass + video framebuffer are now unconditional (NVIDIA has no dmabuf-import path). Verified on the RTX 5070 Ti: device creates with decode_qf=3, caps=DECODE_H264|H265|AV1|VP9; swapchain unaffected. Live stream validation next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	58ccd530fc	feat(ffvk): bindgen shim for FFmpeg's Vulkan hwcontext (pf-ffvk) ... ffmpeg-sys-next binds a curated header list that omits every hwcontext_*.h, so AVVulkanDeviceContext/AVVulkanFramesContext/AVVkFrame — the surface that lets FFmpeg's Vulkan Video decoder run on the presenter's own VkDevice and hand the decoded VkImages back — had no Rust bindings at all. pf-ffvk generates them at build time from the SYSTEM headers, which is the only ABI-safe option: the struct layout depends on FF_API_* deprecation gates resolved in libavutil/version.h (confirmed: FFmpeg 8.1 still carries the FIXED_QUEUES fields). Ships ash<->vulkan.h handle conversions; opaque AVHW*/AVFrame types keep ffmpeg-sys-next the owner of the core surface (pointer casts across). Needs vulkan-headers (Arch) / libvulkan-dev (CI, added); PF_FFVK_VULKAN_INCLUDE overrides for cross builds. Verified: bindgen layout tests pass, av_vk_frame_alloc links and zero-initializes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	6dd2213a20	fix(session): keyframe recovery when the decoder produces no output ... Under infinite GOP the pump only re-requested an IDR when the reassembler's drop count climbed. A lost initial IDR (or a mid-GOP join) delivers complete-but-undecodable delta frames instead — the reassembler never drops, so recovery never fired and the stream froze on the last good frame while libavcodec flooded stderr with missing-reference errors. Reproduced at 4K@144 (large IDRs, higher loss); lower modes hid it. Now a 3-frame no-output streak (~50 ms) forces a fresh IDR, throttled and re-armed across the request→IDR round trip. Verified on glass: 4K@144 recovers and holds. Also quiets libavcodec's raw stderr (it bypassed tracing) to fatal-only, PUNKTFUNK_FFMPEG_LOG restores it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	cbcd7a5c40	refactor(client): relm4 desktop shell; delete legacy presenter + coverflow (phase 5) ... The GTK client becomes a relm4 component tree: AppModel owns the window, trust gate (rules 1-3), and the spawned session child's lifecycle as typed messages; the hosts page is a child component with a FactoryVecDeque of host cards — the HostsCallbacks Rc<dyn Fn> bag, the busy Cell, and the Rc<RefCell<HostsUi>> cross-page pokes are gone. Trust/settings/library dialogs stay plain GTK, invoked from update with a ComponentSender. Deleted with the in-process presenter: ui_stream.rs, video_gl.rs, ui_gamepad_library.rs, launch.rs, the khronos-egl dep, and the PUNKTFUNK_LEGACY_PRESENTER hatch. Every stream (and the console library) now runs in punktfunk-session; the shell spawns it for card connects and exec's it for --connect/--browse so the Decky wrapper keeps working. The request-access flow gains --connect-timeout + a CancelHandle that kills the child. Screenshot scenes re-pointed onto the components (verified: hosts + library self-capture; the dialog scenes present correctly and capture under a GL renderer); the gamepad-library scene is gone with the page. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	be09f9f345	feat(session): console game library — Skia coverflow + SkSL aurora, --browse (phase 4b) ... The run loop grows a browse mode: the console library idles between streams in ONE window (no gamescope handoff), overlay actions launch sessions via run_browse's callback, session end returns to the library. The Overlay contract gains menu routing (MenuEvent → haptic pulse), action draining, and session-phase edges. pf-console-ui ports the GTK launcher wholesale: the coverflow's springs, cursor arithmetic and recede/tilt constants move verbatim with their tests (plus new projection tests — focused-card centering, the inner- edge-recedes corridor); paint order is draw order (the gtk::Fixed restack hack is gone); the aurora renders as an SkSL runtime shader at full rate on every box (the 30 Hz CPU-upscale path and its frozen-on- Deck fallback are deleted — the generated SkSL is compile-tested); titles/scenes shape through textlayout (CJK-safe). Poster art streams in as encoded bytes through the shared model and decodes renderer-side. The session binary wires --browse host[:port] [--mgmt PORT]: KnownHosts lookup (unpaired renders the pair-first scene), library + art fetch on threads, PUNKTFUNK_FAKE_LIBRARY dev hook, and a session_params helper shared with --connect. The minimal build refuses --browse cleanly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	021a2261f6	feat(session): Skia console UI — overlay contract + stats OSD/capture HUD (phase 4a) ... The §6.1 presenter↔console-UI contract lands: pf-presenter exposes its device (SharedDevice) and composites at most one premultiplied-alpha quad per frame (new overlay.frag + LOAD render pass over the swapchain; zero cost while the overlay returns None). pf-console-ui implements it with skia-safe on the shared VkDevice: DirectContext via the ash dispatch chain, a ring of two offscreen render targets (one-frame-in- flight safe), damage-driven redraws — the OSD re-renders at 1 Hz, the hint on capture toggles, nothing per-frame. Skia never touches the swapchain. The session binary carries it behind the default ui feature: 4.9 MB stripped without, 10 MB with (measured). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	433a23da7a	test(presenter): PUNKTFUNK_HW_FAULT=import demotion hook (phase 2 acceptance) ... Faults every dmabuf import so the failure-streak → force_software → software-decode recovery is exercisable on healthy hardware — the plan's §8 phase-2 acceptance requires demoting via a deliberately faulted import rather than waiting for a broken driver. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	a3d3d4738c	feat(client): shell hands desktop connects to punktfunk-session (phase 3) ... start_session_with routes desktop windowed connects to the spawned Vulkan session binary (--connect --fp, --launch, --fullscreen from the stream setting); spawn.rs bridges its stdout contract into the shell — spinner until {"ready":true}, banner from the error/ended JSON line, exit 3 + trust_rejected routed to the re-pair PIN ceremony, TOFU pins the advert fingerprint only once the child proves it on a real connect. The in-process GTK presenter stays for PUNKTFUNK_LEGACY_PRESENTER=1, Gaming-Mode/--fullscreen and --browse launches (no second toplevel under gamescope until phase 4 moves the console UI), the request-access flow, and any spawn failure (silent fallback). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	a02d0a2e9f	feat(presenter): VAAPI dmabuf → Vulkan zero-copy import + CSC pass (phase 2) ... The decoder's NV12 dmabuf imports per-plane (R8 + GR88, explicit DRM format modifier, dedicated dup'd-fd import, FOREIGN→graphics acquire) and a fullscreen-triangle render pass converts it into the presenter's video image with the CICP-driven coefficients ported from video_gl.rs (same tests, plus a rows-vs-matrix agreement check). SPIR-V is committed (shaders/build.sh regenerates) so builds and CI need no toolchain. The import extension set is probed at device creation; unsupported boxes and 3-failure streaks demote the decoder to software via the existing force_software contract. The session binary now honors the Settings decoder preference instead of forcing software. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	89d45f2a55	feat(client): Vulkan session binary — SDL3 + ash presenter MVP (phase 1) ... punktfunk-session streams one --connect session in an SDL3 window: ash swapchain with a transfer-only letterboxed blit of the software-decode path (no graphics pipeline until the phase-2 dmabuf/CSC pass), the ui_stream input-capture state machine on SDL events (scancode→VK table cross-checked against the evdev one), gamepads via a new caller-pumped GamepadService mode (SDL video owns the main thread here), and the shell↔session stdout contract: {"ready":true}, per-window stats: lines, JSON error + exit codes 0/2/3/4. Strict trust — no pin, no connect. Design: punktfunk-planning linux-client-rearchitecture.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	0ab97b597c	refactor(client): extract UI-agnostic plumbing into pf-client-core (phase 0) ... Session pump, FFmpeg decode, PipeWire audio, SDL3 gamepads, keymap, trust store, mDNS discovery, library client and Wake-on-LAN move verbatim from clients/linux into crates/pf-client-core, shared with the upcoming Vulkan session binary (punktfunk-planning: linux-client-rearchitecture.md). The GTK client re-exports them at the crate root so every existing crate::-path keeps resolving; its manifest drops the moved-only deps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	bf07700c74	feat(clients): windows shortcut parity (Ctrl+Alt+Shift+S, F11) + surface stream shortcuts ... Windows was missing two of the four stream shortcuts the GTK client has: Ctrl+Alt+Shift+S (toggle the stats overlay live) and F11 (toggle fullscreen). Add both to the low-level keyboard hook — S flips a HUD_VISIBLE atomic seeded from Settings::show_hud at install (Settings is the default, the key overrides it for the session, matching GTK), F11 drives a borderless-fullscreen toggle on the window HWND and re-locks the pointer geometry for the new client rect. Both are consumed locally, never sent on the wire. Surface the full key set in two places, on both clients: - in the UI: a read-only "In-stream keyboard shortcuts" reference card in the Windows Settings > Input section (the counterpart of the GTK Shortcuts window), plus the expanded HUD hint; the Linux keyboard hint gains F11. - at stream start: a bottom-centre banner listing the shortcuts for the first few seconds of every session, independent of the HUD setting. Linux gets the matching start-flash of its capture hint (capture engages on map and hid it, so the keys were never shown until the first release). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 22:55:45 +02:00
enricobuehler	655ec31ef9	ci(android): attach the built APK to the workflow run ... The APK was only reachable via the generic registry (or attached to a Gitea Release on a vX.Y.Z tag) — a main-push canary or a PR/dispatch run surfaced no downloadable APK on the run page itself. Add an upload-artifact step (v3, per Gitea's GHES-identifying artifact backend, like apple.yml) that grabs whichever APKs were built — the signed universal release APK on a main/tag push, else the debug APK — so any run is a one-click sideload download. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 17:01:02 +00:00
enricobuehler	04302075b5	feat(android): promote the low-latency pipeline to default ... The async decode loop (burst-feed + present-newest-per-vsync, the Apple client's discipline) plus the per-SoC tuning was gated behind an experimental, default-off toggle after the 5dc24a0 overhaul regressed on some phones. That regression was the receive-side latency ratchet the async loop fed — a standing queue that only grew — now fixed in the shared core (FrameChannel jumps to live instead of accumulating it), so the fast pipeline is the default again. Default the master toggle on via a fresh pref key (low_latency_mode_v2), mirroring the migration da376b31 used to flip it off: a new key re-defaults every install — including ones persisted off under the old key — to on, so the promotion reaches users who had saved settings, not just fresh installs. Both stale keys are abandoned unread. Toggle-off still restores the original synchronous decode pipeline byte-for-byte as a per-device escape hatch. Drop "(experimental)" from the settings labels and fix the now-stale default-off wording in the native + Kotlin docs. No decode-path routing change — run_async is reached simply because the toggle now defaults on. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 16:18:40 +00:00
enricobuehler	a1b890ef42	fix(host): coalesce keyframe-request storms into one IDR per cooldown ... Clients request a keyframe on every FEC-unrecoverable frame and keep asking until the IDR actually arrives and decodes — a full round-trip on a link that is already behind. The host answered every request with a full IDR and only rate-limited under intra-refresh (opt-in, off by default), so on the default path a Wi-Fi loss burst produced a 20-40x bitrate spike storm that deepened the very loss it was recovering from — the second half of the periodic double-jolt. Coalesce a request storm into at most one forced IDR per cooldown ALWAYS: serve the first immediately (a genuinely wedged decoder still recovers at once), then suppress for the window (2 s under intra-refresh's healing wave, 750 ms for a full-IDR recovery — long enough to swallow one recovery event's round-trip echo, short enough to re-issue a lost IDR promptly). Seed the cooldown at session open and stamp it on both rebuild paths so the cold-open / post-rebuild storm coalesces into the IDR the fresh encoder already emits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 16:18:30 +00:00
enricobuehler	bdcbb2d3a7	fix(core): jump to live on a standing receive backlog instead of ratcheting latency ... The embedder-facing frame queue was a 16-deep sync_channel whose try_send dropped the NEWEST access unit on overflow — backwards for a live stream (keeps stale, discards fresh), a ~266 ms floor that could not self-drain (producer and consumer both run at frame rate, so any depth a burst injects is conserved forever — the latency ratchet), and a silent reference-chain break the loss counters never saw. The clock-based flush meant to catch it was gated on the skew handshake and never even drained that queue. Replace it with a purpose-built FrameChannel (VecDeque + Condvar) exposing depth() and clear(). Pre-decode AUs are reference-chained under the host's infinite GOP, so they are never dropped mid-stream; instead, when the embedder falls persistently behind, the pump JUMPS TO LIVE — flush_backlog() + clear the queued AUs + request a keyframe — so decode re-anchors cleanly at an IDR. Two cooldown-gated detectors, both suspended during a speed test: - clock-based (existing): > FLUSH_LATENCY behind the skew-corrected clock for FLUSH_AFTER_FRAMES straight; also catches kernel/reassembler backlog. - clock-free (new): the hand-off queue sat >= QUEUE_HIGH without draining to QUEUE_LOW for STANDING_FRAMES straight. Works on same-clock / no-handshake sessions where the clock path is disarmed — the direct "the embedder can't keep up" signal. A transient Wi-Fi clump drains in a few frames and never trips it. Bounded (90-frame hard cap, drop-oldest memory backstop) and diagnosable (each jump logs queue_depth / flushed_datagrams / dropped_frames). next_frame's external Timeout/Closed contract is unchanged, so every native client inherits the fix. Adds 5 FrameChannel unit tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 16:18:18 +00:00
enricobuehler	1dc8dc7f0d	fix(packaging): open mgmt/library port 47990 on the LAN firewall profiles ... The mgmt REST API has bound 0.0.0.0:47990 by default since ae51276 so paired clients can browse the game library over mTLS, but every packaged firewall opener still excluded 47990 and the docs still claimed it was loopback-only. On any host with an active firewall (ufw/firewalld) the LAN game-library feature was silently broken. Add 47990/tcp to the native firewall profiles (punktfunk.ufw [punktfunk-native] + punktfunk-native.xml) and correct the stale "loopback-only by default" text across the debian/arch/bazzite READMEs and the docs site (incl. the factually wrong --mgmt-bind default in host-cli.md, 127.0.0.1 -> 0.0.0.0). Opening the port adds no admin exposure: off-loopback mgmt::require_auth serves only the read-only status/library allowlist to a paired client cert; the bearer-token admin surface stays loopback-only regardless of the bind. Windows was already sound (shared parse_serve binds 0.0.0.0; service.rs already firewall-opens 47990) — add a clarifying comment so the rule isn't mistaken for accidental over-exposure. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 12:38:57 +00:00
enricobuehler	7effdb4030	docs(decky): use the unom.io/pf-decky short link for install-from-URL ... The full git.unom.io package URL is painful to read/type on a Steam Deck's on-screen keyboard; unom.io/pf-decky now redirects to it (added in unom/infra's Caddyfile). Canary/pinned links stay long-form since only /latest gets a short link. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 11:57:51 +00:00
enricobuehler	f30a65d507	fix(web): override vulnerable transitive deps, clear bun audit ... Force patched undici/dompurify/postcss/esbuild/js-yaml pulled in transitively via @unom/ui's payload/vite/storybook chains, and bump vite 7.3.5 -> 7.3.6 so esbuild resolves consistently to 0.28.1 instead of splitting across 0.27.7/0.28.0. Closes all 26 bun audit findings (3 high, 17 moderate, 6 low). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 11:50:41 +00:00
enricobuehler	774988edd4	fix(deps): bump crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 10:50:08 +00:00
enricobuehler	324da666e5	chore(release): bump workspace version to 0.8.2 ... Release 0.8.2: native AMF encoder reconnect reliability on Windows AMD — a second connection no longer comes up black (the encoder now Flushes before Terminate so a reconnect's overlapping teardown can't strand AMD's VCN encode session, self-heals with a full context rebuild when a reconnect still wedges, and logs a per-context bring-up number + first-AU line so a silent wedge is visible); a native data-plane hardening pass that keeps the stream alive across real Wi-Fi links; Android streaming wake/Wi-Fi locks that actually engage plus a console-UI polish pass (per-controller glyphs, scrollable dialogs, animated forms); and gamescope-takeover survival on Bazzite's SDDM session supervisor. Also a Linux-client crash fix — the FlowBox activation cycle that stack- overflowed on every host-card click. The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; refresh the 9 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag (scripts/ci/pf-version.sh), so cutting v0.8.2 auto-advances canary to 0.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.8.2	2026-07-07 11:16:19 +02:00
enricobuehler	efed8d5a20	fix(host): AMF encoder reconnect reliability on Windows AMD ... A second connection to a Windows AMD host came up black with nothing in the logs. The native AMF encoder's teardown never Flushed before Terminate, so a reconnect whose teardown overlapped the new session (a client may not signal an explicit exit, so session 1 tears down late — on the reconnect preempt grace or the QUIC idle timeout) left AMD's limited VCN encode-session slot occupied. The new session's Init then opened onto a wedged session that returns AMF_OK but never emits an AU. NVENC has no equivalent per-session cap, so NVIDIA never showed it. Recovery couldn't help either: the stall watchdog re-Init'd the SAME context, which can't clear a context/VCN-level fault, so it looped a dead context until MAX_ENCODER_RESETS ended the session. Reliability: - Component::drop now Flushes before Terminate (mirrors reset() and the design doc), releasing the VCN session cleanly so the next session's Init gets a free slot. - reset() escalates to a FULL context teardown once an in-place re-Init has run without producing an AU (resets_without_output >= 2), so a wedged reconnect self-heals via a fresh CreateContext+InitDX11 within the reset budget instead of re-initing a dead context in a loop. Logging (the failure was silent): - Per-context bring-up sequence number (context #N) — distinguishes a first connection from a reconnect's fresh context. - A one-shot "AMF produced its first AU on this context" line; its absence after a context #N bring-up is the smoking gun for a silent VCN wedge. - Terminate result logged on drop for both the component and the context. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 11:09:59 +02:00
enricobuehler	636b9c1d1f	Merge remote-tracking branch 'origin/main'	2026-07-07 06:15:21 +00:00
enricobuehler	92f078adaf	fix(host): survive Bazzite's SDDM session supervisor in the gamescope takeover ... Diagnosed live on the .181 Bazzite F44 box (couldn't connect at all; field reports of streams dying after 30 s-5 min): Bazzite autologs into game mode via SDDM with Relogin=true, so the moment the managed takeover stops gamescope-session-plus@<client>, SDDM logs back in and restarts it within the same second. The resurrected autologin session then fights our transient session-plus over the Steam single instance and the GPU for the whole stream: its wrapper relaunches gamescope every ~7 s (each one missing the wrapper's hard 5 s readiness window on a slow NVIDIA init), the churn SIGSEGVs gamescopes, and eventually the streaming gamescope dies with it. Meanwhile a client that gave up left the pipeline-rebuild retry loop SIGKILLing and relaunching the box's Steam session for up to ~6 more minutes. - stop_autologin_sessions: runtime-mask each autologin unit before the SIGKILL stop, so no supervisor can restart it underneath the stream; match every loaded instance (the unit flaps through activating/failed mid-churn). Every restore path unmasks unconditionally (including the desktop-active early return), and --runtime keeps the mask in tmpfs so a reboot clears it. - launch_session: supervise the transient unit while polling for the node — the session-plus wrapper kill -9s a gamescope that missed its 5 s readiness handshake and exits 1, so relaunch it (after a short driver-settle cooldown) instead of waiting the rest of the 45 s on a corpse. - build_pipeline_with_retry: abort between attempts once the session's QUIC connection is closed — no more minutes of Steam churn for a departed client. Validated live on .181: cold-boot connect streams 2059 frames/45 s (p50 5.1 ms), zero SDDM resurrections while masked, TV session restored+unmasked on disconnect, warm same-mode reconnect reuses the session (866 frames/15 s). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 06:15:12 +00:00
enricobuehler	17685ff73b	build(android): debug APKs ship release-profile rust ... Cargo's debug profile is not "slower" for this library — it is unusable, and it invalidated every on-device performance test to date: RustCrypto's AES-GCM compiles to generic-array iterator closures with per-byte precondition checks instead of ARMv8 hardware AES. Profiled live on a phone (simpleperf, 62k samples): ~800 µs of user CPU per 1.4 KB packet — the receive pump pinned above a full core yet only draining ~1,400 pkt/s of a 1,775 pkt/s (20 Mbps) stream, 2.3 MB standing in the kernel socket buffer, the latency-bound flush firing every 2 s forever. With release rust in the same debug APK: pump at ~12 % of a core, socket queue zero, no flushes, 2800x1260@120 streaming clean. preDebugBuild now depends on cargoNdkRelease; `-PrustDebug` opts back into a debug-profile native build for sessions that actually step through Rust. Kotlin debuggability is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	08ab2b6bee	fix(android): declare WAKE_LOCK — the stream's Wi-Fi locks never actually engaged ... WifiLock.acquire() enforces the WAKE_LOCK permission, which the manifest never declared — every acquisition since the first Wi-Fi lock shipped threw SecurityException, silently swallowed by a bare runCatching. The phone's own accounting proved it (dumpsys wifi: high_perf/low_latency active_time_ms = 0 across weeks of streams): every on-device session ran with Wi-Fi power save fully active, whatever the code intended. Verified live after the fix: both locks registered in WifiLockManager, mPowerSaveDisableRequests=2, ping RTT to the streaming phone 3.8 ms avg. A failed acquire now logs loudly — this class of failure must never be invisible again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	b271d0c816	fix(android): hold BOTH Wi-Fi locks while streaming — HIGH_PERF alone is a no-op ... The baseline stream held only WIFI_MODE_FULL_HIGH_PERF, which is deprecated AND non-functional on recent Android — so with the low-latency toggle off (the default) Wi-Fi power save stayed fully active: downlink delivery clumped at beacon intervals (a few hundred ms of latency mush, sawtoothing bitrate) and the AP's power-save buffer periodically overflowed, killing whole frames every few seconds (the host log's alternating loss_ppm=0/50000). Now every stream holds FULL_LOW_LATENCY (API 29+, the only effective power-save disable; foreground + screen-on, which a stream always is) AND FULL_HIGH_PERF (covers older releases) — the same pair Moonlight holds. The experimental toggle no longer selects the lock mode. Also: declare tracing's "log" feature explicitly in the native crate (core transport warnings → logcat must not hinge on quinn's default features), and align the low-latency toggle's copy with its actual scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	83b7c7adf5	feat(android): console UI — per-controller glyphs, dialog scrolling, animated forms ... - Hint-bar glyphs now wear the driving controller's family (kit Gamepad.styleFor by USB vendor id → MainActivity.lastPadStyle, kept live by real input like lastPadIsGamepad): PlayStation pads get Canvas-drawn cross/circle/square/triangle shapes in the classic colours, Nintendo pads monochrome lettering, Xbox/Valve/unknown the coloured letter discs. Hint chars stay semantic (KEYCODE_BUTTON names); only the rendering changes. - The Options legend renders the pad's real Select-family button (SelectButtonGlyph): Xbox View windows, PlayStation Create capsule, Nintendo minus — instead of a bare capsule outline. - GamepadDialog: body + action stack scroll together (title pinned) with BringIntoViewRequester keeping the focused button visible — a 5-action host options dialog compressed/clipped its last button in short landscape windows because the pinned stack could not scroll. - Console form polish: shared animateConsoleFocus (bg/border cross-fade + spring scale) across settings rows / add-host fields / action rows; ConsoleSwitch (spring knob, tinting track) replaces On/Off text on toggle rows; choice values slide in the direction they were stepped (AnimatedContent + SizeTransform) with chevrons that fade in place; the focused row's detail unfolds via AnimatedVisibility; dialog buttons and keyboard keycaps cross-fade (keycaps at 90 ms for hold-to-repeat). - Console settings gain the "Low-latency mode" (Video) and "Auto-wake on connect" (Interface) rows, round-tripping with the touch settings. - Screenshot scene: StatsOverlay call updated to the 18-double layout + the new decoderLabel parameter (fixes the android-screenshots CI compile). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	eea23c5647	fix(core,host): make the native data plane survive real Wi-Fi links ... Root-caused live on a phone at 100 Mbps (stream stuck seconds behind, then oscillating): a stack of transport defects, each amplifying the next. - MTU-safe shards: shard_payload 1452 overshot the IPv4/1500 budget (the old math forgot the 40 B header + 24 B crypto ride inside the UDP payload and counted IP+UDP as 8 B) — the kernel silently split EVERY video datagram into two IP fragments, doubling per-datagram loss on Wi-Fi. New config::mtu1500_shard_payload() = 1408 (1472 sealed = the exact ceiling), negotiated in the Welcome, pinned by a unit test. - Android batched I/O: recv/send batching was cfg(linux); Android is target_os="android" and silently fell back to a syscall per datagram. The libc crate binds neither recvmmsg/sendmmsg nor mmsghdr for Android, so a local bionic extern binding provides them (API 21+, floor is 28); cbindgen excludes them from the C header. The pump/runtime threads also get the Apple-QoS analogue on Android: nice −8 (below the decode thread's −10). - Latency-bounded receive: packets are consumed strictly in order at exactly the arrival rate, so a standing queue (Wi-Fi stall, power-save clumping) NEVER drains — observed as a stream permanently 6-7 s behind with both 32 MB socket buffers full. The pump now flushes the entire backlog (Session::flush_backlog: discard ring + kernel queue at memcpy speed, reset the reassembler) and requests a keyframe when frames keep completing > 400 ms behind the skew-corrected capture clock (30 consecutive, 2 s cooldown, logged). - Time-based loss window: the reassembler declared an incomplete frame lost a fixed 4 INDICES behind the newest — 33 ms at 120 fps, inside normal Wi-Fi retry/reorder timescales, so merely-late frames were pruned every few seconds, each costing a recovery-IDR burst + an inflated loss report. Now 120 ms of capture time (LOSS_WINDOW_NS), same fuse at every refresh rate, with a 64-index hard cap bounding memory against hostile pts. - Adaptive-FEC hysteresis: the controller was memoryless — one clean 750 ms report dropped FEC from 8 % straight back to the 1 % floor, so periodic burst loss (Wi-Fi scan / BT coexistence beats) always hit an unprotected stream and ping-ponged 1↔8 % with a frozen frame per cycle (observed in the host log as alternating loss_ppm=0/50000). Attack stays instant; decay is now one point per clean report. Verified: full core suite (incl. new flush + time-window tests) on macOS + Linux, host release build, arm64 cargo-ndk build, and a 30 s wired probe run at 2800x1260@120 — 3559/3559 frames, zero loss, capture→received p50 5.3 ms (host 5.1 + network 0.3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	912d7de2e6	style(linux): rustfmt drift from the last two commits ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:22:46 +02:00
enricobuehler	e788d0de84	feat(client-linux): log the release/disconnect keyboard chords ... The Ctrl+Alt+Shift+Q/D handlers had no tracing, so a report of "the disconnect shortcut doesn't work" was unverifiable from logs alone — live tracing (added temporarily, then trimmed to these two lines) showed the chord, `disconnect_quit()`, and the session teardown all firing correctly and instantly every time; the confusion traced back to the (now-fixed) FlowBox click crash having kept everyone from ever reaching a live session to test the shortcut with in the first place. Keep the two low-noise, deliberate-action log lines for the next time this comes up; drop the per-keystroke debug trace used to diagnose it, which would otherwise fire on every key during a stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:21:26 +02:00
enricobuehler	53c8eefa99	fix(client-linux): break the FlowBox activation signal cycle — stack overflow on every host-card click ... `child-activated` (fired by a pointer click) was bridged to `child.activate()` so each card's own connect handler (wired on the child's `activate` signal) would run. But `child.activate()` runs `GtkFlowBoxChild`'s default handler, which re-emits `child-activated` on the FlowBox — bouncing straight back into the same closure. Unguarded, that ping-pong recursed forever, overflowing the stack on every single host-card click or Enter-key activation (confirmed live via coredump/gdb: 43k+ stack frames of gobject signal emission, and the `fatal runtime error: stack overflow, aborting` in the crash log). A re-entrancy flag breaks the cycle after the one real activation. Added a regression test that wires the identical FlowBox/FlowBoxChild signal cycle against a real display and asserts it returns instead of recursing — it reproduces the exact stack overflow against the old code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 23:59:04 +02:00
enricobuehler	da376b3122	fix(android): gate the latency overhaul behind an experimental toggle, default off ... The 5dc24a0 low-latency overhaul regressed badly on some phones. Every piece of it — decoder ranking, per-SoC vendor keys, the async decode loop, pipeline thread boosts, the ADPF max-performance bias, game-tagged AAudio, DSCP marking, the Wi-Fi low-latency lock, HDMI ALLM and the forced TV mode switch — now rides the "Low-latency mode (experimental)" toggle, default OFF. Off restores the pre-overhaul pipeline byte-for-byte: the sync poll loop, the platform-default decoder, and the original format keys (standard low-latency + blind Qualcomm twin + priority=0 + operating-rate=MAX together). - New pref key (low_latency_mode_experimental): the old key shipped default-ON, so any install that ever saved settings persisted true — flipping the default under the old key would leave exactly the regressed devices stuck on. - DSCP is applied at socket creation, so the toggle reaches the transport via NativeBridge.nativeSetLowLatencyMode → transport::set_dscp_default, called in the connect choke point before nativeConnect; the core DSCP default reverts to off everywhere. - nativeStartAudio(handle, lowLatencyMode) gates AAudio usage=Game. - VideoDecoders.pickDecoder now skips `.secure` decoder twins and decoders that require FEATURE_SecurePlayback: they need a secure surface, and a secure twin could out-score its plain sibling (only it advertising FEATURE_LowLatency), which black-screens a clear stream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.8.1	2026-07-06 20:18:59 +02:00
enricobuehler	35e16303e6	Merge remote-tracking branch 'origin/main'	2026-07-06 20:02:48 +02:00
enricobuehler	b3c7ba5082	fix(android): auto-wake opt-out + console glyphs default by form factor ... An mDNS discovery miss was forcing connects through the Wake-on-LAN wait even for a host that's already up; add a Settings toggle ("Auto-wake on connect") that skips the mDNS-liveness gate and dials straight through when off. Also default the console UI's button glyphs by form factor instead of always starting in TV-remote style: a phone/tablet only ever enters the console UI via a real controller, so it should show gamepad glyphs from the first frame, not a remote's select/back glyphs. TV keeps the remote default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:56:31 +02:00
enricobuehler	cb7c54a14d	chore(release): regenerate openapi.json for 0.8.1 ... The 0.8.1 version bump (6c1e6ad) bumped Cargo.toml but not the generated OpenAPI doc, leaving info.version stale at 0.8.0. Regenerated — version string only, no API surface change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 17:43:06 +00:00
enricobuehler	4b88aa63c2	style: rustfmt drift from the native AMF SDK encoder ... The native AMF encoder (6f47aba) landed unformatted, failing CI's Format step (and short-circuiting Clippy/Build/Test). Reformatted amf.rs with the pinned rustfmt 1.96.0 — no functional change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 17:39:40 +00:00
enricobuehler	7b4132f74b	fix(client-linux): share one GamepadService across app activations ... `build_ui` (the GTK `activate` handler) started a fresh SDL3 gamepad worker thread on every reactivation of the already-running singleton (another --connect, the launcher clicked twice, ...). sdl3 only lets the first thread ever to call sdl3::init() hold "main thread" status, so every later activation's worker thread failed permanently with "Cannot initialize `Sdl` from a thread other than the main thread", silently disabling controller support for the rest of the process. Start the GamepadService once in run() and clone it into build_ui instead of starting a new one per activation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:11:45 +02:00