104 Commits

Author	SHA1	Message	Date
enricobuehler	764b5d938b	fix(gamepad): resolve the menu diagonal tie-break horizontally on all clients (G25) ... The gamepad-UI navigation resolvers disagreed on which way a perfect 45-degree stick push (|x| == |y|) resolves: the SDL core picked horizontal (`ax >= ay`) while Apple (`abs(x) > abs(y)`) and Android (`abs(Y) >= abs(X)`) picked vertical. Align Apple (`>` -> `>=`) and Android (`>=` -> `>`) to the SDL core so an exact diagonal moves focus the same way on every client (horizontal wins). This is client-local menu navigation only and never reaches the wire. Completes the last deferred G25 sub-part. Verified: Apple `swift build` + full suite (124 pass); Android `:app:compileDebugKotlin`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 22:24:03 +02:00
enricobuehler	60af4de3ba	docs(gamepad/android): document the two-motor vibratorIds ordering assumption (G20) ... The two-motor split assumes ids[0] = light/right and ids[1] = heavy/left, an ordering `VibratorManager.getVibratorIds()` does not guarantee. Record the assumption and its tactile-only failure mode (a heavy-first pad inverts the feel but nothing silences or crashes) at the call site. No behavior change: a per-pad fix needs on-glass verification, and a blanket count-based fallback is unsafe (extra ids may be DualSense trigger actuators that must stay silent). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 22:05:13 +02:00
enricobuehler	48933dc405	fix(gamepad/android): batched HAT, rumble-duration floor, bind eviction, held exit chord (G4/G9/G18/G24) ... Four Android gamepad fixes bringing the client to parity with SDL/Apple: G4 — HAT batched history. Android batches joystick ACTION_MOVEs, so a rapid d-pad tap (press+release within one batch) lived only in the event's historical samples; onMotion read just the final getAxisValue and missed it. Feed every historical HAT sample through the transition logic (new `applyHat`) before the current one. Sticks/triggers stay latest-wins. G9 — floor the rumble one-shot duration. A v2 lease can carry ttl_ms==0 with a nonzero amplitude (past the (0,0) stop guard); createOneShot throws on a non-positive duration, and on the VibratorManager path the effect is built outside the vibrate() runCatching, so the throw would kill the whole rumble poll thread. `durationMs.coerceAtLeast(1)`. G18 — evict feedback binds on disconnect. Rumble/light bindings were cached by device id and freed only at session stop, so a controller unplugged mid-session leaked its open LightsSession. Add GamepadFeedback.onDeviceRemoved(deviceId) (closes the session, cancels rumble), invoked from GamepadRouter's slot-close via a new onSlotClosed callback wired in StreamScreen. The bind maps are now guarded by a lock (the poll threads write them; eviction runs on the main thread). G24 — held exit chord + releases. The emergency-exit chord (Select+Start+ L1+R1) quit the stream the instant it completed — an accidental brush killed the session, and the four held buttons were never released host-side. Now completing the chord ARMS a 1.5 s hold timer (matching DISCONNECT_HOLD on SDL/Apple); onExitChord fires only if still held at expiry, after releasing the held buttons + zeroing the axes on the triggering pad(s). onButton no longer returns the exit bool (async now); MainActivity + StreamScreen updated. G25 (Android half): no change — Android's stick/trigger `.toInt()` already truncates, the chosen cross-client convention. G23 (rich-input plane) stays deferred to its own doc. Verified on this Mac: :kit + :app compileDebugKotlin clean; kit lint unchanged at its pre-existing baseline. On-glass on a real phone + pad still owed (per the Android-regressions-only-show-on-hardware history): watch batched d-pad taps, the 1.5 s exit hold, and a mid-session unplug. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 18:04:30 +02:00
enricobuehler	cdb43f00fe	style: rustfmt the freeze-until-reanchor client wiring ... cargo fmt --all --check flagged the reanchor gate wiring (decode.rs / session.rs / abi.rs / reanchor.rs): wrapped signatures + comparisons, and two multi-line comments that followed a trailing-comment line were restructured to their own lines so rustfmt keeps them at normal indentation instead of deep-aligning them. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 07:36:43 +02:00
enricobuehler	8a18e130a2	feat(client): freeze-until-reanchor loss recovery on Android + Apple via shared core gate ... After unrecoverable loss the host keeps sending delta frames that reference a picture the client never received; hardware decoders conceal these as gray/ garbage with a success status. Linux already withheld them and held the last good frame until a proven clean re-anchor — this brings that behavior to the Android and Apple clients. Extract the Linux pump's freeze state machine into a shared `ReanchorGate` in punktfunk-core (reanchor.rs, 18 tests) exposed over the C ABI (ABI v6, additive — no wire change) for the Swift clients. Migrate the Linux/Deck pump (pf-client-core) onto it as the parity proof (no-op refactor). Then wire: - Android (decode.rs, both sync + async loops): arm on the frame-index gap, a pts-keyed flag map carries the wire flags to the output-buffer release, fold the gate per drained output, gate.poll replaces the dropped-climb block. - Apple Stage2Pipeline (default): arm on a gap (new noteFrameIndexGap), withhold at the ring-submit seam (CAMetalLayer holds its last drawable), poll framesDropped, fold VT decode errors through the no-output streak. - Apple StreamPump (stage-1): fold at enqueue, withhold via kCMSampleAttachmentKey_DoNotDisplay so the layer keeps decoding (reference chain intact) but holds the last displayed frame. - Apple VideoDecoder: thread the AU's wire flags to the async decode callback via a retained FrameContext refcon (replaces the receivedNs bit-pattern scalar). Lifts only on a proven re-anchor (IDR / RFI anchor / 2nd recovery mark) with a 500 ms backstop so a lost re-anchor can never freeze forever. Apple: swift build clean, 123/123 tests pass (incl. VideoToolboxRoundTripTests). On-glass loss-injection validation still owed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:22:09 +02:00
enricobuehler	0ad4e6eff7	feat(android): multi-controller support ... Roll the pf-client-core slot pattern to the Android client (Kotlin + JNI): - New kit/GamepadRouter.kt: the Android analogue of the client-core Slot model — a deviceId→Slot map assigning each InputDevice a stable lowest-free wire pad index held for its lifetime, GamepadArrival(pref) before a pad's first input, GamepadRemove on onInputDeviceRemoved, per-slot AxisMapper + held-bitmask so two pads never clobber each other. The isForwardable gate (excludes DualSense/DS4 all-zero sensor sibling nodes) is centralized in slotFor so no entry point can open a phantom slot. - native/src/session/input.rs: JNI shims take a pad arg -> flags=pad (nativeSendGamepadButton/Axis, plus nativeSendGamepadArrival/Remove). - native/src/feedback.rs: pad carried in rumble bits 49..52 + a leading hidout pad byte; GamepadFeedback.kt routes rumble/lightbar/LED back to the originating device by pad via deviceForPad. - MainActivity.kt routes key/motion events by device; ControllersScreen.kt badges every forwarded pad (was hardcoded i==0), reading getControllerNumber. A lone controller lands on wire index 0, so its per-transition datagrams stay byte-identical to the old single-pad path. gradle :app:assembleDebug green (Rust cross-compiled via cargo-ndk); JNI signatures hand-verified 1:1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:53:07 +02:00
enricobuehler	1dfcb0b2f6	feat(android): default-UI connect/wake modal (Material dialog) ... Mirror the Apple client: the connect/wake overlay was showing the full-screen aurora takeover in the default touch UI too. Make ConnectOverlay mode-aware — gamepad/console keeps the aurora ConnectTakeover, the default UI now renders a Material 3 AlertDialog over the host grid (inert scrim; Back/buttons cancel), matching the app's other touch dialogs. Extract a shared connectCopy() so both presentations read identically; ConnectTakeover is now console-only. Screenshot scenes updated (touch phases -> modal over the host grid via shootScreen; console stays a root capture); record-mode tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 01:29:18 +02:00
enricobuehler	dd02e1f402	feat(clients): unified full-screen connect/wake takeover + iOS/tvOS Wake-on-LAN ... Give instant feedback the moment a host is picked, and make the wake wait a full-screen takeover instead of a modal card — unified into one ConnectOverlay across every client: - android: new ConnectOverlay (aurora backdrop; Connecting / Waking / timed-out phases) replaces the tiny inline "Connecting…" row and the WakeOverlay card. The dial phase is now cancelable and hands off to the wake wait in one frame. - console (pf-console-ui): the connect/wake overlays become a full-screen aurora takeover (draw_takeover) instead of a centered card over a dim scrim; the Waking → Connecting handoff no longer blinks. - apple: new ConnectOverlay mirrors it (macOS / iOS / tvOS), replacing the per-tile connecting spinner + the WakeOverlay card; instant "Connecting…" from model.phase, and the carousel is gated inactive during the dial. Also enable Wake-on-LAN on iOS/tvOS now that the multicast entitlement is approved: enable com.apple.developer.networking.multicast and flip wakeOnLANAvailable to true on every platform (MACs were already learned from mDNS, so wake works immediately). Verified: Android compileDebugKotlin + screenshot renders; console clippy + 36 tests + rendered phases on Linux; Apple swift build + 121 tests + rendered phases. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 23:29:35 +02:00
enricobuehler	7cea893db5	feat(recovery): wire LTR-RFI loss recovery into every client ... Centralize the client-side loss-range detector in punktfunk-core so every embedder shares one implementation instead of re-deriving the wrapping frame-index arithmetic: - NativeClient::note_frame_index(frame_index) folds each received AU (in receive order) through RfiRecovery::observe, firing a throttled RFI request for the exact lost span [first_missing, frame_index-1] on a forward gap. A host that can RFI (AMD LTR / NVENC) re-references a known-good frame instead of paying a 20-40x IDR spike; the frames_dropped-driven keyframe path stays the backstop for when the recovery frame itself is lost. - Export request_rfi + note_frame_index over the C ABI (Apple client). - Call it from the Android (hw+sw pumps), Apple (StreamPump + Stage2Pipeline via PunktfunkConnection.noteFrameIndex), and Windows in-process pumps. Linux/Deck inherit it through pf-client-core's session pump. - Split the decision into a pure RfiRecovery::observe(frame_index, now) and add 8 unit tests: arming, contiguous runs, exact lost-range, single-frame drop, the 100ms throttle (burst-suppress then re-open), reorder stragglers, and u32 wraparound (contiguous + gap-range). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 19:11:01 +02:00
enricobuehler	73c911cae4	feat(rumble): host-authoritative self-terminating envelopes (0xCA v2) ... Rumble was level-triggered, unbounded state on a lossy channel: a non-zero level meant "buzz until further notice", healed only by the host re-sending state every 500 ms, and every client guessed when the host had died with its own magic timeout (SDL 1.5 s, Apple 1.6 s, Android up to 60 s). A lost stop, a reordered start, or a dead host could drone the motor for seconds. Make "stuck rumble" inexpressible on the wire. The 0xCA datagram grows a length-tolerant tail — [u8 seq][u16 ttl_ms] — so it self-terminates: the host authorizes a level for at most ttl_ms and renews it (~120 ms) while it holds, letting an abandoned one lapse client-side. seq is a per-pad wrapping reorder gate (reusing GamepadSnapshot::seq_newer) so a reordered stale start can't re-light a stopped motor. Decoders read the first 7 bytes as a plain level and ignore the tail, so no wire-version bump: an old client renders a new host's levels, and a new client falls back to its prior staleness heuristic against an old host (ttl = None). All four generation pairings render correctly. - core: encode_rumble_datagram_v2 / decode_rumble_envelope (datagram.rs); the client demux applies the seq gate then forwards (pad, low, high, Option<ttl>); next_rumble is unchanged (drops ttl), next_rumble_ttl keeps it; ABI adds punktfunk_connection_next_rumble2 + PUNKTFUNK_RUMBLE_NO_TTL, ABI_VERSION 4->5 (WIRE_VERSION unchanged — the tail is backward-compatible). - host (punktfunk1.rs): the flat 500 ms refresh becomes a renewal loop that bumps seq + stamps a fresh TTL on active pads and drains a short post-stop zero burst, then goes quiet. Hatches: PUNKTFUNK_RUMBLE_ENVELOPE=0 (legacy v1 + flat refresh, a bisect switch), PUNKTFUNK_RUMBLE_TTL_MS (clamped [150, 5000]). - renderers honor the TTL as their playback duration/deadline and keep their old heuristic only for a legacy (ttl=None) update: pf-client-core (the Deck haptic keep-alive is now deadline-bounded so it can't sustain a host-stopped rumble), clients/windows (SDL duration), android (JNI packs the lease out-of-band in bit 48 so any u16 ttl is unambiguous; Kotlin createOneShot(ttl)), apple (RumbleRenderer.envelopeDeadline + nextRumble2; sessionStaleSeconds demoted to the legacy fallback). - tests: codec round-trip + tail tolerance + seq-gate reorder (Rust); the probe asserts the v2 tail arrived under PUNKTFUNK_TEST_FEEDBACK; the Apple loopback asserts ttlMs round-trips end to end; RumbleTuning lease-decision cases. The host-side idle-timeout from the previous commit is defense in depth on the game side; this is the guarantee on the client side. Design: punktfunk-planning/design/rumble-envelope-plan.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-11 03:08:27 +02:00
enricobuehler	35d97ae6ac	feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3) ... design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security invariant preserved per-ring. - proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped before the magic; the driver publisher refuses a cross-bound ring via the shared, unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index validation applied to frames, invariant #10); the host's wait_for_attach surfaces the refusal loudly and self-checks its own stamp. - manager: the one-monitor MgrState becomes a slot map keyed by the client's identity slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts, slot-scoped begin_idd_setup (a different identity is an admission question, never a preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release. - group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in captures, last-out restores); desktop layout via CCD source origins from the pure layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure. - admission: the Windows separate→reject override now sits behind the PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone — a second identity gets its own monitor + ring; default flips in W5 after soak); max_displays and NVENC session-unit budgets decline an unaffordable display AT admission; kick_dwm_compose is process-globally throttled and per-display — cursor jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current state at the next vsync tick). On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean (no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed. V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up (the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1 recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's load-bearing unknown, answered yes. Also carries the client-HDR EDID forwarding that shared this working tree (Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block, PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-11 01:06:44 +02:00
enricobuehler	baa04d2d24	style: cargo fmt over the networking-audit changes ... rustfmt pass over the files the deferred-plan items touched (pinned toolchain 1.96.0); no semantic change. cargo fmt --all --check now clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:10:20 +02:00
enricobuehler	ddb93c533c	fix(core,android): networking-audit small follow-ups — bounds, oversized AUs, probe flag ... Networking-audit deferred plan §6: - 6.1 client reassembler ceiling derived from the negotiated rate: Welcome::session_config (client role) now sets max_frame_bytes to clamp(4 × bitrate_kbps×125 / refresh_hz, 8 MiB, 64 MiB) instead of the blanket 64 MiB p1_defaults bound — the hostile-header memory ceiling was ~10× larger than any real access unit. Local only (the host never reassembles video; the wire is self-describing); a bitrate-0 (older) host keeps the old bound. Unit-tested floor/derived/host/old-host cases. - 6.2 ProbeState.active is cleared when the host's ProbeResult lands, so the pump stops mirroring receive counters once the burst is over. - 6.3 Android: an AU larger than the codec input buffer is DROPPED with a recovery-keyframe request and a counter, on both the sync (feed) and async (feed_ready) paths — a truncated AU is corrupt input the decoder chews on silently, poisoning the reference chain until the next IDR. The async path recycles the never-queued input slot; the sync path returns the dequeued slot with zero valid bytes. - 6.4 bounded uplink channels: mic_tx at 64 (~320 ms of 5 ms frames; overflow sheds the fresh frame with a debug log — a tokio mpsc can't shed from the head, and past 320 ms of backlog the mic is broken either way; the bound is about memory) and ctrl_tx at 32 (sparse requests; a full queue means a wedged control task, reported as Closed). input_tx stays unbounded per the plan: keyboard/mouse events must never silently drop, and gamepad state is snapshot-healed. - 6.5 (wire version byte says P1 while streaming Gf16): record-only, resolves with the P2 packet revision. include/punktfunk_core.h: cbindgen re-emitted in the new module order after the quic/ split (item 3) — no semantic change beyond the reorder. cargo ndk check (arm64-v8a), workspace clippy, core+host tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:07:42 +02:00
enricobuehler	d4467a44e2	feat(core): mid-stream clock re-sync — live offset survives wall-clock steps and drift ... Networking-audit deferred plan §2. The host↔client offset was measured once at connect; an NTP step or slow drift silently corrupted the clock-based jump-to-live signal, the ABR one-way-delay signal, and every latency stat — 4a3b1ae2's disarm backstop stopped the IDR storm but lost the detector for the session. Now the client re-estimates mid-stream and recovers it. - quic: ClockResync — the connect-time 8-round probe/echo estimate as a select!-driven state machine (rounds matched by echoed t1, stale batches ignored), plus accept_resync (batch min-RTT ≤ max(2 ms, 1.5× connect RTT) so a congested window can never bias the offset). No wire change: the host has always answered ClockProbe at any time on the control stream. - client: the offset lives in an Arc<AtomicI64> seeded at connect; the control task re-probes every 60 s and immediately after the pump's FIRST no-op clock flush (the "clock stepped under me" signal, sent on the next report tick). On apply: store, reset stale_frames/noop_clock_flushes, re-arm the clock detector if a step had disarmed it. The disarm heuristic stays as the final backstop. Public NativeClient::clock_offset_ns keeps the connect-time value (ABI untouched); new clock_offset_now_ns() / clock_offset_shared() expose the live value. - consumers migrated to the live offset: pf-client-core session stats, the pf-presenter e2e stamp, Windows session/render, Android feeder/drain/ DisplayTracker (the tracker holds the shared handle, not the client, so the leaked render-callback refcount can't pin the session). - probe: --clock-resync runs a second full handshake mid-connection and asserts a sane, consistent estimate. Live against the local canary host: offsets 8646/2139 ns, disagreement 6 µs, 8/8 rounds — OK. Unit tests cover the round collection, stale-echo rejection, batch restart, min-RTT selection, and the acceptance guard. cargo ndk check green. Remaining manual validation: `sudo date -s "+2 sec"` on a live streaming client → expect one no-op flush, a re-sync, re-armed detector, no IDR pulse. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 15:45:12 +02:00
enricobuehler	6fbab53d56	feat(audio): libopus packet-loss concealment on the client audio plane ... The 0xC9 audio datagrams ride the lossy plane with no FEC, and no client ever consulted the per-packet sequence: a lost 5 ms Opus packet played out as a hard gap in the ring — an audible click/pop on every drop, i.e. constantly on the Wi-Fi links where video loss is already being FEC-absorbed. Now a shared `AudioGapTracker` (punktfunk-core::audio — pure data, wrap-safe, unit-tested incl. u32 wraparound / reorder / duplicate cases) tells the decoder how many packets went missing immediately before each received one, and both native clients (pf-client-core PipeWire path, Android AAudio path) synthesize that many frames of libopus packet-loss concealment first: `decode` with empty input (the opus crate maps it to a NULL data pointer = PLC), sized by the last real frame's sample count. Interpolated fade instead of a click. Bounds: a gap is capped at 10 packets (50 ms) — libopus PLC fades to silence after a few frames anyway, so past the cap the rings' existing underrun/re-prime path takes over. Reorders and duplicates conceal nothing (the plane has no reorder buffer; playing a late packet where it lands is the existing behaviour). In-band Opus FEC (LBRR) is deliberately NOT used: the host sends 5 ms frames and LBRR needs ≥10 ms frames to carry anything. The cap is a crate-private const so cbindgen keeps it out of the C ABI header. Host cargo tests + clippy green; android crate verified via cargo ndk check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 14:55:37 +02:00
enricobuehler	f5e5297a2a	style: cargo fmt — settle comment/assert layout the last two fixes left unformatted ... `cargo fmt --all --check` on main flags decode.rs (android dlsym fix), probe/main.rs (0600 key fix), and session.rs (anti-replay tests). The probe one is restructured rather than machine-formatted: rustfmt wanted the key- permissions comment gutter-aligned to the trailing `// the certificate is public` comment, so fold both into one block comment above the write instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 10:20:40 +02:00
enricobuehler	8fa12167af	fix(android): client loads again on Android < 13 — dlsym the API-33 render callback ... 0.9.0's HUD display stage hard-linked AMediaCodec_setOnFrameRenderedCallback via ndk-sys believing it API 26; the symbol is API 33 ("Available since Android T"). A cdylib links fine with the dangling import, so it only exploded at System.loadLibrary on every pre-13 device: UnsatisfiedLinkError, then every NativeBridge touch throws NoClassDefFoundError — surfacing as "Identity unavailable: io.unom.punktfunk.kit.NativeBridge", a dead pair button, and no discovery (reported on a Y700 / Android 12; 13+ devices unaffected). - decode::install_render_callback now dlsym-resolves the entry point from libmediandk.so, mirroring try_set_frame_rate; on API < 33 the HUD simply has no display stage (the pre-0.9.0 behaviour) and the .so loads. - New scripts/ci/check-android-jni-imports.sh, wired as checkJniImports* gradle tasks the APK build depends on: fails the build if libpunktfunk_android.so imports any symbol absent from the NDK's API-28 stubs — `--platform 28` never enforced this (cdylib links permit undefined symbols), despite the old comment's claim. Verified: 3 ABIs clean at the 28 floor, and the check flags the known API-28 symbols when pointed at a 27 floor. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 10:06:31 +02:00
enricobuehler	ef39050dbc	docs: repo-wide housekeeping — sync README & docs with the code as shipped ... Six parallel audits swept the root docs, docs-site, every per-directory README, and the packaging docs; every claim below was verified against the source before editing. - README: Layout gains the six missing crates (pf-client-core, pf-presenter, pf-console-ui, pf-ffvk, pf-driver-proto, punktfunk-tray), clients/session, api/ and ci/; Linux/Windows client rows reflect the shell + Vulkan-session split and the Vulkan Video -> VAAPI/D3D11VA -> software decode chains; the "every client over a C ABI" claim is corrected (Rust clients link the core directly); tiered stats overlay + console shell noted; Apple row mentions AV1. - CONTRIBUTING: drop the dead CLAUDE.md link (deliberately untracked); point at the README's build/invariants sections. SECURITY: 0.9.0. - host-cli/pairing: --allow-pairing/--require-pairing are no-op legacy names — pairing is required by default, --allow-tofu is the real flag; document --data-port and --idle-timeout-ms. - configuration: document PUNKTFUNK_RECOVER_SESSION_CMD (session-crash recovery hook), PUNKTFUNK_MDNS, PUNKTFUNK_DATA_PORT. - virtual-displays/gnome: GNOME per-client scaling shipped (host- persisted) — flip the ❌ to ✅ and describe how it works. - stats: new "Detail levels" section (Off/Compact/Normal/Detailed + per-platform cycle gestures); retire the GTK hand-off note. - clients/install-client/status/roadmap: decode chains, Windows client validation narrowed to HDR-only pending, adaptive bitrate, console shell, Apple AV1, Windows host vendor list. - Sub-READMEs: clients/linux rewritten for the re-architecture; session Windows decode rung + d3d11va knob; Windows tiered overlay; Android minSdk 28; decky file table; host zerocopy/ path; scripts port 47992 and steamos-host.md; pf-dualsense source path. - packaging: canary version bases are tag-derived (<next-minor> via pf-version.sh/.ps1), codecs-extra not ffmpeg-full, document the pinned offline-Skia tarball + SKIA_BINARIES_URL and vulkan-headers. - Convert 15 dangling design/*.md links to the punktfunk-planning prose convention (those docs live in the private planning repo). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 09:13:42 +02:00
enricobuehler	7b25868a19	fix(input): rock-solid held gamepad state — Android device pinning + seq'd snapshots ... Two causes behind one field report (a held trigger jittering mid-game, Android client → Windows host): Android folded joystick ACTION_MOVEs from EVERY device into one axis state. A controller's joystick-classified sibling node (DualSense/DS4 motion sensors) or a second/drifting pad reports every pad axis as 0, so a held trigger flapped value→0→value on each event interleave. The mapper now qualifies the source DEVICE (its source classes must include GAMEPAD — a joystick event's own source is always plain JOYSTICK), pins to one deviceId until that device disconnects, and merges LTRIGGER/BRAKE (and RTRIGGER/GAS) with max, the same fold as the Controllers probe. Underneath, gamepad input rode per-transition events over unreliable, unordered QUIC datagrams — no sequence numbers, sharing the 4 KiB oldest-first-shed send buffer — so one dropped or reordered event corrupted held pad state until the NEXT change. Gamepad state now travels the way rumble already does: idempotent state, refreshed. InputKind::GamepadState packs the whole pad + a wrapping u8 seq into the existing 18-byte layout; the host advertises HOST_CAP_GAMEPAD_STATE (Welcome trailing byte, offset 67) and applies snapshots through a per-pad stale-seq gate, skipping frame emits for unchanged refreshes; the client folds embedder events into snapshots inside NativeClient's input task (send on change + 100 ms refresh of touched pads), so the SDL clients (Linux/Windows/session), Android, and Apple (C ABI) are all covered with zero capture-code changes. Either end older ⇒ the legacy per-transition path runs unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 01:11:38 +02:00
enricobuehler	c86da1a1ff	chore(android): silence the two vendored-ndk warnings on every native build ... The vendored ndk 0.9.0 warned twice per Android build: an unnecessary `std::ptr::` qualification in input_queue.rs (the crate opts into unused_qualifications) and an unused `Result` import in media_format.rs — unused only because its sole consumers are #[cfg(feature = "api-level-29")] methods our default-feature build compiles out, so the import is now gated the same way (both feature configurations stay warning-free). Vendor-patch inventory in the workspace Cargo.toml updated to stay honest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 23:13:36 +02:00
enricobuehler	03a2fabff1	feat(clients/android): custom resolutions in both settings UIs ... The Settings model always carried arbitrary width/height (0 = native) end to end — only the two UIs' preset lists gated it. Mirror the Apple client's pattern: the touch Resolution dropdown gains a "Custom…" row revealing numeric W×H fields (seeded from the current effective size, coerced even on commit, capped at 8192 — the host's encode.rs stays the validation authority), and the gamepad screen surfaces a stored custom size as a leading "Custom · W × H" choice instead of silently snapping it to Native — a pad can keep a custom size, it just can't type one. Custom-ness is detected from the stored size itself (no persisted flag), so it can never disagree with what's saved. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 22:18:21 +02:00
enricobuehler	3952672873	fix(clients/android): 3-finger stats tap — re-anchor the scroll centroid on pointer-count changes ... The two-or-more-finger scroll path measured its centroid across a VARYING pointer count: real fingers never land (or lift) in the same input frame, so the 2→3 transition moved the centroid far past SCROLL_DIV, emitted a phantom wheel tick to the host, and set `moved` — which disqualified the not-moved tap classification and made the advertised 3-finger stats-cycle tap unreachable on real hardware (two-finger right-click survived only because its anchor never crossed a count change). Re-anchor whenever the finger count changes; genuine two-finger scrolling is measured between same-count frames exactly as before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 22:18:21 +02:00
enricobuehler	13d1aa5738	feat(clients/android): OnFrameRendered display stage — HUD headline becomes capture→displayed ... The long-deferred Android display stage (design/stats-unification.md; plan 4.1 of design/client-parity-and-network-resilience.md): AMediaCodec_setOnFrameRenderedCallback (API 26, under the minSdk-28 floor ⇒ hard-linked via ndk-sys) reports SurfaceFlinger's per-frame render timestamp, giving the HUD the spec's `display` = decoded→displayed term and the directly-measured capture→displayed end-to-end headline on both decode loops. Falls back per spec to the v1 capture→decoded endpoint on any window without render callbacks (the platform may drop them under load), and to it permanently if registration is refused. - The render timestamp arrives on CLOCK_MONOTONIC; it's re-based onto CLOCK_REALTIME against monotonic-now at callback time, which also cancels the (batchable) callback delivery lag. - The `ndk` crate exposes neither the callback nor the codec pointer needed to bind it raw, so the workspace pins `ndk` 0.9.0 to a vendored copy (clients/android/native/ vendor/ndk) whose ONLY change makes MediaCodec::as_ptr public — the "as_ptr patch". Workspace-excluded so host builds never compile it; drop when upstream exposes either. - nativeVideoStats grows to 26 doubles (22–25: dispValid, displayP50, e2eDispP50/P95; 0–21 unchanged for older readers); StatsOverlay moves headline endpoint + equation together so the equation always tiles the headline interval. Verified: host cargo check/test/clippy, aarch64-linux-android check/clippy, Kotlin app+kit+tests compile, roborazzi HUD render shows the full 4-term equation. Device verification rides plan 4.2's phone A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 11:35:16 +02:00
enricobuehler	01428ced58	feat(clients): reachability-probed presence + shareable Decky host management ... Add a bounded, trust-agnostic, mDNS-INDEPENDENT QUIC reachability probe and surface it everywhere saved-host presence is shown, so a host reached over a routed network (Tailscale/VPN/multicast-filtering LAN) no longer reads Offline just because it isn't advertising — the display-side companion to the 0.8.4 dial-first connect fix. Core: - punktfunk-core: NativeClient::probe (bounded handshake; a real host answers even on trust mismatch, a wrong/closed/TCP-only port fails) + punktfunk_probe C ABI (ABI_VERSION 3->4, header regenerated). - pf-client-core: trust::probe_reachable_many (parallel per-host sweep). Presence pips now read `advertising OR probed-reachable`, refreshed by a ~10-12s background sweep off the UI thread: - Linux (relm4): ui_hosts probed map + HostsMsg::Probed sweep. - Windows (windows-reactor): pf-probe worker -> HostsProps.probed. - Apple (SwiftUI): HostStore.refreshReachability, driven by HomeView + GamepadHomeView .task. - Android (Compose): nativeProbe JNI seam + periodic LaunchedEffect (LNP-gated), online dot added to the touch HostCard. - Decky already probes via --list-hosts --probe. Decky client: make the flatpak client's known-hosts store the single source of truth via new headless CLI modes (--list-hosts / --add-host / --set-host / --forget-host / --reset / --reachable). The plugin can now add a host by address, edit/forget hosts, reset all state (keeping the client identity), and shows probe-backed online pips — state is shared with the desktop client, not duplicated. Also lands in-progress Android 17 LNP groundwork (targetSdk 37 + ACCESS_LOCAL_NETWORK runtime flow, permission dialogs) that was already present in the working tree. Verified: cargo check + clippy clean (punktfunk-core, pf-client-core, linux, android native); android assembleDebug BUILD SUCCESSFUL; decky typecheck + rollup build clean; probe true/false-positive behaviour exercised against a live host. Windows and Apple were not compiled locally (no MSVC/Xcode on this Linux box). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-09 00:14:56 +02:00
enricobuehler	838a1239cf	feat(codec): make client codec selection real — GPU-aware native advertisement ... The clients' codec pickers sent a preference the host threw away: host_wire_caps() hardcoded HEVC for every GPU backend, so the native path never emitted H.264/AV1 regardless of what the user chose. Host: advertise what the backend actually encodes, mirroring the GameStream serverinfo logic — software openh264 emits H.264; probed backends (Linux VAAPI, Windows AMF/QSV) advertise their per-GPU CodecSupport via the new wire_mask(); NVENC keeps the Moonlight-validated H.264|HEVC|AV1 static superset; an empty probe falls back to the superset so auto clients still resolve HEVC. Gate 10-bit to HEVC (like the 4:4:4 gate) now that a client can steer the codec — Main10 is the only 10-bit encode path. Fix the web-console stats label hardcoded to "hevc" (new Codec::label(), shared with the GameStream register_session mapping). Android: replace the hardcoded H264|HEVC Hello advertisement with a videoCodecs param fed by VideoDecoders.decodableCodecBits() (AV1 bit only when a real hardware video/av01 decoder exists — the decode loop was already mime-driven); offer AV1 in the codec picker on capable devices. Decky: add the missing "Video codec" dropdown (auto/hevc/h264/av1) to the plugin settings, round-tripping the same codec key the flatpak client reads. Apple: unchanged by design (AnnexB.swift is NAL-only, AV1 is never advertised); refresh the stale "hosts don't emit AV1 on the native path yet" comments here and host-side. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 16:45:37 +02:00
enricobuehler	ab6790ef6c	fix(clients): dial-first reconnect — don't gate the connect on mDNS presence ... A saved host that stopped advertising on mDNS but has a learned Wake-on-LAN MAC was routed into a wake-and-WAIT-for-mDNS flow instead of being dialed. For a host reached over a routed network (Tailscale/VPN/another subnet) mDNS never sees it, so the wait could never succeed and reconnects were impossible — the host log showed no connection attempt at all. The tile's Offline pip and this connect gate shared the same LAN-only `advertises`/`liveAdvert` predicate, so a perfectly reachable host read as unreachable. The first connect worked only because the MAC hadn't been learned yet (a direct dial); once learned, every reconnect wedged in the waker. All four full clients carried this pattern (deliberate mirrors of the Apple `HostWaker`). Each now DIALS FIRST: fire the magic packet up front (fire-and-forget — harmless if the host is awake, and a genuinely-asleep box is booting while the dial times out) and attempt the connection unconditionally. Only a FAILED dial falls into the visible "Waking…" wait, whose redial carries no fallback so it can't loop. A fingerprint-mismatch/trust-rejection failure means the host ANSWERED, so it never takes the wake path. - apple: SessionModel.connect gains `onUnreachable`; startSession dials first. - linux (relm4): AppMsg::WakeConnect wakes+dials; a per-request wake_fallback is armed and consumed in SessionExited, matched by fingerprint/address. - windows: initiate_waking + ConnectOpts.wake_on_fail; the worker's Failed arm escalates to wake_and_connect only on a non-trust failure. - android: doConnectDirect gains onFailure; doConnect wakes+dials first. Decky was already correct (always launches `--connect`; WoL fire-and-forget). Explicit "Wake host" menu actions are unchanged — waiting on mDNS is right when the user explicitly asked to wake a box. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 14:17:01 +02:00
enricobuehler	4c9c7e606e	feat(android): tiered stats HUD + windowed lost/skipped/FEC counters ... Stats overlay verbosity tiers (Off/Compact/Normal/Detailed, 3-finger tap cycles live, old Boolean pref migrated) and the unified-spec line-4 reliability counters: lost/FEC windowed from the connector's cumulative totals, skipped from the client's own newest-wins drops. Adds the fec_recovered_shards accessor to NativeClient, mirrored from the data-plane pump like frames_dropped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 12:29:56 +02:00
enricobuehler	0ab97b597c	refactor(client): extract UI-agnostic plumbing into pf-client-core (phase 0) ... Session pump, FFmpeg decode, PipeWire audio, SDL3 gamepads, keymap, trust store, mDNS discovery, library client and Wake-on-LAN move verbatim from clients/linux into crates/pf-client-core, shared with the upcoming Vulkan session binary (punktfunk-planning: linux-client-rearchitecture.md). The GTK client re-exports them at the crate root so every existing crate::-path keeps resolving; its manifest drops the moved-only deps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:13:16 +02:00
enricobuehler	04302075b5	feat(android): promote the low-latency pipeline to default ... The async decode loop (burst-feed + present-newest-per-vsync, the Apple client's discipline) plus the per-SoC tuning was gated behind an experimental, default-off toggle after the 5dc24a0 overhaul regressed on some phones. That regression was the receive-side latency ratchet the async loop fed — a standing queue that only grew — now fixed in the shared core (FrameChannel jumps to live instead of accumulating it), so the fast pipeline is the default again. Default the master toggle on via a fresh pref key (low_latency_mode_v2), mirroring the migration da376b31 used to flip it off: a new key re-defaults every install — including ones persisted off under the old key — to on, so the promotion reaches users who had saved settings, not just fresh installs. Both stale keys are abandoned unread. Toggle-off still restores the original synchronous decode pipeline byte-for-byte as a per-device escape hatch. Drop "(experimental)" from the settings labels and fix the now-stale default-off wording in the native + Kotlin docs. No decode-path routing change — run_async is reached simply because the toggle now defaults on. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 16:18:40 +00:00
enricobuehler	17685ff73b	build(android): debug APKs ship release-profile rust ... Cargo's debug profile is not "slower" for this library — it is unusable, and it invalidated every on-device performance test to date: RustCrypto's AES-GCM compiles to generic-array iterator closures with per-byte precondition checks instead of ARMv8 hardware AES. Profiled live on a phone (simpleperf, 62k samples): ~800 µs of user CPU per 1.4 KB packet — the receive pump pinned above a full core yet only draining ~1,400 pkt/s of a 1,775 pkt/s (20 Mbps) stream, 2.3 MB standing in the kernel socket buffer, the latency-bound flush firing every 2 s forever. With release rust in the same debug APK: pump at ~12 % of a core, socket queue zero, no flushes, 2800x1260@120 streaming clean. preDebugBuild now depends on cargoNdkRelease; `-PrustDebug` opts back into a debug-profile native build for sessions that actually step through Rust. Kotlin debuggability is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	08ab2b6bee	fix(android): declare WAKE_LOCK — the stream's Wi-Fi locks never actually engaged ... WifiLock.acquire() enforces the WAKE_LOCK permission, which the manifest never declared — every acquisition since the first Wi-Fi lock shipped threw SecurityException, silently swallowed by a bare runCatching. The phone's own accounting proved it (dumpsys wifi: high_perf/low_latency active_time_ms = 0 across weeks of streams): every on-device session ran with Wi-Fi power save fully active, whatever the code intended. Verified live after the fix: both locks registered in WifiLockManager, mPowerSaveDisableRequests=2, ping RTT to the streaming phone 3.8 ms avg. A failed acquire now logs loudly — this class of failure must never be invisible again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	b271d0c816	fix(android): hold BOTH Wi-Fi locks while streaming — HIGH_PERF alone is a no-op ... The baseline stream held only WIFI_MODE_FULL_HIGH_PERF, which is deprecated AND non-functional on recent Android — so with the low-latency toggle off (the default) Wi-Fi power save stayed fully active: downlink delivery clumped at beacon intervals (a few hundred ms of latency mush, sawtoothing bitrate) and the AP's power-save buffer periodically overflowed, killing whole frames every few seconds (the host log's alternating loss_ppm=0/50000). Now every stream holds FULL_LOW_LATENCY (API 29+, the only effective power-save disable; foreground + screen-on, which a stream always is) AND FULL_HIGH_PERF (covers older releases) — the same pair Moonlight holds. The experimental toggle no longer selects the lock mode. Also: declare tracing's "log" feature explicitly in the native crate (core transport warnings → logcat must not hinge on quinn's default features), and align the low-latency toggle's copy with its actual scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	83b7c7adf5	feat(android): console UI — per-controller glyphs, dialog scrolling, animated forms ... - Hint-bar glyphs now wear the driving controller's family (kit Gamepad.styleFor by USB vendor id → MainActivity.lastPadStyle, kept live by real input like lastPadIsGamepad): PlayStation pads get Canvas-drawn cross/circle/square/triangle shapes in the classic colours, Nintendo pads monochrome lettering, Xbox/Valve/unknown the coloured letter discs. Hint chars stay semantic (KEYCODE_BUTTON names); only the rendering changes. - The Options legend renders the pad's real Select-family button (SelectButtonGlyph): Xbox View windows, PlayStation Create capsule, Nintendo minus — instead of a bare capsule outline. - GamepadDialog: body + action stack scroll together (title pinned) with BringIntoViewRequester keeping the focused button visible — a 5-action host options dialog compressed/clipped its last button in short landscape windows because the pinned stack could not scroll. - Console form polish: shared animateConsoleFocus (bg/border cross-fade + spring scale) across settings rows / add-host fields / action rows; ConsoleSwitch (spring knob, tinting track) replaces On/Off text on toggle rows; choice values slide in the direction they were stepped (AnimatedContent + SizeTransform) with chevrons that fade in place; the focused row's detail unfolds via AnimatedVisibility; dialog buttons and keyboard keycaps cross-fade (keycaps at 90 ms for hold-to-repeat). - Console settings gain the "Low-latency mode" (Video) and "Auto-wake on connect" (Interface) rows, round-tripping with the touch settings. - Screenshot scene: StatsOverlay call updated to the 18-double layout + the new decoderLabel parameter (fixes the android-screenshots CI compile). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	da376b3122	fix(android): gate the latency overhaul behind an experimental toggle, default off ... The 5dc24a0 low-latency overhaul regressed badly on some phones. Every piece of it — decoder ranking, per-SoC vendor keys, the async decode loop, pipeline thread boosts, the ADPF max-performance bias, game-tagged AAudio, DSCP marking, the Wi-Fi low-latency lock, HDMI ALLM and the forced TV mode switch — now rides the "Low-latency mode (experimental)" toggle, default OFF. Off restores the pre-overhaul pipeline byte-for-byte: the sync poll loop, the platform-default decoder, and the original format keys (standard low-latency + blind Qualcomm twin + priority=0 + operating-rate=MAX together). - New pref key (low_latency_mode_experimental): the old key shipped default-ON, so any install that ever saved settings persisted true — flipping the default under the old key would leave exactly the regressed devices stuck on. - DSCP is applied at socket creation, so the toggle reaches the transport via NativeBridge.nativeSetLowLatencyMode → transport::set_dscp_default, called in the connect choke point before nativeConnect; the core DSCP default reverts to off everywhere. - nativeStartAudio(handle, lowLatencyMode) gates AAudio usage=Game. - VideoDecoders.pickDecoder now skips `.secure` decoder twins and decoders that require FEATURE_SecurePlayback: they need a secure surface, and a secure twin could out-score its plain sibling (only it advertising FEATURE_LowLatency), which black-screens a clear stream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 20:18:59 +02:00
enricobuehler	b3c7ba5082	fix(android): auto-wake opt-out + console glyphs default by form factor ... An mDNS discovery miss was forcing connects through the Wake-on-LAN wait even for a host that's already up; add a Settings toggle ("Auto-wake on connect") that skips the mDNS-liveness gate and dials straight through when off. Also default the console UI's button glyphs by form factor instead of always starting in TV-remote style: a phone/tablet only ever enters the console UI via a real controller, so it should show gamepad glyphs from the first frame, not a remote's select/back glyphs. TV keeps the remote default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:56:31 +02:00
enricobuehler	959dd74dc8	feat(android): add higher bitrate options up to 500 Mbps ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 16:31:27 +00:00
enricobuehler	91fadce900	feat(clients): signal explicit exit (QUIT_CLOSE_CODE) on deliberate disconnect ... The core's deliberate-quit close (NativeClient::disconnect_quit → QUIT_CLOSE_CODE, host skips the keep-alive linger) was implemented but never called by any client. Wire it to each client's explicit user-disconnect action — NOT to a network drop / host-ended / app-background (those keep the linger for a reconnect): - core: new C-ABI punktfunk_connection_disconnect_quit(c) for the ABI clients - Linux (direct-core): Ctrl+Alt+Shift+D + the controller escape chord - Windows (direct-core): Ctrl+Alt+Shift+D - Apple (C-ABI): PunktfunkConnection.disconnectQuit() + a `deliberate` flag on SessionModel.disconnect() (sessionEnded passes false → keeps the linger) - Android (JNI): new nativeDisconnectQuit export, called from the back gesture + the Select+Start+L1+R1 chord (not the host-gone watchdog) - probe already did this via --quit (77871d6) Verified: core + Linux client + Android (cargo-ndk + gradle) build clean; Windows/Apple compile-checked by CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:37:45 +00:00
enricobuehler	f47d417f37	fix(android): launch games from the library ... The library browser was browse-only — the A button (and a tap) did nothing. Wire it to connect + boot straight into the selected title: thread a `launch` id (the store-qualified library id `steam:<appid>` / `custom:<id>`) through nativeConnect → NativeClient's Hello.launch (was hardcoded None), add a shared connectToHost() the ConnectScreen and the library launcher both use, and have LibraryScreen dial the host with launch=game.id on A / tap — with a launching overlay + an "A Launch" hint. Verified: native compiles (cargo-ndk arm64), app+kit Kotlin compiles (gradle, 3 ABIs). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 12:59:39 +00:00
enricobuehler	70e9570040	fix(android): pass dropped streams through to the ui	2026-07-06 12:14:40 +02:00
enricobuehler	5dc24a069f	perf(android): low-latency decode overhaul — vendor keys, async loop, system tuning ... Close the latency gap on the Android client with per-SoC decoder tuning, an event-driven decode loop, and full system integration. - Decoder selection: rank MediaCodecList decoders in Kotlin (hardware/vendor preferred, software avoided, FEATURE_LowLatency probed) and create the chosen one by name. Per-SoC low-latency keys gated on the codec-name prefix: Qualcomm picture-order + low-latency, Exynos (also Google Tensor), Amlogic, HiSilicon; MediaTek vdec-lowlatency set unconditionally. operating-rate = MAX (Qualcomm) vs priority = 0 (else) are mutually exclusive. NVIDIA/Rockchip/Realtek have no vendor key — covered by ranking + the standard low-latency key. - Async decode loop: AMediaCodec async-notify replaces the poll loop, presenting a decoded frame the instant it is ready instead of waiting out a poll interval. Behind USE_ASYNC_DECODE with the synchronous loop kept for A/B during bring-up. - System integration: Wi-Fi FULL_LOW_LATENCY lock and HDMI ALLM (setPreferMinimalPostProcessing) for the stream's lifetime; game_mode_config.xml opting out of OEM downscaling / FPS overrides. - Pipeline: boost the data-plane pump + audio thread priorities, AAudio usage=Game, DSCP marking on by default on Android, ADPF setPreferPowerEfficiency(false), and setFrameRateWithChangeStrategy(ALWAYS) to force the HDMI mode switch on TV. - lowLatencyMode master toggle (default on) as the escape hatch; the stats HUD now shows the resolved decoder name. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:25:16 +02:00
enricobuehler	3775a39e70	feat(android): console UI, wake-on-LAN wait-until-up, host edit + TV/tablet polish ... Bring the Android client to parity with Apple's gamepad experience and finish Wake-on-LAN. - Console/gamepad home: host carousel, aurora chrome, mTLS game-library coverflow, and an input-aware legend that switches between gamepad face buttons and a TV-remote select-ring + arrows based on the last-used input. - Wake-on-LAN: the fire-and-forget send is upgraded to wait-until-up (WakeController/WakeOverlay: resend + mDNS poll, 90s timeout, cancel/retry, fingerprint-matched so a host that cold-boots onto a new DHCP IP still connects), plus host edit (touch dialog + console form) with an auto-filled MAC. - Android TV: brand banner (android:banner), density-aware console scaling, D-pad/ remote nav (Up = Settings, Down or the pad Select button = host Options), emergency stream-exit chord, and 120Hz console refresh. - Touch UI: settings split into subpages with a tablet NavigationRail, axis-aware tab animation (horizontal on phones, vertical on the tablet rail), animated settings navigation, and a licenses screen with a back button + the real workspace version (read from Cargo.toml). - Vector Lock/controller icons (no emoji); bundled Geist font. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 20:05:17 +02:00
enricobuehler	7c230b97f8	fix(wol): clippy + cfg-gate the Windows client module — main compiles again ... The Wake-on-LAN batch landed with lints that fail `clippy -D warnings` (doc continuation, char-array split, io::Error::other, redundant closure) and an ungated `mod wol;` in the Windows client, which pulls windows-only crates into the non-Windows stub build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 12:02:45 +00:00
enricobuehler	3545febbeb	style: rustfmt the Wake-on-LAN modules ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:52:17 +02:00
enricobuehler	fb709d68ce	feat(clients): Wake-on-LAN in apple/linux/windows/android/decky ... Each client learns a host's MAC from the mDNS `mac` TXT while it's awake, persists it on the saved-host record, and — when reconnecting to an offline host — sends a magic packet before connecting, plus an explicit "Wake host" action. Apple wraps the C-ABI; linux/windows call the core fn directly (linux also gains a --wake CLI mode); android via a new nativeWakeOnLan JNI export (the mDNS browse record gains a 7th mac field); decky shells out to the linux client's --wake before launching the stream. iOS/tvOS need the managed com.apple.developer.networking.multicast entitlement (pending Apple approval), so the wake path + UI are gated off via PunktfunkConnection.wakeOnLANAvailable and the entitlement is commented out — keeping iOS/tvOS releasable. MAC-learning stays active on every platform so it lights up the moment it's ungated. macOS works today. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:39:44 +02:00
enricobuehler	d6dbce1dcc	feat(clients): host/network split in every stats HUD (stats phase 2, client side) ... Consumes the 0xCF host-timing plane (99cb8dd) on all four GUI clients: each keeps a bounded pending ring of receipt samples keyed by pts, matches the host's per-AU capture→sent reports against it, and the HUD equation becomes = host 3.1 + network 6.7 + decode 2.1 + display 2.3 falling back to the combined `= host+network …` term whenever no timing matched the window (old host / datagram loss) — same total, one split fewer, never a misleading zero. Apple additionally gains the split as the only equation line under the stage-1 fallback presenter (receipt is presenter-independent), a `nextHostTiming` wrapper with its own plane lock, and a unit-tested `HostNetworkSplitter`; Android extends the JNI stats array 16→18 doubles (0–15 unchanged); Windows/Linux thread the split through `Stats` into the HUD and the headless/debug logs. Docs updated: design/stats-unification.md Phase 2 → implemented (wire format, fallback semantics), and the docs-site matrix's Sunshine "Host processing latency" row is now a direct match (ours includes the paced send; avg vs p50). Verified here: linux client clippy -D warnings green on the live tree, windows stub check + hand-verified diff, android cargo-ndk arm64 check green, apple loopback test extended (needs the rebuilt xcframework + swift test on the mac). On-glass: pending on all platforms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:31:49 +00:00
enricobuehler	83460cd2c0	feat(clients): unified stats vocabulary across every client + Moonlight comparison docs ... One stat model everywhere (design/stats-unification.md): four measurement points (capture/received/decoded/displayed), three stages that tile the interval exactly, and a HUD that shows the addition explicitly — end-to-end 14.2 ms p50 · 19.8 p95 · capture→on-glass = host+network 9.8 + decode 2.1 + display 2.3 replacing each client's ad-hoc mix of overlapping absolutes (the Apple HUD's three arrow lines that looked sequential but weren't), mean-vs-median decode times (Windows/Linux), missing same-host-clock flags (Windows/Linux), and three different names for the same capture→received measurement (probe's "reassembled", Apple/Android's "client", Windows/Linux's post-decode "lat"). Per client: Apple threads receivedNs through the VT decode via the frame refcon bit pattern so the decode stage exists at all (stage-1 fallback honestly degrades to a capture→received headline); Windows carries FrameTimes through the existing frame channel to the render thread and adds e2e p50/p95 post-Present; Linux stamps received at AU pop and rides decoded_ns on DecodedFrame to the paintable-set site; Android pairs receipt stamps with MediaCodec output buffers via the codec's pts round-trip (JNI stats array 14→16 doubles, indexes 0-13 unchanged). fps now uniformly counts received AUs; lost/(received+lost) per window, hidden at zero. docs-site gains "Understanding the Stats Overlay": what each line means, why the equation only approximately sums (percentiles), and a line-by-line Moonlight/Sunshine matrix — including that Moonlight has no end-to-end number and its "network latency" is an ENet control RTT, so punktfunk's headline must not be compared against any single Moonlight line. Verified here: linux client + probe + core check/clippy/fmt green, android native cargo-ndk arm64 check green. Pending: Windows CI + on-glass, swift test on the mac, on-device Android. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:01:29 +00:00
enricobuehler	495646b676	feat(client/android): Snapdragon latency tuning — ADPF pipeline hints, game mode, max-clock decode ... Three levers to lower and steady decode latency on Snapdragon (Adreno) devices: - ADPF (Adaptive Performance Framework): a new dlsym-resolved hint session (native/src/adpf.rs; API-33+, resolved at runtime so there's no build-time link dependency and libpunktfunk_android.so still loads on API 31/32) tells the CPU governor the video pipeline runs a per-frame real-time workload, so it keeps those threads on fast cores at high clocks. It now covers all three latency-critical threads — the pf-decode feed/drain/present loop, the core data-plane pump (UDP receive + FEC reassembly), and the audio thread — via a new generic hot-thread registry on NativeClient (register_hot_thread / hot_thread_ids; the pump self-registers). The session is built lazily on the first presented frame, since ADPF createSession rejects a set containing any not-yet-live tid. - operating-rate -> Short.MAX ("as fast as possible"): pushes the Qualcomm decoder to run each frame at max clocks instead of merely sustaining the display rate at a power-saving clock that adds per-frame decode latency. - appCategory="game": makes the app eligible for OEM Game Mode / Game Dashboard performance profiles. The core registry is cross-platform (gettid on Linux/Android, a no-op elsewhere) — no Android-specific pollution of the shared core. Host workspace + 64 core tests green; Android arm64-v8a + x86_64 (platform 31) build + clippy clean. On-device Snapdragon validation pending. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 17:16:11 +00:00
enricobuehler	16a7991cea	fix(android/ci): retry transient Play API failures in play-upload.py ... The uploader only caught HTTPError — a URLError (TLS "EOF occurred in violation of protocol", the failure that dropped two release uploads on 2026-07-02) or a Google 5xx killed the job outright. Retry those with 3/9/27 s backoff; 4xx still fails fast. The edits API is transactional until commit, so re-sending is safe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 23:05:27 +00:00
enricobuehler	7e2d7c893c	feat(apple,android): three-way touch input — trackpad cursor (default), direct pointer, real multi-touch passthrough ... The two touch clients had exactly complementary gaps: iOS forwarded fingers ONLY as raw wire touches (no way to drive the host cursor from the touch screen), Android had the two mouse modes but no passthrough. Both now share one three-way "Touch input" setting: Trackpad (default) / Direct pointer / Touch passthrough. iOS/iPadOS: Input/TouchMouse.swift ports the Android gesture engine 1:1 (same px-based acceleration curve; tap=click, two-finger tap=right-click, two-finger drag=scroll, tap-then-drag=held drag, three-finger tap=stats HUD via the shared hudEnabled default); direct-pointer mode maps through the aspect-fit letterbox; the previous always-on behavior lives on as the passthrough option. The mode latches per gesture (a Settings change never splits one gesture across models), touchesCancelled releases held state without synthesizing a click, and session stop flushes a mid-drag button. Settings picker on iPhone + iPad next to the iPad-only pointer-capture toggle. Deliberate default change: trackpad, not passthrough. Android: new nativeSendTouch JNI shim → wire TouchDown/Move/Up (the host already injects real touch on every backend — libei touchscreen, wlroots, KWin fake-input, SendInput); streamTouchPassthrough forwards every finger with stable ids and lifts still-held contacts on teardown; the trackpadMode Boolean becomes the TouchMode enum (old pref migrated on load, never rewritten) with a Settings dropdown. Verified: macOS swift build + full suite (incl. new TouchMouseTests), iOS Simulator Swift compile, cargo check/fmt/clippy on the native crate, Kotlin app+kit compile + unit tests. On-glass feel of the iOS ballistics and Android passthrough against a touch-aware app still pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 00:02:12 +02:00
enricobuehler	ed6108215d	feat(android): connected-controllers debug view (Settings → Host) ... The client end of the "host doesn't see my gamepad" triage chain: a new ControllersScreen lists every InputDevice Android classifies as a gamepad/joystick (name, VID:PID, source classes, the punktfunk pad type it resolves to, rumble test) plus an "Other input devices" section — a pad behind a BT→USB adapter (the Pico 2W tester case) often enumerates with the adapter's identity or not as a gamepad at all, and this makes that visible on the device instead of over a bug report. A live input test (button chips + axis bars + raw last-keycode line) consumes pad events via new MainActivity probe hooks ahead of the focus-nav remap; hold B 1.2s to exit since the pad can't reach the toggle while captured. Gamepad grows pads()/isPad() (firstPad generalized). Kotlin compiles green (kit + app); on-device validation pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 16:33:56 +00:00