fix(encode): NVENC partial-init session leak + three backend-parity gaps

All four found in the pf-encode quality sweep and verified against source.

- NVENC partial-init leak (BOTH platforms, high): `init_session` publishes
  `self.encoder` — and on Windows charges LIVE_SESSION_UNITS — *before* its
  remaining fallible steps (bitstream buffers; on Linux also the input-surface
  alloc and `register_resource`). A failure there left a live session with
  `inited == false`, and every guard on the re-init path keys off `inited`, so
  the next submit skipped teardown and overwrote `self.encoder`: the session
  leaked permanently toward the driver's per-process cap, and its budget units
  never returned, progressively starving parallel-display admission. `teardown`
  already keys off `encoder.is_null()` rather than `inited`, so it cleans up
  exactly this half-built state — it just was never called. Now invoked on the
  `init_session` error path on both platforms.

- `can_encode_10bit` asked the wrong backend (medium): it resolved via
  `linux_auto_is_vaapi`, which ignores `encoder_pref`, while `can_encode_444`
  and `open_video` honour it. On a host that forces a backend (e.g.
  `encoder_pref = "vaapi"` on an NVIDIA box) the probe answered for NVENC while
  the session opened VAAPI, so the negotiated bit depth — and the HDR/SDR colour
  label derived from it — described a backend that never ran. Now uses the same
  `linux_zero_copy_is_vaapi` mirror, and `linux_auto_is_vaapi` carries a warning
  that it resolves the `auto` case only and is not a dispatch mirror.

- Linux software arm ignored SW_BITRATE_CEIL (low): the Windows arm clamped
  openh264 to 100 Mbps, the Linux arm passed the full negotiated rate. The
  constant is now module-scope so both arms share one value.

- QSV/AMF env-parity (low): `PUNKTFUNK_IR_PERIOD_FRAMES` was a no-op on QSV
  despite the comment claiming parity with AMF, and `PUNKTFUNK_NO_QSV_LTR` /
  `PUNKTFUNK_INTRA_REFRESH` had dropped AMF's `trim()` and `yes`/`on` spellings,
  so a value with stray whitespace silently did nothing on Intel while the same
  value worked on AMD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/flatpak.yml

@@ -73,34 +73,8 @@ jobs:
       # sufficient — the Tooling step's dnf install pulls a systemd package upgrade whose RPM
       # trigger re-runs authselect and regenerates this file, undoing the fix. It's reapplied
       # there, right before the first `flatpak` network call.
-      - name: Fix container DNS (drop nss-resolve, resolve over TCP)
-        run: |
-          sed -i 's/resolve \[!UNAVAIL=return\] //' /etc/nsswitch.conf
-          # Resolve over TCP instead of UDP. The documented root cause of the flathub
-          # bootstrap failures (investigated 2026-07-11, see the Tooling step) is this box's
-          # Docker embedded resolver at 127.0.0.11 DROPPING UDP lookups while the shared
-          # runner fleet is saturated — a datagram nobody retransmits, so the lookup just
-          # times out. The answer then was to widen retry.sh's budget to 10 attempts (~9 min),
-          # which is enough to outlast a main push's ~8-workflow fan-out but NOT a TAG push's
-          # 13: v0.15.0 (twice) and v0.16.0 each burned all 10 attempts and failed the job,
-          # each needing a manual re-run.
-          #
-          # `use-vc` makes glibc use TCP, where the kernel retransmits and the query cannot be
-          # silently lost under load. Same resolver, same search path — only the transport
-          # changes, so internal names (git.unom.io) resolve exactly as before; deliberately
-          # NO extra nameservers, which would risk answering an internal name from a public
-          # resolver. Docker's embedded DNS serves TCP on 127.0.0.11:53 as well as UDP.
-          # retry.sh stays as the backstop for genuine upstream blips.
-          #
-          # Non-fatal: Docker bind-mounts /etc/resolv.conf and can present it read-only, and a
-          # DNS tuning that cannot be applied must not be what fails the release build — that
-          # would trade an occasional re-run for a hard stop. Falling back to UDP just restores
-          # today's behaviour, which retry.sh already covers.
-          if ! grep -q '^options .*use-vc' /etc/resolv.conf 2>/dev/null; then
-            echo 'options use-vc timeout:3 attempts:3' >> /etc/resolv.conf \
-              || echo "::warning::could not set use-vc (read-only resolv.conf?); staying on UDP"
-          fi
-          cat /etc/resolv.conf || true
+      - name: Fix container DNS (drop nss-resolve — no systemd-resolved in CI)
+        run: sed -i 's/resolve \[!UNAVAIL=return\] //' /etc/nsswitch.conf
 
       # fedora:43 has no node, but actions/checkout (a JS action) needs it. A plain `run:` step
       # executes via the container shell (no node needed), so install node BEFORE checkout.

.gitea/workflows/plugin-kit-publish.yml

@@ -1,69 +0,0 @@
-# Publish the plugin framework (@punktfunk/plugin-kit) to the Gitea npm registry
-# (https://git.unom.io/api/packages/unom/npm/).
-#
-# Trigger: push a tag `plugin-kit-vX.Y.Z` (must equal plugin-kit/package.json "version"),
-# or run manually. Versions independently of the app's `v*` and the SDK's `sdk-v*` tags.
-#
-# The kit's devDependency on @punktfunk/host is `file:../sdk`, so the SDK's dist must be
-# built BEFORE the kit's `bun install` copies it.
-#
-# Auth: REGISTRY_TOKEN — the same repo Actions secret sdk-publish.yml uses.
-name: plugin-kit-publish
-
-on:
-  push:
-    tags: ['plugin-kit-v*']
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: ubuntu-24.04
-    container:
-      image: oven/bun:1
-    timeout-minutes: 15
-    steps:
-      # oven/bun's slim base ships neither git, a CA bundle, nor node — actions/checkout's HTTPS
-      # fetch needs git + ca-certificates, and the version-guard step below uses node.
-      - name: Install git + node + CA certs
-        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git nodejs
-
-      - uses: actions/checkout@v4
-
-      - name: Build the SDK (file:../sdk dependency source)
-        working-directory: sdk
-        run: |
-          bun install --frozen-lockfile --ignore-scripts
-          bun run build
-
-      - name: Install dependencies
-        working-directory: plugin-kit
-        run: bun install --frozen-lockfile --ignore-scripts
-
-      - name: Typecheck
-        working-directory: plugin-kit
-        run: bun run typecheck
-
-      - name: Test
-        working-directory: plugin-kit
-        run: bun test
-
-      - name: Build (dist/ JS + .d.ts + theme.css)
-        working-directory: plugin-kit
-        run: bun run build
-
-      - name: Tag matches package version
-        if: startsWith(github.ref, 'refs/tags/')
-        working-directory: plugin-kit
-        run: |
-          TAG="${GITHUB_REF_NAME#plugin-kit-v}"
-          PKG="$(node -p "require('./package.json').version")"
-          test "$TAG" = "$PKG" || { echo "tag $GITHUB_REF_NAME does not match package version $PKG"; exit 1; }
-
-      - name: Publish to Gitea registry
-        working-directory: plugin-kit
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          test -n "$NODE_AUTH_TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
-          printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$NODE_AUTH_TOKEN" >> .npmrc
-          bun publish

.gitea/workflows/release.yml

@@ -149,26 +149,6 @@ jobs:
           # inherits this from the env during the xcframework build).
           echo "CMAKE_POLICY_VERSION_MINIMUM=3.5" >> "$GITHUB_ENV"
 
-      - name: Pin + prune Xcode DerivedData
-        # Without -derivedDataPath, xcodebuild derives its DerivedData directory name from the
-        # PROJECT'S ABSOLUTE PATH — and act_runner rotates its workspace
-        # (~/.cache/act/<hash>/hostexecutor), so each rotation minted a brand new ~760 MB tree
-        # under ~/Library that nothing ever collected. 31 of them piled up in three days
-        # (~32 GB with the shared ModuleCache), filled the runner's boot volume, and failed
-        # v0.16.0's xcframework build with "No space left on device". Pinning one path makes the
-        # tree REUSED instead of multiplied — it also keeps the module cache warm between runs.
-        run: |
-          DD="$HOME/ci/derived-data/release"
-          mkdir -p "$DD"
-          echo "DERIVED_DATA=$DD" >> "$GITHUB_ENV"
-          # Safety net for trees the pin does not own: the legacy per-path ones from before this
-          # change, and anything another job leaves in the default root. Untouched for a week ⇒ gone.
-          if [ -d "$HOME/Library/Developer/Xcode/DerivedData" ]; then
-            find "$HOME/Library/Developer/Xcode/DerivedData" -mindepth 1 -maxdepth 1 \
-              -mtime +7 -exec rm -rf {} + 2>/dev/null || true
-          fi
-          echo "disk after prune:"; df -h /System/Volumes/Data | tail -1
-
       - name: Build PunktfunkCore.xcframework (mac + iOS + tvOS)
         # tvOS is a tier-3 target (nightly -Zbuild-std): slow on the first build, then cached on
         # the self-hosted runner. Built on canary too so the tvOS archive/upload below runs on the
@@ -196,7 +176,6 @@ jobs:
             -project "$PROJECT" -scheme Punktfunk \
             -destination 'generic/platform=macOS' \
             -archivePath "$RUNNER_TEMP/Punktfunk-macos.xcarchive" \
-            -derivedDataPath "$DERIVED_DATA" \
             -skipMacroValidation -skipPackagePluginValidation \
             MARKETING_VERSION="$VERSION" CURRENT_PROJECT_VERSION="$BUILD_NUM" \
             CODE_SIGNING_ALLOWED=NO
@@ -294,7 +273,6 @@ jobs:
             -project "$PROJECT" -scheme Punktfunk \
             -destination 'generic/platform=macOS' \
             -archivePath "$RUNNER_TEMP/Punktfunk-macos-appstore.xcarchive" \
-            -derivedDataPath "$DERIVED_DATA" \
             -skipMacroValidation -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             -authenticationKeyPath "$RUNNER_TEMP/asc.p8" \
@@ -358,7 +336,6 @@ jobs:
             -project "$PROJECT" -scheme Punktfunk-iOS \
             -destination 'generic/platform=iOS' \
             -archivePath "$RUNNER_TEMP/Punktfunk-ios.xcarchive" \
-            -derivedDataPath "$DERIVED_DATA" \
             -skipMacroValidation -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             -authenticationKeyPath "$RUNNER_TEMP/asc.p8" \
@@ -417,7 +394,6 @@ jobs:
             -project "$PROJECT" -scheme Punktfunk-tvOS \
             -destination 'generic/platform=tvOS' \
             -archivePath "$RUNNER_TEMP/Punktfunk-tvos.xcarchive" \
-            -derivedDataPath "$DERIVED_DATA" \
             -skipMacroValidation -skipPackagePluginValidation \
             -allowProvisioningUpdates \
             -authenticationKeyPath "$RUNNER_TEMP/asc.p8" \

Cargo.lock

@@ -2159,7 +2159,7 @@ dependencies = [
 
 [[package]]
 name = "latency-probe"
-version = "0.17.0"
+version = "0.15.0"
 
 [[package]]
 name = "lazy_static"
@@ -2264,7 +2264,7 @@ dependencies = [
 
 [[package]]
 name = "libvpl-sys"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "bindgen",
  "cmake",
@@ -2299,7 +2299,7 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "loss-harness"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "punktfunk-core",
 ]
@@ -2788,7 +2788,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pf-capture"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -2808,7 +2808,7 @@ dependencies = [
 
 [[package]]
 name = "pf-client-core"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -2832,7 +2832,7 @@ dependencies = [
 
 [[package]]
 name = "pf-clipboard"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -2850,7 +2850,7 @@ dependencies = [
 
 [[package]]
 name = "pf-console-ui"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -2871,7 +2871,7 @@ dependencies = [
 
 [[package]]
 name = "pf-encode"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -2894,7 +2894,7 @@ dependencies = [
 
 [[package]]
 name = "pf-ffvk"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "ash",
  "bindgen",
@@ -2903,7 +2903,7 @@ dependencies = [
 
 [[package]]
 name = "pf-frame"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "libc",
@@ -2915,7 +2915,7 @@ dependencies = [
 
 [[package]]
 name = "pf-gpu"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "pf-host-config",
@@ -2929,11 +2929,11 @@ dependencies = [
 
 [[package]]
 name = "pf-host-config"
-version = "0.17.0"
+version = "0.15.0"
 
 [[package]]
 name = "pf-inject"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -2961,14 +2961,14 @@ dependencies = [
 
 [[package]]
 name = "pf-paths"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "tracing",
 ]
 
 [[package]]
 name = "pf-presenter"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -2983,7 +2983,7 @@ dependencies = [
 
 [[package]]
 name = "pf-vdisplay"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -3013,7 +3013,7 @@ dependencies = [
 
 [[package]]
 name = "pf-win-display"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "pf-paths",
@@ -3025,7 +3025,7 @@ dependencies = [
 
 [[package]]
 name = "pf-zerocopy"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -3221,7 +3221,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-android"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "android_logger",
  "jni",
@@ -3237,7 +3237,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-linux"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3253,7 +3253,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-session"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "pf-client-core",
@@ -3268,7 +3268,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-windows"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "async-channel",
  "ffmpeg-next",
@@ -3287,7 +3287,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-core"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "aes-gcm",
  "bytes",
@@ -3318,7 +3318,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-host"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -3363,13 +3363,11 @@ dependencies = [
  "rand 0.8.6",
  "rcgen",
  "reis",
- "ring",
  "roxmltree",
  "rsa",
  "rusqlite",
  "rustls",
  "rusty_enet",
- "semver",
  "serde",
  "serde_json",
  "sha2",
@@ -3402,7 +3400,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-probe"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "mdns-sd",
@@ -3416,7 +3414,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-tray"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "ksni",
@@ -3439,7 +3437,7 @@ checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
 
 [[package]]
 name = "pyrowave-sys"
-version = "0.17.0"
+version = "0.15.0"
 dependencies = [
  "bindgen",
  "cmake",

Cargo.toml

@@ -48,7 +48,7 @@ exclude = [
 ndk = { path = "clients/android/native/vendor/ndk" }
 
 [workspace.package]
-version = "0.17.0"
+version = "0.15.0"
 edition = "2021"
 rust-version = "1.82"
 license = "MIT OR Apache-2.0"

clients/android/native/src/decode/async_loop.rs

@@ -404,14 +404,7 @@ fn feeder_loop(
                 // stage is consumed: the HUD, or the ABR decode signal (`measure_decode`). The
                 // HUD-only `received` point + host/network split stay gated on the overlay.
                 if stats.enabled() || measure_decode {
-                    // Core reassembly-completion stamp (ABI v9), NOT the pull instant: stamping
-                    // here would fold the hand-off queue wait into the network latency figure
-                    // (a client-side standing backlog masquerading as network). 0 = older core.
-                    let received_ns = if frame.received_ns > 0 {
-                        frame.received_ns as i128
-                    } else {
-                        now_realtime_ns()
-                    };
+                    let received_ns = now_realtime_ns();
                     {
                         let mut g = in_flight
                             .lock()

clients/android/native/src/decode/sync_loop.rs

@@ -221,13 +221,7 @@ pub(super) fn run_sync(
                     // samplers (`received` point, host/network split) stay gated on the overlay so
                     // the hidden steady state adds only a wall-clock read + the receipt push.
                     if stats.enabled() || measure_decode {
-                        // Core reassembly-completion stamp (ABI v9), not the pull instant — see
-                        // async_loop: a pull stamp folds hand-off queue wait into "network".
-                        let received_ns = if frame.received_ns > 0 {
-                            frame.received_ns as i128
-                        } else {
-                            now_realtime_ns()
-                        };
+                        let received_ns = now_realtime_ns();
                         in_flight.push_back((frame.pts_ns / 1000, received_ns));
                         if in_flight.len() > IN_FLIGHT_CAP {
                             in_flight.pop_front(); // stale — codec never echoed it back

clients/apple/Sources/PunktfunkClient/ContentView.swift

@@ -579,21 +579,13 @@ struct ContentView: View {
                         model?.disconnect() // the captured-state ⌃⌥⇧D combo
                     },
                     onFrame: { [meter = model.meter, latency = model.latency,
-                                split = model.latencySplit, queue = model.clientQueue,
-                                offset = conn.clockOffsetNs] au in
+                                split = model.latencySplit, offset = conn.clockOffsetNs] au in
                         meter.note(byteCount: au.data.count)
                         latency.record(ptsNs: au.ptsNs, offsetNs: offset)
                         // The same receipt, keyed by pts, awaiting its 0xCF host timing (the
-                        // host/network split — drained by the 1 s stats tick). receivedNs is
-                        // the core's reassembly stamp (ABI v9), so the split's network term no
-                        // longer contains the client-queue wait...
+                        // host/network split — drained by the 1 s stats tick).
                         split.recordReceipt(
                             ptsNs: au.ptsNs, receivedNs: au.receivedNs, offsetNs: offset)
-                        // ...which is measured as its own term instead (receipt→pull, both
-                        // client-local).
-                        queue.record(
-                            ptsNs: UInt64(bitPattern: au.receivedNs), atNs: au.pulledNs,
-                            offsetNs: 0)
                     },
                     onSessionEnd: { [weak model] in
                         Task { @MainActor in model?.sessionEnded() }

clients/apple/Sources/PunktfunkClient/Session/SessionModel.swift

@@ -102,12 +102,6 @@ final class SessionModel: ObservableObject {
     @Published var decodeValid = false
     @Published var displayP50Ms = 0.0
     @Published var displayValid = false
-    /// Client-queue wait: core reassembly receipt → the pump's pull (`AccessUnit.pulledNs −
-    /// receivedNs`, ABI v9 receipt split — the 2026-07 two-pair investigation). ~0 on a healthy
-    /// stream; a persistent value is a client-side standing backlog that used to hide inside
-    /// "network". Shown in the detailed tier only when it says something (≥ ~2 ms).
-    @Published var clientQueueP50Ms = 0.0
-    @Published var clientQueueValid = false
     /// The measured OS present floor (design/apple-presentation-rebuild.md): the deadline
     /// engine's vend→glass pipeline depth — an OS property no client can pace under (~2 refresh
     /// intervals composited; would read ~1 under direct-to-display). The HUD subtracts it from
@@ -153,9 +147,6 @@ final class SessionModel: ObservableObject {
     let endToEnd = LatencyMeter()
     let decodeStage = LatencyMeter()
     let displayStage = LatencyMeter()
-    /// Client-queue sampler (see `clientQueueP50Ms`) — fed per AU by the stream view's onFrame,
-    /// drained by the same 1 s tick as the stage meters.
-    let clientQueue = LatencyMeter()
     /// The OS present floor sampler (see `osFloorP50Ms`) — fed one sample per display-link
     /// update by the deadline engine, drained by the same 1 s tick as the stage meters.
     let presentFloor = LatencyMeter()
@@ -498,7 +489,6 @@ final class SessionModel: ObservableObject {
         endToEndValid = false
         decodeValid = false
         displayValid = false
-        clientQueueValid = false
         osFloorValid = false
         lostFrames = 0
         lostPct = 0
@@ -689,12 +679,6 @@ final class SessionModel: ObservableObject {
                 } else {
                     self.osFloorValid = false
                 }
-                if let q = self.clientQueue.drain() {
-                    self.clientQueueP50Ms = q.p50Ms
-                    self.clientQueueValid = true
-                } else {
-                    self.clientQueueValid = false
-                }
                 // Mirror the window to the unified log (see statsLog) — one line per second,
                 // stages in ms, only while frames actually flowed. `fps` counts RECEIVED AUs;
                 // `presents` counts frames that reached glass (the display meter's sample count)
@@ -707,7 +691,7 @@ final class SessionModel: ObservableObject {
                     let line = String(
                         format: "fps=%d presents=%d e2e_p50=%.1f e2e_p95=%.1f hostnet_p50=%.1f "
                             + "decode_p50=%.1f display_p50=%.1f lost=%d "
-                            + "floor_p50=%.1f display_adj=%.1f e2e_adj=%.1f queue_p50=%.1f",
+                            + "floor_p50=%.1f display_adj=%.1f e2e_adj=%.1f",
                         frames,
                         displayWindow?.count ?? 0,
                         self.endToEndValid ? self.endToEndP50Ms : -1,
@@ -718,8 +702,7 @@ final class SessionModel: ObservableObject {
                         lost,
                         self.osFloorValid ? self.osFloorP50Ms : -1,
                         self.displayValid ? self.displayAdjP50Ms : -1,
-                        self.endToEndValid ? self.endToEndAdjP50Ms : -1,
-                        self.clientQueueValid ? self.clientQueueP50Ms : -1)
+                        self.endToEndValid ? self.endToEndAdjP50Ms : -1)
                     statsLog.info("\(line, privacy: .public)")
                 }
             }

clients/apple/Sources/PunktfunkClient/Session/StreamHUDView.swift

@@ -118,16 +118,6 @@ struct StreamHUDView: View {
                             .font(.system(.caption2, design: .monospaced))
                             .foregroundStyle(.tertiary)
                     }
-                    // Client-queue wait (reassembly receipt → decode pull, ABI v9 split): ~0 on
-                    // a healthy stream and hidden as noise; shown from 2 ms — a persistent value
-                    // is a client-side standing backlog that pre-split builds displayed as
-                    // "network" (the 2026-07 two-pair plateau). The core's standing-latency
-                    // bleed logs alongside when it acts on the same state.
-                    if model.clientQueueValid && model.clientQueueP50Ms >= 2 {
-                        Text("client queue +\(model.clientQueueP50Ms, specifier: "%.1f") (receive backlog — standing if it persists)")
-                            .font(.system(.caption2, design: .monospaced))
-                            .foregroundStyle(.tertiary)
-                    }
                 }
             } else if model.hostNetworkValid {
                 // Stage-1 fallback presenter: the layer decodes + presents internally with no

clients/apple/Sources/PunktfunkKit/Connection/PunktfunkConnection.swift

@@ -35,31 +35,10 @@ public struct AccessUnit: Sendable {
     public let ptsNs: UInt64
     public let frameIndex: UInt32
     public let flags: UInt32
-    /// Client `CLOCK_REALTIME` instant the AU finished reassembly in the core (post-FEC,
-    /// decrypted — `PunktfunkFrame.received_ns`, ABI v9) — the **received** measurement point of
-    /// design/stats-unification.md. NOT the pull instant: stamping at the pull folded the
-    /// pre-decode hand-off wait into the network term, which is how the 2026-07 two-pair
-    /// standing-latency plateau hid as "network". The decode stage is `decodedNs - receivedNs`,
-    /// both client-local (no skew offset applies).
+    /// Client `CLOCK_REALTIME` instant the AU was handed over by the core (post-FEC, decrypted)
+    /// — the **received** measurement point of design/stats-unification.md. The decode stage is
+    /// `decodedNs - receivedNs`, both client-local (no skew offset applies).
     public let receivedNs: Int64
-    /// Client `CLOCK_REALTIME` instant this pull returned. `pulledNs - receivedNs` is the
-    /// client-queue wait (kernel hand-off + FrameChannel dwell) — the term the HUD splits out
-    /// so a client-side standing backlog can never masquerade as network latency again.
-    public let pulledNs: Int64
-
-    /// `pulledNs` defaults to `receivedNs` (zero queue wait) for callers with no pull instant —
-    /// the synthetic probe AUs and decode tests, where the split is meaningless.
-    public init(
-        data: Data, ptsNs: UInt64, frameIndex: UInt32, flags: UInt32,
-        receivedNs: Int64, pulledNs: Int64? = nil
-    ) {
-        self.data = data
-        self.ptsNs = ptsNs
-        self.frameIndex = frameIndex
-        self.flags = flags
-        self.receivedNs = receivedNs
-        self.pulledNs = pulledNs ?? receivedNs
-    }
 }
 
 /// One Opus audio packet (48 kHz stereo, 5 ms frames) — decode with AVAudioConverter
@@ -683,16 +662,11 @@ public final class PunktfunkConnection {
             let data = Data(bytes: base, count: Int(frame.len)) // copy: ptr valid only until next call
             var ts = timespec()
             clock_gettime(CLOCK_REALTIME, &ts)
-            let pulledNs = Int64(ts.tv_sec) * 1_000_000_000 + Int64(ts.tv_nsec)
-            // Receipt = the core's reassembly-completion stamp (ABI v9); the pull instant is
-            // kept separately so the client-queue wait is its own measured term. 0 would mean a
-            // pre-v9 core — impossible here (core and Kit ship in one binary), but fall back to
-            // the pull instant rather than record a 1970 receipt.
-            let receivedNs = frame.received_ns > 0 ? Int64(frame.received_ns) : pulledNs
+            let receivedNs = Int64(ts.tv_sec) * 1_000_000_000 + Int64(ts.tv_nsec)
             return AccessUnit(
                 data: data, ptsNs: frame.pts_ns,
                 frameIndex: frame.frame_index, flags: frame.flags,
-                receivedNs: receivedNs, pulledNs: pulledNs)
+                receivedNs: receivedNs)
         case statusNoFrame:
             return nil
         case statusClosed:

clients/apple/Sources/PunktfunkKit/Video/Stage2Pipeline.swift

@@ -1213,9 +1213,7 @@ public final class Stage2Pipeline {
                         let chunkAligned =
                             au.flags & PunktfunkConnection.userFlagChunkAligned != 0
                         let ptsNs = au.ptsNs
-                        // Decode stage starts at the PULL (matching the VT path's FrameContext —
-                        // receipt→pull is the HUD's separate client-queue term, ABI v9 split).
-                        let receivedNs = au.pulledNs
+                        let receivedNs = au.receivedNs
                         let flags = au.flags
                         let submitted = decoder.decode(
                             au: au.data, chunkAligned: chunkAligned, windowSize: windowSize

clients/apple/Sources/PunktfunkKit/Video/VideoDecoder.swift

@@ -32,12 +32,9 @@ public enum ReadyImage: @unchecked Sendable {
 public struct ReadyFrame: @unchecked Sendable {
     /// Host capture clock (the AU's pts), in nanoseconds.
     public let ptsNs: UInt64
-    /// Client `CLOCK_REALTIME` instant the AU left `nextAU` (`AccessUnit.pulledNs`, threaded
-    /// through the decode via the frame refcon), in nanoseconds — the decode stage's start
-    /// point. (Named for its historical role; since the ABI v9 receipt split the true
-    /// reassembly receipt lives on `AccessUnit.receivedNs`, and receipt→pull is the HUD's own
-    /// client-queue term.) 0 when unknown (a caller that didn't stamp) — the decode-stage meter
-    /// then drops the sample via its sanity guard.
+    /// Client `CLOCK_REALTIME` instant the AU was received (`AccessUnit.receivedNs`, threaded
+    /// through the decode via the frame refcon), in nanoseconds. 0 when unknown (a caller that
+    /// didn't stamp receipt) — the decode-stage meter then drops the sample via its sanity guard.
     public let receivedNs: Int64
     /// Client `CLOCK_REALTIME` instant decode completed, in nanoseconds.
     public let decodedNs: Int64
@@ -170,11 +167,7 @@ public final class VideoDecoder: @unchecked Sendable {
         var infoOut = VTDecodeInfoFlags()
         // The AU's receipt instant + wire flags ride through as a retained context; the output
         // callback reclaims it. Retain immediately before submit so no early return can leak it.
-        // The decode stage starts at the PULL (the AU leaving nextAU), not the reassembly
-        // receipt: both consumers — the decode-stage meter and the ABR decode signal — are
-        // specified from the pull, and the receipt→pull wait is the HUD's separate client-queue
-        // term (see AccessUnit.pulledNs).
-        let ctx = FrameContext(receivedNs: au.pulledNs, flags: au.flags)
+        let ctx = FrameContext(receivedNs: au.receivedNs, flags: au.flags)
         let refcon = Unmanaged.passRetained(ctx).toOpaque()
         let status = VTDecompressionSessionDecodeFrame(
             session,

clients/linux/src/ui_settings.rs

@@ -856,15 +856,7 @@ pub fn show(
         s.render_scale =
             RENDER_SCALES[(scale_row.selected() as usize).min(RENDER_SCALES.len() - 1)];
         s.bitrate_kbps = (bitrate_row.value() * 1000.0) as u32;
-        // Keep a stored preference this table doesn't list (e.g. "switchpro" — valid to the
-        // session, hand-edited or written by another client): it displays as "Automatic", and
-        // writing that back would silently erase it just by opening + closing the dialog.
-        // Persist the row only when the user picked a non-Auto entry or the stored value was
-        // a listed one to begin with.
-        let pad_sel = (pad_row.selected() as usize).min(GAMEPADS.len() - 1);
-        if pad_sel != 0 || GAMEPADS.contains(&s.gamepad.as_str()) {
-            s.gamepad = GAMEPADS[pad_sel].to_string();
-        }
+        s.gamepad = GAMEPADS[(pad_row.selected() as usize).min(GAMEPADS.len() - 1)].to_string();
         s.touch_mode =
             TOUCH_MODES[(touch_row.selected() as usize).min(TOUCH_MODES.len() - 1)].to_string();
         s.forward_pad = chosen_pin.borrow().clone();

clients/probe/src/main.rs

@@ -458,11 +458,7 @@ async fn session(args: Args) -> Result<()> {
         ),
         (None, None) => tracing::info!(%remote, "punktfunk/1 connected"),
     }
-    let (mut send, recv) = conn.open_bi().await.context("open control stream")?;
-    // Frame every read on the control stream through the resumable reader, exactly as the client
-    // pump does: `clock_sync` bounds each read with a timeout, and a frame straddling two wakeups
-    // would otherwise leave the stream permanently misaligned for the rest of the run.
-    let mut recv = io::MsgReader::new(recv);
+    let (mut send, mut recv) = conn.open_bi().await.context("open control stream")?;
 
     io::write_msg(
         &mut send,
@@ -487,11 +483,8 @@ async fn session(args: Args) -> Result<()> {
                 // host/network split is exactly what it exists to report. Old hosts ignore the bit.
                 // PROBE_SEQ: the shared-core reassembler windows probe-space frames, so the probe
                 // qualifies for `--speed-test` bursts; without the bit the host declines them.
-                // STREAMED_AU: the same shared reassembler accepts sentinel-headed streamed
-                // blocks, and the probe is exactly the tool that measures the overlap win.
                 let mut caps = punktfunk_core::quic::VIDEO_CAP_HOST_TIMING
-                    | punktfunk_core::quic::VIDEO_CAP_PROBE_SEQ
-                    | punktfunk_core::quic::VIDEO_CAP_STREAMED_AU;
+                    | punktfunk_core::quic::VIDEO_CAP_PROBE_SEQ;
                 if std::env::var_os("PUNKTFUNK_CLIENT_10BIT").is_some() {
                     caps |= punktfunk_core::quic::VIDEO_CAP_10BIT;
                 }
@@ -520,8 +513,8 @@ async fn session(args: Args) -> Result<()> {
         .encode(),
     )
     .await?;
-    let welcome =
-        Welcome::decode(&recv.read_msg().await?).map_err(|e| anyhow!("Welcome decode: {e:?}"))?;
+    let welcome = Welcome::decode(&io::read_msg(&mut recv).await?)
+        .map_err(|e| anyhow!("Welcome decode: {e:?}"))?;
     tracing::info!(
         mode = ?welcome.mode,
         fec = ?welcome.fec,
@@ -636,7 +629,10 @@ async fn session(args: Args) -> Result<()> {
                 tracing::error!("Reconfigure write failed");
                 return;
             }
-            match rr.read_msg().await.map(|b| Reconfigured::decode(&b)) {
+            match io::read_msg(&mut rr)
+                .await
+                .map(|b| Reconfigured::decode(&b))
+            {
                 Ok(Ok(ack)) if ack.accepted => {
                     tracing::info!(mode = ?ack.mode, "mode switch ACCEPTED")
                 }
@@ -689,7 +685,10 @@ async fn session(args: Args) -> Result<()> {
                         tracing::error!("SetBitrate write failed");
                         return;
                     }
-                    match rr.read_msg().await.map(|b| BitrateChanged::decode(&b)) {
+                    match io::read_msg(&mut rr)
+                        .await
+                        .map(|b| BitrateChanged::decode(&b))
+                    {
                         Ok(Ok(ack)) => tracing::info!(
                             applied_kbps = ack.bitrate_kbps,
                             "BITRATE CHANGE acked by host"
@@ -751,7 +750,7 @@ async fn session(args: Args) -> Result<()> {
                 tracing::error!("ProbeRequest write failed");
                 return;
             }
-            let res = match sr.read_msg().await.map(|b| ProbeResult::decode(&b)) {
+            let res = match io::read_msg(&mut sr).await.map(|b| ProbeResult::decode(&b)) {
                 Ok(Ok(r)) => r,
                 other => {
                     tracing::error!(?other, "bad ProbeResult");

clients/session/Cargo.toml

@@ -27,13 +27,9 @@ ui = ["dep:pf-console-ui", "dep:serde_json"]
 # Same Linux+Windows gating as the rest of the client stack; elsewhere this is a stub
 # binary.
 [target.'cfg(any(target_os = "linux", windows))'.dependencies]
-# `default-features = false` on both: THIS crate's `pyrowave` feature (above) is the single
-# switch that turns the wavelet codec on, and it enables it explicitly on each. Inheriting their
-# defaults instead would make `--no-default-features` a lie — the Windows ARM64 leg builds that
-# way precisely to skip the vendored PyroWave C++, which has no ARM64 SIMD path.
-pf-presenter = { path = "../../crates/pf-presenter", default-features = false }
+pf-presenter = { path = "../../crates/pf-presenter" }
 pf-console-ui = { path = "../../crates/pf-console-ui", optional = true }
-pf-client-core = { path = "../../crates/pf-client-core", default-features = false }
+pf-client-core = { path = "../../crates/pf-client-core" }
 punktfunk-core = { path = "../../crates/punktfunk-core", features = ["quic"] }
 # The fake-library dev hook (`PUNKTFUNK_FAKE_LIBRARY`, browse mode) parses GameEntry JSON.
 serde_json = { version = "1", optional = true }

clients/windows/Cargo.toml

@@ -29,17 +29,7 @@ punktfunk-core = { path = "../../crates/punktfunk-core", features = ["quic"] }
 # The shared client service layer: the trust/settings stores (ONE `Settings` struct for the
 # shell and the spawned session binary — src/trust.rs re-exports it) and the game-library
 # data model (fetch + art pipeline) behind the library page.
-#
-# `default-features = false` drops pf-client-core's default `pyrowave`, which would otherwise
-# build the vendored PyroWave C++ INTO THE SHELL — dead weight here (the shell never decodes;
-# it only offers "pyrowave" as a codec preference string the session binary acts on) and fatal
-# on ARM64, where Granite's math falls back to x86 SSE intrinsics and stops at
-# `simd.hpp: #error "Implement me."`. This does NOT drop PyroWave from the Windows client:
-# decode lives in the spawned punktfunk-session binary, whose own default enables the feature,
-# and cargo's feature unification turns it back on for the shared pf-client-core whenever that
-# binary is in the same build (x64). On the ARM64 leg both are built --no-default-features, so
-# nothing enables it and the C++ is never compiled.
-pf-client-core = { path = "../../crates/pf-client-core", default-features = false }
+pf-client-core = { path = "../../crates/pf-client-core" }
 
 # WinUI 3 UI via windows-reactor (a declarative React-like framework backed by WinUI). Its
 # `build.rs` downloads the Windows App SDK NuGets and stages the bootstrap DLL + resources.pri

clients/windows/packaging/AppxManifest.xml

@@ -59,14 +59,9 @@
     </Application>
     <!--
       Second entry point: the couch/console UI, for an HTPC or a TV-attached box where the
-      desktop shell is the wrong first screen. Its own executable (punktfunk-console.exe)
-      because an MSIX Application entry cannot pass arguments to a full-trust exe; it hands
-      straight off to the session binary's controller-driven browse mode (host list,
-      pairing, settings, library) fullscreen.
-
-      NOTE: never write a double hyphen in this file. XML forbids it inside a comment, and
-      makepri rejects the whole manifest ("Appx manifest not found or is invalid") — which
-      is exactly how the console flag spelled out here broke the v0.15.0 MSIX build.
+      desktop shell is the wrong first screen. Same full-trust executable, launched with
+      `--console`, which hands straight off to the session binary's controller-driven
+      browse mode (host list, pairing, settings, library) fullscreen.
     -->
     <Application Id="PunktfunkConsole" Executable="punktfunk-console.exe"
                  EntryPoint="Windows.FullTrustApplication">

crates/pf-capture/src/linux/mod.rs

@@ -1310,25 +1310,21 @@ mod pipewire {
     /// (which Mutter delivers as metadata-only "corrupted" buffers) still refresh the position.
     fn update_cursor_meta(cursor: &mut CursorState, spa_buf: *mut spa::sys::spa_buffer) {
         // SAFETY: `spa_buf` is the live buffer we still hold (dequeued, not yet requeued).
-        // `spa_buffer_find_meta` returns the `spa_meta` (type + byte `size` + `data` pointer) for
-        // `SPA_META_Cursor`, or null. We take `find_meta` rather than `find_meta_data` specifically
-        // to obtain the region's real `size`: the bitmap offset, pixel offset and stride read below
-        // are ALL producer-written, and without a bound against the actual region they drive
-        // out-of-bounds pointer arithmetic and an oversized `slice::from_raw_parts` — an OOB read
-        // that SIGSEGVs inside the PipeWire `.process` callback (a segfault `catch_unwind` cannot
-        // catch). Every offset below is validated against `region_size` with checked arithmetic,
-        // mirroring the fd-length guard the main frame path already applies to xdg-desktop-portal-wlr.
-        let meta = unsafe { spa::sys::spa_buffer_find_meta(spa_buf, spa::sys::SPA_META_Cursor) };
-        if meta.is_null() {
+        // `spa_buffer_find_meta_data` scans its metadata array for a `SPA_META_Cursor` of at least
+        // `size_of::<spa_meta_cursor>()` bytes and returns a pointer into that buffer's metadata
+        // (or null), valid until requeue. The size argument matches the struct the result is cast to.
+        let cur = unsafe {
+            spa::sys::spa_buffer_find_meta_data(
+                spa_buf,
+                spa::sys::SPA_META_Cursor,
+                std::mem::size_of::<spa::sys::spa_meta_cursor>(),
+            ) as *const spa::sys::spa_meta_cursor
+        };
+        if cur.is_null() {
             return;
         }
-        // SAFETY: `meta` is non-null and points into the held buffer's metadata array.
-        let (region_size, data) = unsafe { ((*meta).size as usize, (*meta).data as *const u8) };
-        if data.is_null() || region_size < std::mem::size_of::<spa::sys::spa_meta_cursor>() {
-            return;
-        }
-        let cur = data as *const spa::sys::spa_meta_cursor;
-        // SAFETY: `region_size >= size_of::<spa_meta_cursor>()` checked above, so every field is in bounds.
+        // SAFETY: `cur` is non-null and points to a `spa_meta_cursor` of at least its own size
+        // inside the held buffer (guaranteed by the size arg above), so every field read is in bounds.
         let (id, pos_x, pos_y, hot_x, hot_y, bmp_off) = unsafe {
             (
                 (*cur).id,
@@ -1351,18 +1347,13 @@ mod pipewire {
             // Position-only update — keep the cached bitmap.
             return;
         }
-        let bmp_off = bmp_off as usize;
-        // The `spa_meta_bitmap` header must fit entirely inside the region before we read it —
-        // `bitmap_offset` is producer-controlled and otherwise reads past the metadata.
-        match bmp_off.checked_add(std::mem::size_of::<spa::sys::spa_meta_bitmap>()) {
-            Some(end) if end <= region_size => {}
-            _ => return,
-        }
-        // SAFETY: `bmp_off + size_of::<spa_meta_bitmap>() <= region_size` (checked directly above),
-        // so the header is fully in bounds; the producer places it aligned as before.
-        let bmp = unsafe { data.add(bmp_off) as *const spa::sys::spa_meta_bitmap };
-        // SAFETY: `bmp` is the in-bounds `spa_meta_bitmap` header validated just above; reading its
-        // scalar fields is sound.
+        // SAFETY: `bitmap_offset` is a byte offset from `cur` to a `spa_meta_bitmap`, which the
+        // producer placed inside the same meta region it sized for this cursor (>= the size we
+        // requested). The resulting pointer is in bounds and aligned for `spa_meta_bitmap`.
+        let bmp =
+            unsafe { (cur as *const u8).add(bmp_off as usize) as *const spa::sys::spa_meta_bitmap };
+        // SAFETY: `bmp` is the in-bounds, aligned `spa_meta_bitmap` pointer computed just above; the
+        // producer fully initialized this header, so reading its scalar fields is sound.
         let (vfmt, bw, bh, stride, pix_off) = unsafe {
             (
                 (*bmp).format,
@@ -1378,27 +1369,10 @@ mod pipewire {
         }
         let row = bw as usize * 4;
         let stride = if stride < row { row } else { stride };
-        // `span` is the exact byte extent the strided loop reads: `stride·(bh-1) + row`. Compute it
-        // with checked arithmetic (a producer stride near `i32::MAX` would otherwise overflow) and
-        // require the whole pixel block `[bmp_off + pix_off, +span)` to lie inside the region before
-        // fabricating the slice — this is the check whose absence made the read go out of bounds.
-        let span = match stride
-            .checked_mul(bh as usize - 1)
-            .and_then(|v| v.checked_add(row))
-        {
-            Some(s) => s,
-            None => return,
-        };
-        match bmp_off
-            .checked_add(pix_off)
-            .and_then(|v| v.checked_add(span))
-        {
-            Some(end) if end <= region_size => {}
-            _ => return,
-        }
-        // SAFETY: `bmp_off + pix_off + span <= region_size` (checked directly above), so the slice
-        // is fully within the producer's meta region; `span` is exactly the strided loop's extent.
-        let src = unsafe { std::slice::from_raw_parts(data.add(bmp_off + pix_off), span) };
+        let span = stride * (bh as usize - 1) + row;
+        // SAFETY: the bitmap pixels live at `bmp + pix_off` for `span` bytes, within the
+        // producer-sized meta region. `span` is the exact extent the strided copy below reads.
+        let src = unsafe { std::slice::from_raw_parts((bmp as *const u8).add(pix_off), span) };
         let mut rgba = vec![0u8; bw as usize * bh as usize * 4];
         for y in 0..bh as usize {
             for x in 0..bw as usize {
@@ -2190,37 +2164,36 @@ mod pipewire {
                 }
             })
             .process(|stream, ud| {
-                // Latest-frame-only (OBS pattern): Mutter delivers buffers in bursts and recycles its
-                // pool; an older queued buffer carries a STALE frame. Drain all queued buffers, requeue
-                // the older ones, keep only the newest. This dequeue/requeue runs OUTSIDE the
-                // `catch_unwind` below — they are non-panicking C FFI pointer ops, and `newest` is
-                // requeued exactly once AFTER the panic-containing region. Previously the whole thing was
-                // inside the catch, so a caught panic (in `update_cursor_meta`/`consume_frame`) stranded
-                // `newest` forever, permanently shrinking the stream's fixed pool until capture wedged.
-                // SAFETY: `stream` is the live stream PipeWire passes into this `.process` callback on the
-                // loop thread; `dequeue_raw_buffer` returns a stream-owned `*mut pw_buffer` or null
-                // (null-checked), single-threaded so no concurrent access.
-                let mut newest = unsafe { stream.dequeue_raw_buffer() };
-                if newest.is_null() {
-                    return;
-                }
-                let mut drained = 1u32;
-                loop {
-                    // SAFETY: same stream/loop-thread contract; returns the next stream-owned buffer or null.
-                    let next = unsafe { stream.dequeue_raw_buffer() };
-                    if next.is_null() {
-                        break;
-                    }
-                    // SAFETY: `newest` was dequeued from this stream and not yet requeued; we immediately
-                    // overwrite it, so the requeued pointer is never touched again.
-                    unsafe { stream.queue_raw_buffer(newest) };
-                    newest = next;
-                    drained += 1;
-                }
-                // PipeWire dispatches from a C trampoline with no catch_unwind; a panic crossing that FFI
-                // boundary would abort the whole host. Contain the inspect/consume work — the only Rust
-                // code here that can panic — and requeue `newest` unconditionally after it.
+                // PipeWire dispatches this from a C trampoline with no catch_unwind; a
+                // panic crossing that FFI boundary would abort the whole host. Contain it.
                 let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                    // Latest-frame-only (OBS pattern): Mutter delivers buffers in bursts and
+                    // recycles its pool; an older queued buffer carries a STALE frame. Drain all
+                    // queued buffers, requeue the older ones, keep only the newest.
+                    // SAFETY: `stream` is the live stream PipeWire passes into this `.process` callback on
+                    // the loop thread, where `pw_stream_dequeue_buffer` is the documented call. It returns
+                    // a `*mut pw_buffer` owned by the stream (or null when the queue is drained),
+                    // null-checked before any use. The loop is single-threaded, so no concurrent access.
+                    let mut newest = unsafe { stream.dequeue_raw_buffer() };
+                    if newest.is_null() {
+                        return;
+                    }
+                    let mut drained = 1u32;
+                    loop {
+                        // SAFETY: same stream/loop-thread contract as the dequeue above; each call returns
+                        // the next stream-owned `*mut pw_buffer` or null (null-checked before use).
+                        let next = unsafe { stream.dequeue_raw_buffer() };
+                        if next.is_null() {
+                            break;
+                        }
+                        // SAFETY: `newest` is a non-null `*mut pw_buffer` previously dequeued from this same
+                        // stream and not yet requeued; `pw_stream_queue_buffer` hands ownership back to the
+                        // stream. We immediately overwrite `newest = next`, so the requeued pointer is never
+                        // touched again (no use-after-requeue). Loop thread, single-threaded.
+                        unsafe { stream.queue_raw_buffer(newest) };
+                        newest = next;
+                        drained += 1;
+                    }
                     // SAFETY: `newest` is the non-null buffer we still own (dequeued, not requeued);
                     // `.buffer` is a `*mut spa_buffer` field libpipewire populated. This is a single field
                     // load through a valid pointer — no mutation or aliasing.
@@ -2299,18 +2272,19 @@ mod pipewire {
                                 "capture: skipped a stale CORRUPTED/cursor buffer (GNOME)"
                             );
                         }
-                        // Skip this stale/cursor buffer — `newest` is requeued unconditionally below.
+                        // SAFETY: `newest` is the non-null buffer we own (dequeued, never requeued on this
+                        // skip path); hand it back to the stream exactly once and return without touching it
+                        // again. Loop thread inside `.process`.
+                        unsafe { stream.queue_raw_buffer(newest) };
                         return;
                     }
 
                     consume_frame(ud, spa_buf);
+                    // SAFETY: `consume_frame` has finished reading `spa_buf` (and the `datas` borrows derived
+                    // from `newest`), so requeuing the owned `newest` exactly once here is sound — no
+                    // use-after-requeue. Loop thread inside `.process`.
+                    unsafe { stream.queue_raw_buffer(newest) };
                 }));
-                // Hand `newest` back to the stream exactly once, on EVERY path — normal, corrupted-skip,
-                // or a caught panic in the closure above. This single requeue is what keeps the fixed
-                // buffer pool from draining.
-                // SAFETY: all reads of `spa_buf`/`newest` (update_cursor_meta, consume_frame) completed
-                // inside the closure above; `newest` was dequeued from this stream and not yet requeued.
-                unsafe { stream.queue_raw_buffer(newest) };
                 if outcome.is_err() {
                     // In the per-frame `.process` callback: a deterministic panic (e.g. a bad
                     // format) would fire this every frame, so power-of-two throttle it — enough to

crates/pf-capture/src/windows/idd_push.rs

@@ -1341,12 +1341,6 @@ impl IddPushCapturer {
         self.out_ring.clear(); // the output format changed → rebuild lazily at the new format
         self.video_conv = None; // converters are sized + HDR-specific → rebuild at the new mode
         self.hdr_p010_conv = None;
-        // The PyroWave CSC is mode-baked too (BgraToYuvPlanes picks different SDR vs HDR shaders
-        // and R8/R8G8 vs R16/R16G16 outputs). Without this, a display_hdr flip (Downgrade point D:
-        // client_10bit=true but HDR couldn't enable at open) reused the stale SDR converter against
-        // the freshly HDR-formatted pyro ring — every frame corrupted. `ensure_pyro_conv` only
-        // builds when None, so it must be reset here like its siblings.
-        self.pyro_conv = None;
         self.pyro_ring.clear(); // PyroWave two-plane ring is sized → rebuild at the new mode
         self.pyro_last = None;
         self.out_idx = 0;
@@ -1867,7 +1861,6 @@ impl IddPushCapturer {
                     cbcr,
                     fence_handle,
                     fence_value,
-                    ring_gen: self.generation,
                 }),
             )
         } else {
@@ -1926,7 +1919,6 @@ impl IddPushCapturer {
                         cbcr: dst_cbcr,
                         fence_handle,
                         fence_value,
-                        ring_gen: self.generation,
                     }),
                 }),
                 cursor: None,

crates/pf-client-core/src/session.rs

@@ -447,16 +447,8 @@ fn pump(
         // every ~8–16 ms at 60–120 Hz anyway, so this rarely times out mid-stream).
         match connector.next_frame(Duration::from_millis(20)) {
             Ok(frame) => {
-                // The `received` point: reassembly COMPLETION, stamped by the core session as
-                // the AU crossed poll_frame (ABI v9). Stamping here at the hand-off pull instead
-                // would fold the pre-decode queue wait into `host+network` — a client-side
-                // standing backlog masquerading as network latency (the 2026-07 two-pair
-                // investigation). 0 = a core predating the stamp; fall back to the pull instant.
-                let received_ns = if frame.received_ns > 0 {
-                    frame.received_ns
-                } else {
-                    now_ns()
-                };
+                // The `received` point: AU fully reassembled, in hand, before decode.
+                let received_ns = now_ns();
                 // fps / goodput count every received AU (spec), decoded or not.
                 frames_n += 1;
                 bytes_n += frame.data.len() as u64;

crates/pf-encode/src/enc/codec.rs

@@ -32,46 +32,6 @@ pub struct EncodedFrame {
     pub chunk_aligned: bool,
 }
 
-/// One slice-boundary chunk of an encoded AU, emitted by a chunked-poll backend
-/// ([`Encoder::poll_chunk`], latency plan §7 LN1): the encoder hands out completed slices while
-/// the rest of the frame is still encoding, so packetize/FEC/pacing can overlap the encode tail.
-/// The chunks of one AU concatenate to exactly the bytes [`Encoder::poll`] would have returned,
-/// and every cut lands on an Annex-B NAL boundary (slice starts). AU-level metadata
-/// (`pts_ns`/`keyframe`/`recovery_anchor`/`chunk_aligned`) is authoritative on the FIRST chunk
-/// (`first`) — the host opens the wire frame from it; `last` closes the AU. `keyframe` on a
-/// non-final chunk is the encoder's own prediction (exact under the P-only/infinite-GOP config —
-/// the driver only ever emits an IDR we asked for); the final chunk re-checks it against the
-/// driver's reported picture type.
-pub struct AuChunk {
-    pub data: Vec<u8>,
-    pub pts_ns: u64,
-    pub keyframe: bool,
-    /// See [`EncodedFrame::recovery_anchor`].
-    pub recovery_anchor: bool,
-    /// See [`EncodedFrame::chunk_aligned`].
-    pub chunk_aligned: bool,
-    /// Opens the AU (carries the authoritative AU metadata).
-    pub first: bool,
-    /// Closes the AU (the concatenation is complete; the encoder's in-flight slot is released).
-    pub last: bool,
-}
-
-impl AuChunk {
-    /// A whole AU as a single self-closing chunk — what every non-chunked backend's
-    /// [`Encoder::poll_chunk`] default emits, so a chunk consumer needs no per-backend fork.
-    pub fn whole(f: EncodedFrame) -> Self {
-        AuChunk {
-            data: f.data,
-            pts_ns: f.pts_ns,
-            keyframe: f.keyframe,
-            recovery_anchor: f.recovery_anchor,
-            chunk_aligned: f.chunk_aligned,
-            first: true,
-            last: true,
-        }
-    }
-}
-
 /// Codec selection negotiated with the client.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Codec {
@@ -259,11 +219,6 @@ pub struct EncoderCaps {
 
 /// A hardware encoder. One per session; runs on the encode thread.
 pub trait Encoder: Send {
-    /// Submit one captured frame for encoding. Lifetime contract: the caller must keep `frame`
-    /// (and its GPU payload) alive until this frame's AU has been returned by
-    /// [`poll`](Self::poll) — a stream-ordered backend (Linux direct-NVENC's IO-stream binding)
-    /// may still be reading the payload asynchronously after `submit` returns. Both host encode
-    /// loops already hold the frame across their poll drain; new callers must do the same.
     fn submit(&mut self, frame: &CapturedFrame) -> Result<()>;
     /// [`submit`](Self::submit) with the **wire frame index** this frame's AU will carry — the
     /// number the packetizer stamps on it and the client's loss reports/RFI requests name. The
@@ -309,37 +264,8 @@ pub trait Encoder: Send {
     fn invalidate_ref_frames(&mut self, _first_frame: i64, _last_frame: i64) -> bool {
         false
     }
-    /// Escalate into a pipelined (two-thread) retrieve mode under sustained GPU contention — the
-    /// encoder analog of the capturer depth escalation: AUs ride ~one loop tick behind (`poll`
-    /// may return `None` while an encode is in flight) in exchange for capture/submit no longer
-    /// serializing on the encode wait. Returns whether pipelined retrieve is (now) active; the
-    /// switch may be deferred to the next safe point internally. `false` from the default impl =
-    /// unsupported — the session loop stops asking. De-escalation is a v2 item everywhere.
-    fn set_pipelined(&mut self, _on: bool) -> bool {
-        false
-    }
     /// Pull the next encoded AU if one is ready.
     fn poll(&mut self) -> Result<Option<EncodedFrame>>;
-    /// Whether [`poll_chunk`](Self::poll_chunk) currently emits sub-AU chunks — i.e. the LIVE
-    /// session has slice-level readback armed (Linux direct-NVENC with the
-    /// `PUNKTFUNK_NVENC_SLICES` and `PUNKTFUNK_NVENC_SUBFRAME` knobs on a sync depth-1
-    /// retrieve). Dynamic, not static: a pipelined-retrieve escalation or a session rebuild can
-    /// turn it off — re-query per AU, never cache across frames. `false` (the default) means
-    /// `poll_chunk` degrades to one whole-AU chunk per frame.
-    fn supports_chunked_poll(&self) -> bool {
-        false
-    }
-    /// Pull the next slice-boundary chunk of the oldest in-flight AU (latency plan §7 LN1).
-    /// Semantics when chunking is live: BLOCKS until the next chunk is readable, and the final
-    /// (`last`) chunk blocks exactly like [`poll`](Self::poll) does — the depth-1 pump treats
-    /// `None` as re-poll-next-tick, so a non-blocking tail would ride the AU one tick late (the
-    /// `6dc195f9` Vulkan bug class). `Ok(None)` only when no AU is in flight. Each AU must be
-    /// drained through ONE method: calling `poll` on a partially-chunked AU is a caller bug (the
-    /// backend errors rather than double-emit bytes). Default: delegates to `poll`, wrapping the
-    /// whole AU as a single `first && last` chunk.
-    fn poll_chunk(&mut self) -> Result<Option<AuChunk>> {
-        Ok(self.poll()?.map(AuChunk::whole))
-    }
     /// Tear the underlying hardware encoder down and rebuild it in place, keeping the session's
     /// negotiated parameters — the encode-stall watchdog's recovery lever (a wedged AMF/QSV
     /// driver stops emitting AUs or accepting frames without ever returning an error). Returns
@@ -367,16 +293,6 @@ pub trait Encoder: Send {
     /// flagged [`EncodedFrame::chunk_aligned`] and the session marks them on the wire.
     /// Default: no-op (the H.26x backends' bitstreams cannot be cut losslessly).
     fn set_wire_chunking(&mut self, _shard_payload: usize) {}
-    /// How many frames the CAPTURER guarantees the encoder may hold in flight before it starts
-    /// reusing an input texture (`Capturer::pipeline_depth`). Backends that encode the capturer's
-    /// textures IN PLACE — no `CopyResource` — must not pipeline deeper than this: the capturer
-    /// rotates its output ring per delivered frame with no regard for encode completion, so a
-    /// deeper pipeline lets it overwrite a texture mid-encode. That is visual corruption (torn or
-    /// mixed frames), not UB, so it fails silently and intermittently.
-    ///
-    /// Called once by the session glue after the capturer is known; a backend that copies its
-    /// input, or is synchronous, ignores it. Default: no-op.
-    fn set_input_ring_depth(&mut self, _depth: usize) {}
     /// Signal end-of-stream. After this, drain the remaining AUs with [`poll`](Self::poll)
     /// until it returns `None` — NVENC buffers frames internally even at `delay=0`.
     fn flush(&mut self) -> Result<()>;
@@ -496,23 +412,6 @@ mod tests {
         }
     }
 
-    /// The whole-AU chunk (every non-chunked backend's `poll_chunk` shape) must carry the AU's
-    /// metadata verbatim and be self-closing (`first && last`).
-    #[test]
-    fn whole_au_chunk_is_self_closing() {
-        let c = AuChunk::whole(EncodedFrame {
-            data: vec![0, 0, 0, 1, 0x40],
-            pts_ns: 42,
-            keyframe: true,
-            recovery_anchor: true,
-            chunk_aligned: false,
-        });
-        assert_eq!(c.data, vec![0, 0, 0, 1, 0x40]);
-        assert_eq!(c.pts_ns, 42);
-        assert!(c.keyframe && c.recovery_anchor && !c.chunk_aligned);
-        assert!(c.first && c.last);
-    }
-
     /// Wire round-trip and the stats label stay in lockstep with the `quic::CODEC_*` bits.
     #[test]
     fn codec_wire_roundtrip_and_label() {

crates/pf-encode/src/enc/linux/mod.rs

@@ -826,7 +826,7 @@ impl NvencEncoder {
                         (*f).linesize[i] as usize,
                     )
                 });
-                pf_zerocopy::cuda::copy_yuv444_to_device(buf, dsts, true)
+                pf_zerocopy::cuda::copy_yuv444_to_device(buf, dsts)
             } else if self.want_444 {
                 ffi::av_frame_free(&mut f);
                 bail!(
@@ -839,11 +839,11 @@ impl NvencEncoder {
                 let y_pitch = (*f).linesize[0] as usize;
                 let uv_ptr = (*f).data[1] as pf_zerocopy::cuda::CUdeviceptr;
                 let uv_pitch = (*f).linesize[1] as usize;
-                pf_zerocopy::cuda::copy_nv12_to_device(buf, y_ptr, y_pitch, uv_ptr, uv_pitch, true)
+                pf_zerocopy::cuda::copy_nv12_to_device(buf, y_ptr, y_pitch, uv_ptr, uv_pitch)
             } else {
                 let dst_ptr = (*f).data[0] as pf_zerocopy::cuda::CUdeviceptr;
                 let dst_pitch = (*f).linesize[0] as usize;
-                pf_zerocopy::cuda::copy_device_to_device(buf, dst_ptr, dst_pitch, true)
+                pf_zerocopy::cuda::copy_device_to_device(buf, dst_ptr, dst_pitch)
             };
             if let Err(e) = copy_res {
                 ffi::av_frame_free(&mut f);

crates/pf-encode/src/enc/linux/pyrowave.rs

@@ -1176,24 +1176,7 @@ impl Encoder for PyroWaveEncoder {
     fn submit(&mut self, frame: &CapturedFrame) -> Result<()> {
         // SAFETY: single-threaded encoder; `encode_frame` records/submits on handles this
         // struct owns and waits its own fence before touching results.
-        let r = unsafe { self.encode_frame(frame) };
-        if r.is_err() {
-            // `encode_frame` opens the recording window early and has several fallible steps
-            // inside it (cursor prep, dmabuf import, format mapping, the CPU-RGB staging path,
-            // an unsupported-payload bail, and the encode call itself). Every one returns with
-            // `self.cmd` still RECORDING, and nothing downstream repairs it — there is exactly
-            // one `begin_command_buffer` in this file and `reset()`/`Drop` never touch `cmd` —
-            // so the NEXT frame would call `begin` on a recording buffer, which is invalid usage.
-            // Legal here on every path: the pool carries RESET_COMMAND_BUFFER and the buffer is
-            // not pending (we never reached the submit, or the submit itself failed).
-            // SAFETY: `self.cmd` is owned by this encoder and, on these paths, not in flight.
-            unsafe {
-                let _ = self
-                    .device
-                    .reset_command_buffer(self.cmd, vk::CommandBufferResetFlags::empty());
-            }
-        }
-        r
+        unsafe { self.encode_frame(frame) }
     }
 
     fn caps(&self) -> EncoderCaps {

crates/pf-encode/src/enc/linux/vk_util.rs

@@ -77,32 +77,6 @@ pub(crate) unsafe fn import_rgb_dmabuf(
     d: &pf_frame::DmabufFrame,
     cw: u32,
     ch: u32,
-) -> Result<(vk::Image, vk::DeviceMemory, vk::ImageView)> {
-    import_rgb_dmabuf_as(
-        device,
-        ext_fd,
-        mem_props,
-        d,
-        cw,
-        ch,
-        vk::ImageUsageFlags::SAMPLED,
-        None,
-    )
-}
-
-/// [`import_rgb_dmabuf`] with the image usage explicit and an optional video-profile list
-/// (chained into the image create) — the RGB-direct encode path imports the captured buffer
-/// as a profiled `VIDEO_ENCODE_SRC` image instead of a sampled one.
-#[allow(clippy::too_many_arguments)]
-pub(crate) unsafe fn import_rgb_dmabuf_as(
-    device: &ash::Device,
-    ext_fd: &ash::khr::external_memory_fd::Device,
-    mem_props: &vk::PhysicalDeviceMemoryProperties,
-    d: &pf_frame::DmabufFrame,
-    cw: u32,
-    ch: u32,
-    usage: vk::ImageUsageFlags,
-    profile_list: Option<&mut vk::VideoProfileListInfoKHR>,
 ) -> Result<(vk::Image, vk::DeviceMemory, vk::ImageView)> {
     use anyhow::Context;
     use std::os::fd::IntoRawFd;
@@ -116,27 +90,26 @@ pub(crate) unsafe fn import_rgb_dmabuf_as(
         .plane_layouts(&plane);
     let mut ext = vk::ExternalMemoryImageCreateInfo::default()
         .handle_types(vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT);
-    let mut ci = vk::ImageCreateInfo::default()
-        .image_type(vk::ImageType::TYPE_2D)
-        .format(fmt)
-        .extent(vk::Extent3D {
-            width: cw,
-            height: ch,
-            depth: 1,
-        })
-        .mip_levels(1)
-        .array_layers(1)
-        .samples(vk::SampleCountFlags::TYPE_1)
-        .tiling(vk::ImageTiling::DRM_FORMAT_MODIFIER_EXT)
-        .usage(usage)
-        .sharing_mode(vk::SharingMode::EXCLUSIVE)
-        .initial_layout(vk::ImageLayout::UNDEFINED)
-        .push_next(&mut ext)
-        .push_next(&mut drm);
-    if let Some(pl) = profile_list {
-        ci = ci.push_next(pl);
-    }
-    let img = device.create_image(&ci, None)?;
+    let img = device.create_image(
+        &vk::ImageCreateInfo::default()
+            .image_type(vk::ImageType::TYPE_2D)
+            .format(fmt)
+            .extent(vk::Extent3D {
+                width: cw,
+                height: ch,
+                depth: 1,
+            })
+            .mip_levels(1)
+            .array_layers(1)
+            .samples(vk::SampleCountFlags::TYPE_1)
+            .tiling(vk::ImageTiling::DRM_FORMAT_MODIFIER_EXT)
+            .usage(vk::ImageUsageFlags::SAMPLED)
+            .sharing_mode(vk::SharingMode::EXCLUSIVE)
+            .initial_layout(vk::ImageLayout::UNDEFINED)
+            .push_next(&mut ext)
+            .push_next(&mut drm),
+        None,
+    )?;
     // dup the fd; Vulkan takes ownership of the dup on a successful import.
     let dup = d.fd.try_clone().context("dup dmabuf fd")?.into_raw_fd();
     let fd_props = {
@@ -210,8 +183,7 @@ pub(crate) unsafe fn make_plain_image(
         None,
     )?;
     let req = device.get_image_memory_requirements(img);
-    // Unwind on failure: callers (the encoders' open paths) only ever see the completed triple.
-    let mem = match device.allocate_memory(
+    let mem = device.allocate_memory(
         &vk::MemoryAllocateInfo::default()
             .allocation_size(req.size)
             .memory_type_index(find_mem(
@@ -220,24 +192,8 @@ pub(crate) unsafe fn make_plain_image(
                 vk::MemoryPropertyFlags::DEVICE_LOCAL,
             )),
         None,
-    ) {
-        Ok(m) => m,
-        Err(e) => {
-            device.destroy_image(img, None);
-            return Err(e.into());
-        }
-    };
-    if let Err(e) = device.bind_image_memory(img, mem, 0) {
-        device.destroy_image(img, None);
-        device.free_memory(mem, None);
-        return Err(e.into());
-    }
-    match make_view(device, img, fmt, 0) {
-        Ok(view) => Ok((img, mem, view)),
-        Err(e) => {
-            device.destroy_image(img, None);
-            device.free_memory(mem, None);
-            Err(e)
-        }
-    }
+    )?;
+    device.bind_image_memory(img, mem, 0)?;
+    let view = make_view(device, img, fmt, 0)?;
+    Ok((img, mem, view))
 }

crates/pf-encode/src/enc/linux/vk_valve_rgb.rs

@@ -1,82 +0,0 @@
-//! Vendored `VK_VALVE_video_encode_rgb_conversion` bindings — the RGB→YCbCr encode-source
-//! extension (Vulkan 1.4.327; RADV since Mesa 26.0, hardware-gated on the VCN EFC front-end
-//! conversion block). Our pinned `ash 0.38.0+1.3.281` predates it entirely; same vendoring
-//! rationale as [`vk_av1_encode`](super::vk_av1_encode) — definitions copied from the registry
-//! so the layouts are correct-by-construction, chained via raw `p_next`. Consumed by
-//! `vulkan_video.rs`: B0 probes + logs availability (design/vulkan-rgb-direct-encode.md);
-//! B1 makes the captured BGRx dmabuf the direct encode source with EFC doing the 709-narrow CSC.
-#![allow(dead_code)]
-
-use ash::vk;
-use std::ffi::{c_void, CStr};
-
-pub const EXTENSION_NAME: &CStr = c"VK_VALVE_video_encode_rgb_conversion";
-
-// ---------- struct-type (VkStructureType) values — construct via `stype` ----------
-pub const ST_PHYSICAL_DEVICE_FEATURES: i32 = 1_000_390_000;
-pub const ST_CAPABILITIES: i32 = 1_000_390_001;
-pub const ST_PROFILE_INFO: i32 = 1_000_390_002;
-pub const ST_SESSION_CREATE_INFO: i32 = 1_000_390_003;
-
-// `VkVideoEncodeRgbModelConversionFlagBitsVALVE`
-pub const MODEL_RGB_IDENTITY: u32 = 0x01;
-pub const MODEL_YCBCR_IDENTITY: u32 = 0x02;
-pub const MODEL_YCBCR_709: u32 = 0x04;
-pub const MODEL_YCBCR_601: u32 = 0x08;
-pub const MODEL_YCBCR_2020: u32 = 0x10;
-// `VkVideoEncodeRgbRangeCompressionFlagBitsVALVE`
-pub const RANGE_FULL: u32 = 0x01;
-pub const RANGE_NARROW: u32 = 0x02;
-// `VkVideoEncodeRgbChromaOffsetFlagBitsVALVE`
-pub const CHROMA_OFFSET_COSITED_EVEN: u32 = 0x01;
-pub const CHROMA_OFFSET_MIDPOINT: u32 = 0x02;
-
-/// `VkPhysicalDeviceVideoEncodeRgbConversionFeaturesVALVE` — chain into
-/// `VkPhysicalDeviceFeatures2` (query) / `VkDeviceCreateInfo` (enable).
-#[repr(C)]
-pub struct PhysicalDeviceVideoEncodeRgbConversionFeaturesVALVE {
-    pub s_type: vk::StructureType,
-    pub p_next: *mut c_void,
-    pub video_encode_rgb_conversion: vk::Bool32,
-}
-
-/// `VkVideoEncodeRgbConversionCapabilitiesVALVE` — chain into the
-/// `vkGetPhysicalDeviceVideoCapabilitiesKHR` output when the queried profile carries
-/// [`VideoEncodeProfileRgbConversionInfoVALVE`]; reports which conversions the HW does.
-#[repr(C)]
-pub struct VideoEncodeRgbConversionCapabilitiesVALVE {
-    pub s_type: vk::StructureType,
-    pub p_next: *mut c_void,
-    pub rgb_models: u32,
-    pub rgb_ranges: u32,
-    pub x_chroma_offsets: u32,
-    pub y_chroma_offsets: u32,
-}
-
-/// `VkVideoEncodeProfileRgbConversionInfoVALVE` — part of the video-profile *identity*: every
-/// consumer of the profile (caps query, format query, session, image profile lists) must carry
-/// the same chain.
-#[repr(C)]
-pub struct VideoEncodeProfileRgbConversionInfoVALVE {
-    pub s_type: vk::StructureType,
-    pub p_next: *const c_void,
-    pub perform_encode_rgb_conversion: vk::Bool32,
-}
-
-/// `VkVideoEncodeSessionRgbConversionCreateInfoVALVE` — chain into
-/// `VkVideoSessionCreateInfoKHR`; single-bit selections of the conversion actually performed.
-#[repr(C)]
-pub struct VideoEncodeSessionRgbConversionCreateInfoVALVE {
-    pub s_type: vk::StructureType,
-    pub p_next: *const c_void,
-    pub rgb_model: u32,
-    pub rgb_range: u32,
-    pub x_chroma_offset: u32,
-    pub y_chroma_offset: u32,
-}
-
-/// `vk::StructureType` for a raw `ST_*` constant above.
-#[inline]
-pub fn stype(raw: i32) -> vk::StructureType {
-    vk::StructureType::from_raw(raw)
-}

crates/pf-encode/src/enc/nvenc_core.rs

@@ -35,38 +35,6 @@ pub(super) fn codec_guid(codec: Codec) -> nv::GUID {
     }
 }
 
-/// Resolved per-frame slice count for a session (latency plan §7 LN1, Phase 3): the
-/// `PUNKTFUNK_NVENC_SLICES` env override wins (1..=32; **1 = the explicit single-slice
-/// escape**, needed now that a backend can default higher), else the backend's
-/// `default_slices` — 4 on Linux direct-NVENC since the Phase-3 default-on, 1 everywhere else
-/// (the Windows async path is deliberately untouched). H.264/HEVC only (AV1 partitions via
-/// tiles). ONE parse shared by the config author ([`apply_low_latency_config`] via
-/// [`LowLatencyConfig::slices`]) and the Linux backend's chunked-poll arming, so the two can
-/// never disagree about whether a session is multi-slice.
-pub(super) fn resolve_slices(codec: Codec, default_slices: u32) -> u32 {
-    if !matches!(codec, Codec::H264 | Codec::H265) {
-        return 1;
-    }
-    std::env::var("PUNKTFUNK_NVENC_SLICES")
-        .ok()
-        .and_then(|s| s.parse::<u32>().ok())
-        .filter(|n| (1..=32).contains(n))
-        .unwrap_or(default_slices)
-}
-
-/// Resolved sub-frame readback (`enableSubFrameWrite` + `reportSliceOffsets`; sync sessions
-/// only, see [`build_init_params`]): `PUNKTFUNK_NVENC_SUBFRAME` tri-state — `0` = never (the
-/// default-on escape), `1` = force (even where the caps probe says unsupported — an operator
-/// explicitly testing), unset = the backend's `default_on` (Linux direct-NVENC passes its
-/// SUBFRAME_READBACK caps-probe result since Phase 3; Windows passes `false`).
-pub(super) fn resolve_subframe(default_on: bool) -> bool {
-    match std::env::var("PUNKTFUNK_NVENC_SUBFRAME").as_deref() {
-        Ok("0") => false,
-        Ok("1") => true,
-        _ => default_on,
-    }
-}
-
 /// Reference-frame DPB depth when RFI is supported (Apollo uses 5). A deeper DPB lets an invalidated
 /// reference fall back to an older still-valid frame instead of a full IDR; `numRefL0 = 1` keeps each
 /// P-frame single-reference for low latency. Also the window the backends' `invalidate_ref_frames`
@@ -98,9 +66,6 @@ pub(super) struct LowLatencyConfig {
     pub hdr: bool,
     /// This GPU supports reference-frame invalidation (a deeper DPB for graceful loss recovery).
     pub rfi_supported: bool,
-    /// Resolved per-frame slice count ([`resolve_slices`] — env override, else the backend
-    /// default). ≤ 1 leaves the preset's single slice untouched.
-    pub slices: u32,
 }
 
 /// Author the shared `NV_ENC_INITIALIZE_PARAMS` (P1/ULL preset, PTD, the session dimensions/rate)
@@ -117,7 +82,6 @@ pub(super) fn build_init_params(
     cfg: &mut nv::NV_ENC_CONFIG,
     split_mode: u32,
     enable_async: bool,
-    subframe: bool,
 ) -> nv::NV_ENC_INITIALIZE_PARAMS {
     let mut init = nv::NV_ENC_INITIALIZE_PARAMS {
         version: nv::NV_ENC_INITIALIZE_PARAMS_VER,
@@ -137,16 +101,6 @@ pub(super) fn build_init_params(
     };
     // splitEncodeMode is a C bitfield — set via the generated accessor, not a struct field.
     init.set_splitEncodeMode(split_mode);
-    // Sub-frame readback (latency plan §7 LN1; default-on for Linux direct-NVENC since Phase 3 —
-    // the caller resolves `subframe` via [`resolve_subframe`] + its caps probe): the driver
-    // writes each slice into the output buffer as it completes and reports per-slice offsets, so
-    // a sync-mode consumer can read slices out while the frame is still encoding. Pair with
-    // multi-slice (a single-slice frame yields nothing to read early). `reportSliceOffsets`
-    // requires `enableEncodeAsync = 0`, so async (Windows) sessions never arm.
-    if !enable_async && subframe {
-        init.set_enableSubFrameWrite(1);
-        init.set_reportSliceOffsets(1);
-    }
     init
 }
 
@@ -164,9 +118,6 @@ pub(super) unsafe fn apply_low_latency_config(cfg: &mut nv::NV_ENC_CONFIG, c: Lo
     cfg.gopLength = nv::NVENC_INFINITE_GOPLENGTH;
     cfg.frameIntervalP = 1;
     cfg.rcParams.rateControlMode = nv::NV_ENC_PARAMS_RC_MODE::NV_ENC_PARAMS_RC_CBR;
-    // Explicit zero reorder delay: with P-only + no lookahead there is no reordering to buffer,
-    // but pin the bit so no preset/driver default can ever slip a frame of reorder delay in.
-    cfg.rcParams.set_zeroReorderDelay(1);
     let bps = c.bitrate.min(u32::MAX as u64) as u32;
     cfg.rcParams.averageBitRate = bps;
     cfg.rcParams.maxBitRate = bps;
@@ -195,26 +146,6 @@ pub(super) unsafe fn apply_low_latency_config(cfg: &mut nv::NV_ENC_CONFIG, c: Lo
         Codec::PyroWave => unreachable!("PyroWave never opens the direct-NVENC backend"),
     }
 
-    // Multi-slice frames (latency plan §7 LN1): `c.slices` splits every frame into N slices
-    // (sliceMode 3 = "N slices per frame"), the unit sub-frame readback ships early and loss
-    // concealment can discard independently. Costs ~1-2 % bitrate in slice headers. H.264/HEVC
-    // only — AV1 partitions via tiles, not slices (the resolver already returns 1 there).
-    // Default 4 on Linux direct-NVENC (Phase 3), env-only elsewhere; ≤ 1 keeps the preset's
-    // single slice.
-    if let Some(n) = Some(c.slices).filter(|n| *n >= 2) {
-        match c.codec {
-            Codec::H264 => {
-                cfg.encodeCodecConfig.h264Config.sliceMode = 3;
-                cfg.encodeCodecConfig.h264Config.sliceModeData = n;
-            }
-            Codec::H265 => {
-                cfg.encodeCodecConfig.hevcConfig.sliceMode = 3;
-                cfg.encodeCodecConfig.hevcConfig.sliceModeData = n;
-            }
-            Codec::Av1 | Codec::PyroWave => {}
-        }
-    }
-
     // Chroma + bit depth. Full-chroma 4:4:4 (HEVC Range Extensions, chromaFormatIDC=3 under the FREXT
     // profile) takes precedence and composes with 10-bit (Main 4:4:4 10); it needs a full-chroma-
     // capable input. Otherwise 10-bit selects Main10 (HEVC) or the AV1 output depth — stamping the

crates/pf-encode/src/enc/windows/nvenc.rs

@@ -37,8 +37,7 @@
 #![deny(clippy::undocumented_unsafe_blocks)]
 
 use super::nvenc_core::{
-    apply_low_latency_config, build_init_params, codec_guid, resolve_slices, resolve_subframe,
-    LowLatencyConfig, NvStatusExt, RFI_DPB,
+    apply_low_latency_config, build_init_params, codec_guid, LowLatencyConfig, NvStatusExt, RFI_DPB,
 };
 use super::nvenc_status;
 use super::{ChromaFormat, Codec, EncodedFrame, Encoder, EncoderCaps};
@@ -410,12 +409,6 @@ pub struct NvencD3d11Encoder {
     events: Vec<usize>,
     /// Async mode: the retrieve thread + its channels (`None` = classic same-thread sync retrieve).
     async_rt: Option<AsyncRetrieve>,
-    /// The capturer's `pipeline_depth` (`set_input_ring_depth`). This backend encodes the
-    /// capturer's textures IN PLACE, so it is a HARD ceiling on async in-flight depth: the
-    /// capturer rotates its ring per delivered frame regardless of encode completion, so
-    /// pipelining deeper lets it overwrite a texture mid-encode (torn frames). `None` until the
-    /// session glue reports it — treated as "unknown, don't pipeline past the env cap".
-    input_ring_depth: Option<usize>,
     /// `NV_ENC_CAPS_ASYNC_ENCODE_SUPPORT` from the caps probe — gates the async retrieve mode.
     async_supported: bool,
     /// (bitstream, mapped input resource to unmap after retrieval, pts_ns, recovery-anchor) per
@@ -512,7 +505,6 @@ impl NvencD3d11Encoder {
             bitstreams: Vec::new(),
             events: Vec::new(),
             async_rt: None,
-            input_ring_depth: None,
             async_supported: false,
             pending: VecDeque::new(),
             frame_idx: 0,
@@ -745,10 +737,6 @@ impl NvencD3d11Encoder {
                 av1_input_depth_minus8: if ten_bit_in { 2 } else { 0 },
                 hdr: self.hdr,
                 rfi_supported: self.rfi_supported,
-                // Env-only on Windows (default single slice): the Phase-3 default-on is a
-                // Linux-direct-NVENC decision — the Windows async path stays untouched, and a
-                // Windows operator opting in must choose slices+sync over async retrieve.
-                slices: resolve_slices(self.codec, 1),
             },
         );
         Ok(cfg)
@@ -796,9 +784,6 @@ impl NvencD3d11Encoder {
             &mut cfg,
             split_mode,
             enable_async,
-            // Windows: env opt-in only ("1"), never a default — and build_init_params
-            // additionally refuses it on an async session.
-            resolve_subframe(false),
         );
 
         match (api().initialize_encoder)(enc, &mut init).nv_ok() {
@@ -1171,21 +1156,11 @@ impl Encoder for NvencD3d11Encoder {
         // index, which is non-zero on a mid-session encoder rebuild's first frame.
         let opening = self.next == 0;
         // Async backpressure: never hand NVENC an output bitstream that is still in flight, and
-        // keep in-flight depth within the capturer's texture ring. At the cap, block on the OLDEST
-        // completion (the retrieve thread is already waiting on its event) before submitting more —
-        // bounding depth exactly like the sync path's per-tick blocking poll, just `cap` deep
-        // instead of 1.
-        //
-        // The ring term is the one that matters for correctness: `async_inflight_cap()` is only the
-        // output-bitstream-pool ceiling plus an env knob, and consults NOTHING about the capturer,
-        // despite this comment previously claiming otherwise. Since this backend encodes the
-        // capturer's textures in place, exceeding the capturer's declared `pipeline_depth` lets it
-        // rotate a texture out from under a live encode — torn frames, silently.
-        let cap = match self.input_ring_depth {
-            Some(d) => async_inflight_cap().min(d.max(1)),
-            None => async_inflight_cap(),
-        };
-        while self.async_rt.is_some() && self.pending.len() >= cap {
+        // keep in-flight depth within the capturer's texture ring (see `async_inflight_cap`). At
+        // the cap, block on the OLDEST completion (the retrieve thread is already waiting on its
+        // event) before submitting more — bounding depth exactly like the sync path's per-tick
+        // blocking poll, just `cap` deep instead of 1.
+        while self.async_rt.is_some() && self.pending.len() >= async_inflight_cap() {
             let done = {
                 let rt = self.async_rt.as_mut().expect("checked in loop condition");
                 rt.done_rx
@@ -1361,17 +1336,6 @@ impl Encoder for NvencD3d11Encoder {
         self.submit(frame)
     }
 
-    fn set_input_ring_depth(&mut self, depth: usize) {
-        // This backend registers and encodes the capturer's textures in place (no CopyResource),
-        // so the capturer's ring depth is a hard ceiling on how deep async may pipeline.
-        self.input_ring_depth = Some(depth);
-        tracing::debug!(
-            depth,
-            env_cap = async_inflight_cap(),
-            "NVENC: capturer input-ring depth reported — async in-flight bounded by the smaller"
-        );
-    }
-
     fn request_keyframe(&mut self) {
         self.force_kf = true;
     }
@@ -1576,7 +1540,6 @@ impl Encoder for NvencD3d11Encoder {
                     &mut cfg,
                     self.split_mode,
                     self.session_async,
-                    resolve_subframe(false),
                 ),
                 ..Default::default()
             };

crates/pf-encode/src/enc/windows/pyrowave.rs

@@ -43,9 +43,6 @@ const BS_SLACK: usize = 256 * 1024;
 /// (a desktop-switch device recreate), in which case the stale imports are evicted + destroyed.
 const IMPORT_CACHE_CAP: usize = 8;
 
-/// Plane-import cache key: the texture's COM address plus the extent it was imported at.
-type PlaneKey = (isize, u32, u32);
-
 // --- Vulkan enum values not surfaced by pyrowave-sys' bindgen (only enums *reachable* from the
 // pyrowave C API are generated; these plain #define / flags-typedef values are stable spec
 // constants). bindgen renders every reachable Vulkan enum as a `u32` type alias, so these u32
@@ -139,12 +136,8 @@ pub struct PyroWaveEncoder {
     // Imported plane textures, cached by the out-ring texture's raw pointer (stable per ring slot):
     // the full-res R8 Y plane and the half-res R8G8 CbCr plane, imported SEPARATELY (a single planar
     // NV12 import is unreliable on NVIDIA at arbitrary sizes).
-    /// The capturer ring generation the cached plane imports below belong to. A recreate bumps it,
-    /// and every cached import is destroyed — the COM addresses they are keyed on can be recycled
-    /// by the allocator after a recreate, so identity cannot rest on the pointer alone.
-    ring_gen: Option<u32>,
-    y_images: Vec<(PlaneKey, pw::pyrowave_image)>,
-    cbcr_images: Vec<(PlaneKey, pw::pyrowave_image)>,
+    y_images: Vec<(isize, pw::pyrowave_image)>,
+    cbcr_images: Vec<(isize, pw::pyrowave_image)>,
 
     width: u32,
     height: u32,
@@ -275,7 +268,6 @@ impl PyroWaveEncoder {
                 pw_dev,
                 pw_enc,
                 sync: std::ptr::null_mut(),
-                ring_gen: None,
                 y_images: Vec::new(),
                 cbcr_images: Vec::new(),
                 width,
@@ -359,16 +351,10 @@ impl PyroWaveEncoder {
     ///
     /// # Safety
     /// Same contract as [`import_plane`].
-    /// Keyed on `(texture address, width, height)` rather than the bare address: the COM pointer
-    /// carries no reference here, so a released texture's address can be recycled by a later
-    /// allocation and return an import describing the WRONG surface. Folding the extent in means a
-    /// recycled address at a different size can never alias. (A recycle at the SAME size is still
-    /// possible in principle — the complete fix is to key on the capturer's ring generation, which
-    /// needs that generation plumbed onto `PyroFrameShare`.)
     unsafe fn cached_plane(
-        cache: &mut Vec<(PlaneKey, pw::pyrowave_image)>,
+        cache: &mut Vec<(isize, pw::pyrowave_image)>,
         make: impl FnOnce() -> Result<pw::pyrowave_image>,
-        key: PlaneKey,
+        key: isize,
     ) -> Result<pw::pyrowave_image> {
         if let Some((_, img)) = cache.iter().find(|(k, _)| *k == key) {
             return Ok(*img);
@@ -437,21 +423,6 @@ impl PyroWaveEncoder {
             !self.pw_enc.is_null(),
             "pyrowave: encode after a failed reset (encoder was destroyed and not rebuilt)"
         );
-        // The plane textures are imported at the encoder's CONFIGURED extent, not the frame's, so a
-        // capture that changed size would be read under a stale `VkImageCreateInfo`. This is
-        // reachable without any client Reconfigure: the IDD capturer autonomously recreates its ring
-        // on a confirmed display-descriptor change (e.g. a fullscreen game mode-setting the virtual
-        // display). Refuse instead — the session must reopen the encoder at the new mode. Mirrors
-        // the guard the QSV and AMF backends already carry.
-        anyhow::ensure!(
-            frame.width == self.width && frame.height == self.height,
-            "pyrowave: captured frame {}x{} != encoder {}x{} (the capturer recreated its ring at a \
-             new mode — the encoder must be reopened)",
-            frame.width,
-            frame.height,
-            self.width,
-            self.height
-        );
         let FramePayload::D3d11(d3d) = &frame.payload else {
             bail!("pyrowave (Windows) needs a D3D11 frame (the capturer must be in pyrowave mode)")
         };
@@ -460,25 +431,6 @@ impl PyroWaveEncoder {
              in pyrowave mode (session_plan::output_format must set OutputFormat::pyrowave)",
         )?;
 
-        // Ring recreate ⇒ every cached plane import belongs to textures that no longer exist. Their
-        // COM addresses can be handed back out by the allocator, so a pointer-keyed hit could return
-        // an image bound to freed memory. Flush on the generation change rather than relying on the
-        // address (or the FIFO cap) to notice.
-        if self.ring_gen != Some(share.ring_gen) {
-            if self.ring_gen.is_some() {
-                tracing::info!(
-                    from = ?self.ring_gen,
-                    to = share.ring_gen,
-                    cached = self.y_images.len() + self.cbcr_images.len(),
-                    "pyrowave: capturer recreated its ring — flushing stale plane imports"
-                );
-            }
-            for (_, img) in self.y_images.drain(..).chain(self.cbcr_images.drain(..)) {
-                pw::pyrowave_image_destroy(img);
-            }
-            self.ring_gen = Some(share.ring_gen);
-        }
-
         // Import the fence whenever this encoder has no timeline yet — the first frame, OR a fresh
         // encoder after a client mode-switch rebuild (the capturer passes the persistent handle on
         // every frame precisely so a rebuilt encoder can re-import it).
@@ -513,7 +465,7 @@ impl PyroWaveEncoder {
         };
         let pw_dev = self.pw_dev;
         let y_img = {
-            let key = (d3d.texture.as_raw() as isize, w, h);
+            let key = d3d.texture.as_raw() as isize;
             let tex = &d3d.texture;
             Self::cached_plane(
                 &mut self.y_images,
@@ -522,7 +474,7 @@ impl PyroWaveEncoder {
             )?
         };
         let cbcr_img = {
-            let key = (share.cbcr.as_raw() as isize, cw, ch);
+            let key = share.cbcr.as_raw() as isize;
             let tex = &share.cbcr;
             Self::cached_plane(
                 &mut self.cbcr_images,
@@ -1024,9 +976,6 @@ mod tests {
                     cbcr: cbcr_tex,
                     fence_handle: Some(fence_handle.0 as isize),
                     fence_value: 1,
-                    // One synthetic ring for the whole case: a constant generation exercises the
-                    // steady-state cache-hit path (a changing one would flush every frame).
-                    ring_gen: 1,
                 }),
             }),
             cursor: None,

crates/pf-encode/src/enc/windows/qsv.rs

@@ -714,16 +714,7 @@ pub struct QsvEncoder {
     /// `EncoderCaps::supports_rfi` and all per-frame marking/forcing below.
     ltr_active: bool,
     /// The wire frame index stored in each LTR slot (`None` = never marked).
-    ///
-    /// This mirrors the HARDWARE DPB, so an entry must not be cleared merely because we distrust
-    /// it: nulling issues no VPL call, and the encoder keeps the frame marked long-term until that
-    /// `LongTermIdx` is re-marked or an IDR flushes it. Distrust is recorded in `ltr_tainted`
-    /// instead, so the rejection list can still NAME the entry the hardware is holding.
     ltr_slots: [Option<i64>; NUM_LTR_SLOTS],
-    /// Per-slot taint from `invalidate_ref_frames`' sweep: the mark is still live in the hardware
-    /// DPB but was encoded inside the client's corrupt window, so it may not anchor a recovery —
-    /// it must be REJECTED instead. Cleared wherever the slot is re-marked or the DPB is flushed.
-    ltr_tainted: [bool; NUM_LTR_SLOTS],
     next_ltr_slot: usize,
     ltr_mark_interval: i64,
     /// Set by `invalidate_ref_frames`: the slot the next submitted frame force-references.
@@ -798,7 +789,6 @@ impl QsvEncoder {
             ir_active: false,
             ltr_active: false,
             ltr_slots: [None; NUM_LTR_SLOTS],
-            ltr_tainted: [false; NUM_LTR_SLOTS],
             next_ltr_slot: 0,
             ltr_mark_interval: ltr_mark_interval(fps),
             pending_force: None,
@@ -923,7 +913,6 @@ impl QsvEncoder {
         self.ltr_active = ltr_active;
         self.ir_active = ir_active;
         self.ltr_slots = [None; NUM_LTR_SLOTS];
-        self.ltr_tainted = [false; NUM_LTR_SLOTS];
         self.next_ltr_slot = 0;
         self.pending_force = None;
         self.hdr_applied = self.hdr_meta;
@@ -1049,7 +1038,6 @@ impl Encoder for QsvEncoder {
                 // An IDR voids the decoder's reference buffers — drop stale slots and any
                 // queued force; the mark cadence below re-anchors on the IDR itself.
                 self.ltr_slots = [None; NUM_LTR_SLOTS];
-                self.ltr_tainted = [false; NUM_LTR_SLOTS]; // the IDR flushed the DPB with them
                 self.next_ltr_slot = 0;
                 self.pending_force = None;
             } else if self.ltr_test_force_at == Some(cur_idx) {
@@ -1065,9 +1053,7 @@ impl Encoder for QsvEncoder {
                 // emptied the slot since the force was queued. An empty slot means there is
                 // nothing clean to re-reference — the frame must ship as a plain P WITHOUT the
                 // `recovery_anchor` tag (the client lifts its post-loss freeze on that tag).
-                // The slot is no longer emptied by the sweep, so test the taint flag too — a
-                // tainted slot is exactly the "nothing clean to re-reference" case.
-                if let Some(idx) = self.ltr_slots[slot].filter(|_| !self.ltr_tainted[slot]) {
+                if let Some(idx) = self.ltr_slots[slot] {
                     force_ltr = Some((slot, idx));
                     recovery_anchor = true;
                 }
@@ -1075,9 +1061,6 @@ impl Encoder for QsvEncoder {
             if force_ltr.is_none() && (forced || cur_idx % self.ltr_mark_interval == 0) {
                 let slot = self.next_ltr_slot;
                 self.ltr_slots[slot] = Some(cur_idx);
-                // Re-marking replaces the hardware's LongTermIdx: the tainted frame is gone from
-                // the DPB and this slot is clean again.
-                self.ltr_tainted[slot] = false;
                 self.next_ltr_slot = (self.next_ltr_slot + 1) % NUM_LTR_SLOTS;
                 mark_slot = Some(slot);
             }
@@ -1340,23 +1323,13 @@ impl Encoder for QsvEncoder {
         // loss ships corruption as the recovery anchor, and every subsequent mark re-samples
         // the soup — the sustained-loss field failure where the picture never healed. Dropped
         // slots stay dropped; the cadence re-marks a clean frame within ~1/4 s.
-        //
-        // Mark tainted rather than clearing: `ltr_slots` mirrors the HARDWARE DPB, and nulling an
-        // entry issues no VPL call — the frame stays marked long-term in the encoder. Clearing it
-        // made the rejection list below (which iterates the post-sweep mirror and only names `Some`
-        // slots) silently SKIP the one entry the sweep exists to distrust, so the recovery frame
-        // could still predict from it. With two slots the "exactly one swept" case is the modal
-        // one, and it was the broken one.
-        for (slot, marked) in self.ltr_slots.iter().enumerate() {
+        for marked in self.ltr_slots.iter_mut() {
             if marked.is_some_and(|idx| idx >= first) {
-                self.ltr_tainted[slot] = true;
+                *marked = None;
             }
         }
         let mut best: Option<(usize, i64)> = None;
         for (slot, marked) in self.ltr_slots.iter().enumerate() {
-            if self.ltr_tainted[slot] {
-                continue; // still in the DPB, but encoded inside the corrupt window
-            }
             if let Some(idx) = *marked {
                 if idx < first && best.is_none_or(|(_, b)| idx > b) {
                     best = Some((slot, idx));
@@ -1481,7 +1454,6 @@ impl Encoder for QsvEncoder {
                 self.ltr_active = ltr;
                 self.ir_active = ir;
                 self.ltr_slots = [None; NUM_LTR_SLOTS];
-                self.ltr_tainted = [false; NUM_LTR_SLOTS];
                 self.next_ltr_slot = 0;
                 self.pending_force = None;
                 if let Some(inner) = self.inner.as_mut() {

crates/pf-encode/src/lib.rs

@@ -129,9 +129,6 @@ pub fn open_video(
     cuda: bool,
     bit_depth: u8,
     chroma: ChromaFormat,
-    // The session may hand this encoder cursor bitmaps to composite (cursor-as-metadata
-    // captures). Backends whose fast path can't blend (Vulkan EFC RGB-direct) key off it.
-    cursor_blend: bool,
 ) -> Result<Box<dyn Encoder>> {
     let (inner, backend) = open_video_backend(
         codec,
@@ -143,7 +140,6 @@ pub fn open_video(
         cuda,
         bit_depth,
         chroma,
-        cursor_blend,
     )?;
     // Record what this session encodes on (the mgmt API's "currently used GPU"): the backend label
     // is reported by `open_video_backend` from the branch that ACTUALLY opened — not re-derived by
@@ -207,34 +203,15 @@ impl Encoder for TrackedEncoder {
     fn invalidate_ref_frames(&mut self, first_frame: i64, last_frame: i64) -> bool {
         self.inner.invalidate_ref_frames(first_frame, last_frame)
     }
-    // Forwarded for the same reason as `set_wire_chunking` below — the unforwarded default
-    // (`false` = "backend can't pipeline, stop asking") silently killed the §7 LN3 contention
-    // escalation for every session, since the host loop only ever holds the wrapped box.
-    fn set_pipelined(&mut self, on: bool) -> bool {
-        self.inner.set_pipelined(on)
-    }
     // The classic TrackedEncoder trap: a defaulted trait method that isn't forwarded
     // silently no-ops through the wrapper (bit the direct-NVENC work, then THIS — the
     // §4.4 chunking probe run hit the default while the plan said Some(1408)).
     fn set_wire_chunking(&mut self, shard_payload: usize) {
         self.inner.set_wire_chunking(shard_payload)
     }
-    // Forwarded for the same reason as `set_wire_chunking` above — an unforwarded default here
-    // would silently leave the in-place backends pipelining past the capturer's ring.
-    fn set_input_ring_depth(&mut self, depth: usize) {
-        self.inner.set_input_ring_depth(depth)
-    }
     fn poll(&mut self) -> Result<Option<EncodedFrame>> {
         self.inner.poll()
     }
-    // Both chunked-poll methods forwarded (the same trap class): the defaults would report
-    // "not chunked" and wrap whole AUs, silently discarding the sub-frame overlap.
-    fn supports_chunked_poll(&self) -> bool {
-        self.inner.supports_chunked_poll()
-    }
-    fn poll_chunk(&mut self) -> Result<Option<AuChunk>> {
-        self.inner.poll_chunk()
-    }
     fn reset(&mut self) -> bool {
         self.inner.reset()
     }
@@ -268,9 +245,7 @@ fn open_video_backend(
     cuda: bool,
     bit_depth: u8,
     chroma: ChromaFormat,
-    cursor_blend: bool,
 ) -> Result<(Box<dyn Encoder>, &'static str)> {
-    let _ = cursor_blend; // consumed only by the Linux vulkan-encode arm below
     validate_dimensions(codec, width, height)?;
     // Refresh/fps must be positive and sane: fps feeds the encoder time_base (`Rational(1, fps)`)
     // and the pts→ns conversion (`pts * 1e9 / fps`), so 0 builds a 1/0 rational / divides by zero.
@@ -328,14 +303,8 @@ fn open_video_backend(
                 && vulkan_encode_enabled()
                 && !(bit_depth == 10 && format.is_hdr_rgb10())
             {
-                match vulkan_video::VulkanVideoEncoder::open(
-                    codec,
-                    width,
-                    height,
-                    fps,
-                    bitrate_bps,
-                    cursor_blend,
-                ) {
+                match vulkan_video::VulkanVideoEncoder::open(codec, width, height, fps, bitrate_bps)
+                {
                     Ok(e) => {
                         tracing::info!(
                             codec = ?codec,
@@ -388,15 +357,8 @@ fn open_video_backend(
                             "the Vulkan Video encoder supports HEVC + AV1; the session negotiated {codec:?}"
                         );
                     }
-                    vulkan_video::VulkanVideoEncoder::open(
-                        codec,
-                        width,
-                        height,
-                        fps,
-                        bitrate_bps,
-                        cursor_blend,
-                    )
-                    .map(|e| (Box::new(e) as Box<dyn Encoder>, "vulkan"))
+                    vulkan_video::VulkanVideoEncoder::open(codec, width, height, fps, bitrate_bps)
+                        .map(|e| (Box::new(e) as Box<dyn Encoder>, "vulkan"))
                 }
                 #[cfg(not(feature = "vulkan-encode"))]
                 {
@@ -1376,12 +1338,6 @@ mod vulkan_video;
 #[cfg(all(target_os = "linux", feature = "vulkan-encode"))]
 #[path = "enc/linux/vk_av1_encode.rs"]
 mod vk_av1_encode;
-// Vendored `VK_VALVE_video_encode_rgb_conversion` bindings (host-only) — RGB encode source with
-// the VCN EFC front-end doing the CSC (design/vulkan-rgb-direct-encode.md). ash 0.38 predates
-// the extension; same vendoring rationale as `vk_av1_encode`.
-#[cfg(all(target_os = "linux", feature = "vulkan-encode"))]
-#[path = "enc/linux/vk_valve_rgb.rs"]
-mod vk_valve_rgb;
 // Small ash leaf helpers shared by the Linux Vulkan encode backends (dmabuf import, image/memory
 // utilities) — extracted from `vulkan_video.rs` when the PyroWave backend arrived.
 #[cfg(all(

crates/pf-frame/src/dxgi.rs

@@ -52,12 +52,6 @@ pub struct PyroFrameShare {
     /// The fence value the capturer signalled after THIS frame's convert. The encoder's Vulkan
     /// acquire waits on it, so the wavelet read is ordered after the D3D11 CSC.
     pub fence_value: u64,
-    /// The capturer's ring generation, bumped every time it recreates its texture ring. The
-    /// PyroWave encoder caches its plane imports keyed on the texture's COM address, which carries
-    /// no reference — after a recreate those addresses can be recycled by the allocator, so a
-    /// cached import may describe a texture that no longer exists. The encoder flushes its import
-    /// cache whenever this changes, making cache identity independent of allocator behaviour.
-    pub ring_gen: u32,
 }
 
 /// A GPU-resident captured texture (the Windows zero-copy path: NVENC/AMF/QSV encode it in place;

crates/pf-inject/src/inject/linux/steam_gadget.rs

@@ -17,7 +17,7 @@
 use anyhow::{bail, Context, Result};
 use std::mem::size_of;
 use std::os::fd::RawFd;
-use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
 use std::thread::JoinHandle;
 
@@ -196,45 +196,6 @@ impl Drop for GadgetFd {
     }
 }
 
-/// The signal used to break a worker thread out of a blocking raw_gadget ioctl at teardown.
-/// `EVENT_FETCH`/`EP_WRITE` are `wait_event_interruptible` in the kernel with no timeout and no
-/// `O_NONBLOCK` honouring, and closing the fd cannot wake a thread already inside the ioctl (the
-/// in-flight syscall holds a reference to the struct file). A signal is the only reliable lever:
-/// delivered with a no-op, non-`SA_RESTART` handler it forces the ioctl to return `EINTR`, after
-/// which the loop's top-of-iteration `running` check exits. `SIGUSR1` is unused elsewhere in this
-/// process; the handler is a no-op, so a stray `SIGUSR1` becomes harmless rather than fatal.
-const WAKE_SIGNAL: libc::c_int = libc::SIGUSR1;
-
-/// Install the no-op `WAKE_SIGNAL` handler exactly once. Crucially `sa_flags = 0` (no `SA_RESTART`)
-/// so a delivered signal makes the interruptible ioctl return `EINTR` instead of auto-restarting.
-fn install_wake_handler() {
-    static ONCE: std::sync::Once = std::sync::Once::new();
-    ONCE.call_once(|| {
-        extern "C" fn noop(_: libc::c_int) {}
-        // SAFETY: installing a well-formed `sigaction` with an empty mask and a valid no-op handler
-        // for a single signal; touches only this process's disposition for `WAKE_SIGNAL`.
-        unsafe {
-            let mut sa: libc::sigaction = std::mem::zeroed();
-            // Via `*const ()`: casting a function item straight to an integer is what
-            // `clippy::function_casts_as_integer` rejects, and the pointer hop is the documented
-            // way to spell it. `sa_sigaction` is a `usize`-typed handler slot, so the value is
-            // unchanged.
-            sa.sa_sigaction = noop as *const () as usize;
-            libc::sigemptyset(&mut sa.sa_mask);
-            sa.sa_flags = 0;
-            libc::sigaction(WAKE_SIGNAL, &sa, std::ptr::null_mut());
-        }
-    });
-}
-
-/// Lets `Drop` wake a specific worker thread parked in a blocking ioctl. `tid` is the thread's
-/// `pthread_self()` (0 until it starts); `done` is set right before the thread returns, so `Drop`
-/// stops signalling a thread that has already exited.
-struct Waker {
-    tid: Arc<AtomicU64>,
-    done: Arc<AtomicBool>,
-}
-
 /// A virtual Steam Deck presented over the USB gadget subsystem. Dropping it stops the threads and
 /// closes the gadget (the kernel tears down the device).
 pub struct SteamDeckGadget {
@@ -242,7 +203,6 @@ pub struct SteamDeckGadget {
     feedback: Arc<Mutex<super::steam_proto::SteamFeedback>>,
     running: Arc<AtomicBool>,
     threads: Vec<JoinHandle<()>>,
-    wakers: Vec<Waker>,
     _fd: Arc<GadgetFd>,
     seq: u32,
 }
@@ -283,18 +243,6 @@ impl SteamDeckGadget {
         let ctrl_ep = Arc::new(std::sync::atomic::AtomicI32::new(-1));
         let configured = Arc::new(AtomicBool::new(false));
 
-        // The teardown wake path (see `WAKE_SIGNAL`) needs the handler installed before any thread
-        // can park in a blocking ioctl.
-        install_wake_handler();
-        let ctrl_waker = Waker {
-            tid: Arc::new(AtomicU64::new(0)),
-            done: Arc::new(AtomicBool::new(false)),
-        };
-        let stream_waker = Waker {
-            tid: Arc::new(AtomicU64::new(0)),
-            done: Arc::new(AtomicBool::new(false)),
-        };
-
         // Control thread: enumerate + answer every control transfer.
         let control = {
             let fd = fd.clone();
@@ -302,15 +250,10 @@ impl SteamDeckGadget {
             let ctrl_ep = ctrl_ep.clone();
             let configured = configured.clone();
             let feedback = feedback.clone();
-            let tid = ctrl_waker.tid.clone();
-            let done = ctrl_waker.done.clone();
             std::thread::Builder::new()
                 .name("pf-deck-gadget-ctrl".into())
                 .spawn(move || {
-                    // SAFETY: `pthread_self` is always valid on the calling thread.
-                    tid.store(unsafe { libc::pthread_self() } as u64, Ordering::SeqCst);
-                    control_loop(fd, running, ctrl_ep, configured, feedback, serial, unit_id);
-                    done.store(true, Ordering::SeqCst);
+                    control_loop(fd, running, ctrl_ep, configured, feedback, serial, unit_id)
                 })
                 .context("spawn gadget control thread")?
         };
@@ -321,16 +264,9 @@ impl SteamDeckGadget {
             let ctrl_ep = ctrl_ep.clone();
             let configured = configured.clone();
             let report = report.clone();
-            let tid = stream_waker.tid.clone();
-            let done = stream_waker.done.clone();
             std::thread::Builder::new()
                 .name("pf-deck-gadget-stream".into())
-                .spawn(move || {
-                    // SAFETY: `pthread_self` is always valid on the calling thread.
-                    tid.store(unsafe { libc::pthread_self() } as u64, Ordering::SeqCst);
-                    stream_loop(fd, running, ctrl_ep, configured, report);
-                    done.store(true, Ordering::SeqCst);
-                })
+                .spawn(move || stream_loop(fd, running, ctrl_ep, configured, report))
                 .context("spawn gadget stream thread")?
         };
 
@@ -339,7 +275,6 @@ impl SteamDeckGadget {
             feedback,
             running,
             threads: vec![control, stream],
-            wakers: vec![ctrl_waker, stream_waker],
             _fd: fd,
             seq: 0,
         })
@@ -367,32 +302,6 @@ impl SteamDeckGadget {
 impl Drop for SteamDeckGadget {
     fn drop(&mut self) {
         self.running.store(false, Ordering::SeqCst);
-        // The control thread spends steady state parked in a blocking `EVENT_FETCH` ioctl that only
-        // tests `running` at the top of its loop, so clearing the flag is not enough — it must be
-        // signalled out of the syscall (see `WAKE_SIGNAL`). Without this the join below can hang the
-        // caller (the session input thread, via `PadSlots::sweep`) indefinitely. Retry until each
-        // thread reports done, to cover the race where the signal lands just before the thread
-        // re-enters the ioctl; bounded (~1 s) so a genuinely stuck thread can't wedge teardown either.
-        for _ in 0..200 {
-            let mut all_done = true;
-            for w in &self.wakers {
-                if w.done.load(Ordering::SeqCst) {
-                    continue;
-                }
-                all_done = false;
-                let tid = w.tid.load(Ordering::SeqCst);
-                if tid != 0 {
-                    // SAFETY: the thread is joinable and not yet joined (join runs after this loop),
-                    // so `tid` names a live pthread; `pthread_kill` on a finished-but-unjoined thread
-                    // is defined (returns ESRCH), never UB.
-                    unsafe { libc::pthread_kill(tid as libc::pthread_t, WAKE_SIGNAL) };
-                }
-            }
-            if all_done {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
         for t in self.threads.drain(..) {
             let _ = t.join();
         }

crates/pf-inject/src/inject/windows/dualsense_windows.rs

@@ -299,20 +299,13 @@ pub(super) fn create_swdevice(p: &SwDeviceProfile) -> Result<(HSWDEVICE, Option<
     let event = unsafe { CreateEventW(None, true, false, PCWSTR::null())? };
     // `result` starts as E_FAIL, NOT S_OK: if the wait below times out, a zero-initialised HRESULT
     // would read as success and mask the failure (found by the 2026-07 driver-health audit).
-    // HEAP-allocated, deliberately: `sw_create_cb` writes `result` + up to 127 u16 of instance id
-    // through this pointer and then `SetEvent`s. The wait below is bounded (10 s), so on a wedged-PnP
-    // timeout the callback may still be PENDING — a stack context would be popped and a late callback
-    // would corrupt whatever the input thread put there next, and SetEvent a closed/recycled handle.
-    // On the timeout path we therefore LEAK the box and leave the event open (a one-off ~264 B + one
-    // HANDLE, only on that rare path) so a late callback always writes to live memory.
-    let ctx = Box::into_raw(Box::new(SwCreateCtx {
+    let mut ctx = SwCreateCtx {
         event,
         result: E_FAIL,
         instance_id: [0; 128],
-    }));
-    // SAFETY: info + the buffers outlive the call; `ctx` is a live heap allocation that outlives every
-    // path below (reclaimed only where the callback provably ran). windows-rs returns the HSWDEVICE
-    // (the C out-param) as the Result value.
+    };
+    // SAFETY: info + the buffers + ctx outlive the call (we wait on the event before returning);
+    // windows-rs returns the HSWDEVICE (the C out-param) as the Result value.
     let hsw = match unsafe {
         SwDeviceCreate(
             w!("punktfunk"),
@@ -320,15 +313,13 @@ pub(super) fn create_swdevice(p: &SwDeviceProfile) -> Result<(HSWDEVICE, Option<
             &info,
             None,
             Some(sw_create_cb),
-            Some(ctx as *const c_void),
+            Some(&mut ctx as *mut SwCreateCtx as *const c_void),
         )
     } {
         Ok(h) => h,
         Err(e) => {
-            // SAFETY: the call failed, so no callback was registered and `ctx` is ours to reclaim;
-            // `event` is valid and unreferenced.
+            // SAFETY: event is valid.
             unsafe {
-                drop(Box::from_raw(ctx));
                 let _ = CloseHandle(event);
             }
             return Err(anyhow!("SwDeviceCreate failed: {e}"));
@@ -337,22 +328,17 @@ pub(super) fn create_swdevice(p: &SwDeviceProfile) -> Result<(HSWDEVICE, Option<
     // Block until PnP finishes enumerating (the callback signals), then check its result.
     // SAFETY: event is valid.
     let wait = unsafe { WaitForSingleObject(event, 10_000) };
+    // SAFETY: event is valid.
+    unsafe {
+        let _ = CloseHandle(event);
+    }
     if wait != WAIT_OBJECT_0 {
-        // Timed out: the callback may still fire. Intentionally leak `ctx` AND leave `event` open so
-        // its eventual write + SetEvent target live memory/handle rather than freed ones.
         // SAFETY: hsw is the handle SwDeviceCreate returned.
         unsafe { SwDeviceClose(hsw) };
         return Err(anyhow!(
             "SwDeviceCreate enumeration callback never fired (10s) — PnP may be wedged"
         ));
     }
-    // The callback ran (it is what signalled the event), so nothing else will touch `ctx`/`event`.
-    // SAFETY: `ctx` came from `Box::into_raw` above and is reclaimed exactly once here; `event` is
-    // valid and no longer referenced by a pending callback.
-    let ctx = unsafe {
-        let _ = CloseHandle(event);
-        Box::from_raw(ctx)
-    };
     if ctx.result.is_err() {
         // SAFETY: hsw is the handle SwDeviceCreate returned.
         unsafe { SwDeviceClose(hsw) };

crates/pf-inject/src/inject/windows/dualshock4_windows.rs

@@ -62,7 +62,7 @@ impl Ds4WinPad {
             std::ptr::write_unaligned(base as *mut u32, SHM_MAGIC);
         }
         let inst = format!("pf_ds4_{index}");
-        let (hsw, instance_id) = create_swdevice(&SwDeviceProfile {
+        let (hsw, instance_id) = match create_swdevice(&SwDeviceProfile {
             instance: &inst,
             container_tag: 0x5046_4453, // "PFDS"
             container_index: index,
@@ -70,13 +70,13 @@ impl Ds4WinPad {
             usb_vid_pid: "VID_054C&PID_09CC",
             usb_mi: None,
             description: "punktfunk Virtual DualShock 4",
-        })?; // Propagate, do NOT swallow — see below.
-        let (hsw, instance_id) = (Some(hsw), instance_id);
-        // Swallowing a create failure here (the previous behaviour) latched the pad slot to
-        // `Some(pad)` with no live devnode: `PadSlots::ensure` short-circuits on `is_some()` and
-        // `gate.on_success()` cleared the backoff, so the create-gate that exists precisely to
-        // self-heal a transient PnP failure never retried. The game saw no controller for the whole
-        // session unless the client unplugged the pad. Matches the XUSB sibling, which propagates.
+        }) {
+            Ok((h, id)) => (Some(h), id),
+            Err(e) => {
+                tracing::warn!(error = %format!("{e:#}"), "SwDeviceCreate failed; DualShock 4 devnode unavailable");
+                (None, None)
+            }
+        };
         let _sw = hsw.map(super::gamepad_raii::SwDevice::new);
         // Bounded eager delivery — for the DS4 this is what closes the identity race: the driver
         // must read `device_type = 1` from the delivered DATA section before hidclass asks it for

crates/pf-inject/src/inject/windows/gamepad_windows.rs

@@ -82,16 +82,12 @@ fn create_swdevice(index: u8) -> Result<(HSWDEVICE, Option<String>)> {
     let event = unsafe { CreateEventW(None, true, false, PCWSTR::null())? };
     // `result` starts as E_FAIL, NOT S_OK: if the wait below times out, a zero-initialised HRESULT
     // would read as success and mask the failure (found by the 2026-07 driver-health audit).
-    // HEAP-allocated for the same reason as the DualSense sibling: the callback writes through this
-    // pointer and SetEvents, and the wait below is bounded — a stack context would be popped while a
-    // late callback still holds it. On the timeout path the box is deliberately leaked and the event
-    // left open so a late write/SetEvent always targets live memory/handle.
-    let ctx = Box::into_raw(Box::new(SwCreateCtx {
+    let mut ctx = SwCreateCtx {
         event,
         result: E_FAIL,
         instance_id: [0; 128],
-    }));
-    // SAFETY: info + buffers outlive the call; `ctx` is a live heap allocation outliving every path.
+    };
+    // SAFETY: info + buffers + ctx outlive the call (we wait on the event before returning).
     let hsw = match unsafe {
         SwDeviceCreate(
             w!("punktfunk"),
@@ -99,14 +95,13 @@ fn create_swdevice(index: u8) -> Result<(HSWDEVICE, Option<String>)> {
             &info,
             None,
             Some(sw_create_cb),
-            Some(ctx as *const c_void),
+            Some(&mut ctx as *mut SwCreateCtx as *const c_void),
         )
     } {
         Ok(h) => h,
         Err(e) => {
-            // SAFETY: the call failed, so no callback is pending and `ctx` is ours to reclaim.
+            // SAFETY: event is valid.
             unsafe {
-                drop(Box::from_raw(ctx));
                 let _ = CloseHandle(event);
             }
             return Err(anyhow!("SwDeviceCreate(pf_xusb) failed: {e}"));
@@ -114,20 +109,17 @@ fn create_swdevice(index: u8) -> Result<(HSWDEVICE, Option<String>)> {
     };
     // SAFETY: event valid; block until PnP finishes enumerating, then check the callback result.
     let wait = unsafe { WaitForSingleObject(event, 10_000) };
+    // SAFETY: event is valid.
+    unsafe {
+        let _ = CloseHandle(event);
+    }
     if wait != WAIT_OBJECT_0 {
-        // Timed out — intentionally leak `ctx` and leave `event` open (see above).
         // SAFETY: hsw is the handle SwDeviceCreate returned.
         unsafe { SwDeviceClose(hsw) };
         return Err(anyhow!(
             "SwDeviceCreate(pf_xusb) enumeration callback never fired (10s) — PnP may be wedged"
         ));
     }
-    // The callback ran (it signalled the event), so nothing else will touch `ctx`/`event`.
-    // SAFETY: `ctx` came from `Box::into_raw` and is reclaimed exactly once here.
-    let ctx = unsafe {
-        let _ = CloseHandle(event);
-        Box::from_raw(ctx)
-    };
     if ctx.result.is_err() {
         // SAFETY: hsw is the handle SwDeviceCreate returned.
         unsafe { SwDeviceClose(hsw) };

crates/pf-inject/src/inject/windows/steam_deck_windows.rs

@@ -66,7 +66,7 @@ impl DeckWinPad {
             std::ptr::write_unaligned(base as *mut u32, SHM_MAGIC);
         }
         let inst = format!("pf_deck_{index}");
-        let (hsw, instance_id) = create_swdevice(&SwDeviceProfile {
+        let (hsw, instance_id) = match create_swdevice(&SwDeviceProfile {
             instance: &inst,
             container_tag: 0x5046_4453, // "PFDS"
             container_index: index,
@@ -77,8 +77,13 @@ impl DeckWinPad {
             // spike's run-1 failure).
             usb_mi: Some(2),
             description: "punktfunk Virtual Steam Deck",
-        })?; // Propagate — swallowing latched the slot to a pad with no devnode (see the DS4 twin).
-        let (hsw, instance_id) = (Some(hsw), instance_id);
+        }) {
+            Ok((h, i)) => (Some(h), i),
+            Err(e) => {
+                tracing::warn!(error = %format!("{e:#}"), "SwDeviceCreate failed; Steam Deck devnode unavailable");
+                (None, None)
+            }
+        };
         let _sw = hsw.map(super::gamepad_raii::SwDevice::new);
         // Bounded eager delivery — the driver must read `device_type = 3` before hidclass asks
         // it for descriptors, or the pad would enumerate with the default DualSense identity.

crates/pf-presenter/Cargo.toml

@@ -11,11 +11,7 @@ repository.workspace = true
 # Same Linux+Windows gating as the rest of the client stack (dmabuf import is the one
 # Linux-only module — see lib.rs).
 [target.'cfg(any(target_os = "linux", windows))'.dependencies]
-# `default-features = false`: the PyroWave decode backend is turned on through THIS crate's own
-# `pyrowave` feature (which re-exports it below), never by inheriting the dependency's default.
-# Otherwise a consumer that deliberately builds us without `pyrowave` still drags the vendored
-# C++ in — fatal on Windows ARM64, where Granite has no SIMD path.
-pf-client-core = { path = "../pf-client-core", default-features = false }
+pf-client-core = { path = "../pf-client-core" }
 # AVVkFrame access (Vulkan Video frames: live sync state under the frames lock).
 pf-ffvk = { path = "../pf-ffvk" }
 punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }

crates/pf-zerocopy/src/imp/client.rs

@@ -21,7 +21,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Child, Command};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex, OnceLock};
-use std::time::{Duration, Instant};
+use std::time::Duration;
 
 /// Handshake budget: EGL + CUDA bring-up is ~200 ms; a cold driver load can take seconds.
 const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(20);
@@ -64,27 +64,11 @@ impl Drop for Shared {
 /// Children whose worker hasn't exited yet at `RemoteImporter` drop time (it exits on socket
 /// EOF, i.e. after the last in-flight frame drops). Swept on every spawn and every drop so
 /// workers don't linger as zombies for more than one capture generation.
-static REAPER: Mutex<Vec<(Child, Instant)>> = Mutex::new(Vec::new());
-
-/// How long past `REPLY_TIMEOUT` a parked worker may linger before it is force-killed. A worker
-/// wedged INSIDE a driver call never observes socket EOF, so `try_wait` alone would keep it (and
-/// its CUcontext + BufferPool — order hundreds of MB of VRAM) forever.
-const REAPER_KILL_DEADLINE: Duration = Duration::from_secs(20);
+static REAPER: Mutex<Vec<Child>> = Mutex::new(Vec::new());
 
 fn sweep_reaper() {
     let mut list = REAPER.lock().unwrap();
-    let now = Instant::now();
-    list.retain_mut(|(c, parked)| {
-        if matches!(c.try_wait(), Ok(Some(_))) {
-            return false; // exited on its own → reaped
-        }
-        if now.duration_since(*parked) > REAPER_KILL_DEADLINE {
-            let _ = c.kill();
-            let _ = c.wait();
-            return false; // wedged past the deadline → force-killed + reaped
-        }
-        true
-    });
+    list.retain_mut(|c| !matches!(c.try_wait(), Ok(Some(_))));
 }
 
 /// Fd pinned to this process's own executable image, opened (once, lazily) via the
@@ -471,7 +455,7 @@ impl Drop for RemoteImporter {
         // gone; park the rest for the next sweep.
         if let Some(mut child) = self.child.take() {
             if !matches!(child.try_wait(), Ok(Some(_))) {
-                REAPER.lock().unwrap().push((child, Instant::now()));
+                REAPER.lock().unwrap().push(child);
             }
         }
         sweep_reaper();

crates/pf-zerocopy/src/imp/cuda.rs

@@ -251,32 +251,6 @@ unsafe fn copy_blocking(copy: &CUDA_MEMCPY2D, what: &str) -> Result<()> {
     ck(cuStreamSynchronize(stream), "cuStreamSynchronize")
 }
 
-/// Issue `copy` on this thread's priority stream WITHOUT waiting — for stream-ordered consumers
-/// only (the direct-NVENC submit path with `NvEncSetIOCudaStreams` bound to this stream): the
-/// stream, not the CPU, orders completion, so the SOURCE must stay valid until the downstream
-/// stream work (the encode) has finished.
-unsafe fn copy_async(copy: &CUDA_MEMCPY2D, what: &str) -> Result<()> {
-    ck(cuMemcpy2DAsync_v2(copy, copy_stream()), what)
-}
-
-/// `copy_blocking` when `sync`, else `copy_async` — the shared tail of the public `copy_*_to_device`
-/// helpers, whose `sync: false` mode carries `copy_async`'s source-lifetime contract.
-unsafe fn copy_issue(copy: &CUDA_MEMCPY2D, what: &str, sync: bool) -> Result<()> {
-    if sync {
-        copy_blocking(copy, what)
-    } else {
-        copy_async(copy, what)
-    }
-}
-
-/// The calling thread's copy/launch stream as a raw handle, for binding external stream-ordering
-/// (the direct-NVENC `NvEncSetIOCudaStreams` hookup). Null = the NULL stream (priority-stream
-/// creation failed) — callers should treat null as "stream-ordering unavailable" and keep their
-/// blocking copies. The shared context must be current on this thread.
-pub fn copy_stream_handle() -> *mut c_void {
-    copy_stream() // CUstream IS *mut c_void (opaque CUstream_st*)
-}
-
 /// Max cursor-overlay bitmap edge (px) uploaded to the device blend buffer — matches the Vulkan path.
 pub const CURSOR_MAX: u32 = 256;
 
@@ -380,7 +354,6 @@ impl CursorBlend {
         ch: u32,
         ox: i32,
         oy: i32,
-        sync: bool,
     ) -> Result<()> {
         let (mut a_surf, mut a_cur) = (surf, self.cur_buf);
         let (mut a_pitch, mut a_w, mut a_h) = (pitch as i32, w as i32, h as i32);
@@ -397,7 +370,7 @@ impl CursorBlend {
             &mut a_ox as *mut _ as *mut c_void,
             &mut a_oy as *mut _ as *mut c_void,
         ];
-        self.launch(self.f_argb, a_cw as u32, a_ch as u32, &mut args, sync)
+        self.launch(self.f_argb, a_cw as u32, a_ch as u32, &mut args)
     }
 
     /// Blend into an owned planar YUV444 surface (3 stacked full-res planes) at `(ox,oy)`.
@@ -412,7 +385,6 @@ impl CursorBlend {
         ch: u32,
         ox: i32,
         oy: i32,
-        sync: bool,
     ) -> Result<()> {
         let (mut a_base, mut a_cur) = (base, self.cur_buf);
         let (mut a_pitch, mut a_w, mut a_h) = (pitch as i32, w as i32, h as i32);
@@ -429,7 +401,7 @@ impl CursorBlend {
             &mut a_ox as *mut _ as *mut c_void,
             &mut a_oy as *mut _ as *mut c_void,
         ];
-        self.launch(self.f_yuv444, a_cw as u32, a_ch as u32, &mut args, sync)
+        self.launch(self.f_yuv444, a_cw as u32, a_ch as u32, &mut args)
     }
 
     /// Blend into an owned NV12 surface (Y plane at `base`, interleaved UV at `base + pitch*h`).
@@ -444,7 +416,6 @@ impl CursorBlend {
         ch: u32,
         ox: i32,
         oy: i32,
-        sync: bool,
     ) -> Result<()> {
         let (mut a_yb, mut a_uvb, mut a_cur) = (base, base + pitch as u64 * h as u64, self.cur_buf);
         let (mut a_yp, mut a_uvp) = (pitch as i32, pitch as i32);
@@ -470,20 +441,16 @@ impl CursorBlend {
             (a_cw as u32).div_ceil(2),
             (a_ch as u32).div_ceil(2),
             &mut args,
-            sync,
         )
     }
 
-    /// Launch `f` over a `work_w × work_h` grid (16×16 blocks) on the copy stream; `sync` waits
-    /// for it, `!sync` leaves completion to the stream (stream-ordered consumers only — the
-    /// kernel PARAMETERS are copied at launch time, so the arg locals need not outlive the call).
+    /// Launch `f` over a `work_w × work_h` grid (16×16 blocks) on the copy stream, then synchronize.
     fn launch(
         &self,
         f: CUfunction,
         work_w: u32,
         work_h: u32,
         args: &mut [*mut c_void],
-        sync: bool,
     ) -> Result<()> {
         if work_w == 0 || work_h == 0 {
             return Ok(());
@@ -491,11 +458,9 @@ impl CursorBlend {
         const B: u32 = 16;
         let stream = copy_stream();
         // SAFETY: `f` is a resolved kernel from our loaded module; `args` holds pointers to live
-        // locals whose types match the kernel's C parameters (per the call site above) — CUDA
-        // copies the parameter values during `cuLaunchKernel` itself, so they need not outlive
-        // the call. Grid/block dims are non-zero. Launched on the copy stream (ordered after the
-        // input-surface copy issued on the same stream); `sync` waits, `!sync` leaves ordering to
-        // the stream (the NVENC IO-stream binding). Requires the context current.
+        // locals whose types match the kernel's C parameters (per the call site above); grid/block
+        // dims are non-zero. Launched on the copy stream (ordered after the input-surface copy that
+        // `copy_into_slot` already synchronized) then synchronized. Requires the context current.
         unsafe {
             ck(
                 cuLaunchKernel(
@@ -513,10 +478,7 @@ impl CursorBlend {
                 ),
                 "cuLaunchKernel(cursor)",
             )?;
-            if sync {
-                ck(cuStreamSynchronize(stream), "cuStreamSynchronize(cursor)")?;
-            }
-            Ok(())
+            ck(cuStreamSynchronize(stream), "cuStreamSynchronize(cursor)")
         }
     }
 }
@@ -1041,13 +1003,7 @@ impl RegisteredTexture {
         // SAFETY: `self.resource` is the valid `CUgraphicsResource` from a successful `register_gl`
         // (its only constructor), so the wrappers forward to the live table; the caller holds the
         // GL+CUDA contexts current (the registration's contract). `cuGraphicsMapResources` maps
-        // `count == 1` resource via `&mut self.resource` (a live field). It is issued on
-        // `copy_stream()` — NOT the NULL stream — because map's only ordering guarantee is that
-        // prior GL work completes before subsequent CUDA work issued IN THE STREAM PASSED TO IT;
-        // the copy below runs on `copy_stream()` (a `CU_STREAM_NON_BLOCKING` stream, exempt from
-        // implicit NULL-stream ordering), so mapping on NULL left the copy free to race the GL
-        // de-tile/CSC that produced this texture (glFlush only, no fence) — intermittent torn or
-        // stale frames under GPU load. Map, copy, and unmap now all share `copy_stream()`.
+        // `count == 1` resource via `&mut self.resource` (a live field) on the default stream;
         // `cuGraphicsSubResourceGetMappedArray` writes the mapped `CUarray` into the live local
         // `array` (index 0, mip 0). On failure we unmap and bail (balanced). `&copy` is a live
         // local `CUDA_MEMCPY2D` outliving the synchronous `copy_blocking`: `srcArray` is valid
@@ -1056,12 +1012,12 @@ impl RegisteredTexture {
         // we always unmap afterward (even on error), keeping the map/unmap pair balanced.
         unsafe {
             ck(
-                cuGraphicsMapResources(1, &mut self.resource, copy_stream()),
+                cuGraphicsMapResources(1, &mut self.resource, std::ptr::null_mut()),
                 "cuGraphicsMapResources",
             )?;
             let mut array: CUarray = std::ptr::null_mut();
             if cuGraphicsSubResourceGetMappedArray(&mut array, self.resource, 0, 0) != 0 {
-                let _ = cuGraphicsUnmapResources(1, &mut self.resource, copy_stream());
+                let _ = cuGraphicsUnmapResources(1, &mut self.resource, std::ptr::null_mut());
                 bail!("cuGraphicsSubResourceGetMappedArray failed");
             }
             let copy = CUDA_MEMCPY2D {
@@ -1075,7 +1031,7 @@ impl RegisteredTexture {
                 ..Default::default()
             };
             let res = copy_blocking(&copy, "cuMemcpy2DAsync_v2");
-            let _ = cuGraphicsUnmapResources(1, &mut self.resource, copy_stream());
+            let _ = cuGraphicsUnmapResources(1, &mut self.resource, std::ptr::null_mut());
             res
         }
     }
@@ -1102,12 +1058,12 @@ impl RegisteredTexture {
         // so the map/unmap pair stays balanced and the array outlives the copy.
         unsafe {
             ck(
-                cuGraphicsMapResources(1, &mut self.resource, copy_stream()),
+                cuGraphicsMapResources(1, &mut self.resource, std::ptr::null_mut()),
                 "cuGraphicsMapResources",
             )?;
             let mut array: CUarray = std::ptr::null_mut();
             if cuGraphicsSubResourceGetMappedArray(&mut array, self.resource, 0, 0) != 0 {
-                let _ = cuGraphicsUnmapResources(1, &mut self.resource, copy_stream());
+                let _ = cuGraphicsUnmapResources(1, &mut self.resource, std::ptr::null_mut());
                 bail!("cuGraphicsSubResourceGetMappedArray failed");
             }
             let copy = CUDA_MEMCPY2D {
@@ -1121,7 +1077,7 @@ impl RegisteredTexture {
                 ..Default::default()
             };
             let res = copy_blocking(&copy, "cuMemcpy2DAsync_v2(plane)");
-            let _ = cuGraphicsUnmapResources(1, &mut self.resource, copy_stream());
+            let _ = cuGraphicsUnmapResources(1, &mut self.resource, std::ptr::null_mut());
             res
         }
     }
@@ -1166,13 +1122,10 @@ pub fn copy_mapped_yuv444(
 /// Copy a pitched device buffer into another device region (device→device), e.g. our imported
 /// [`DeviceBuffer`] into a pooled CUDA surface NVENC owns. Both are 4-byte (BGRx) pixels.
 /// The caller must have the shared context current on this thread (see [`make_current`]).
-/// `sync: false` enqueues without a CPU wait (stream-ordered consumers only — `src` must stay
-/// valid until the downstream stream work completes; see [`copy_stream_handle`]).
 pub fn copy_device_to_device(
     src: &DeviceBuffer,
     dst_ptr: CUdeviceptr,
     dst_pitch: usize,
-    sync: bool,
 ) -> Result<()> {
     let copy = CUDA_MEMCPY2D {
         srcMemoryType: CU_MEMORYTYPE_DEVICE,
@@ -1185,27 +1138,23 @@ pub fn copy_device_to_device(
         Height: src.height as usize,
         ..Default::default()
     };
-    // SAFETY: `copy_issue` is unsafe (issues a CUDA copy); the caller must have the shared
+    // SAFETY: `copy_blocking` is unsafe (issues a CUDA copy); the caller must have the shared
     // context current (documented). `&copy` is a live local device→device `CUDA_MEMCPY2D` outliving
-    // the enqueue: `srcDevice`/`srcPitch` are `src`'s live allocation, `dstDevice`/`dstPitch` the
-    // caller's live region, `width*4`×`height` within both; `sync: false` shifts the source-
-    // lifetime obligation to the caller (documented above). Wrapper → live table.
-    unsafe { copy_issue(&copy, "cuMemcpy2DAsync_v2(dev->dev)", sync) }
+    // the synchronous call: `srcDevice`/`srcPitch` are `src`'s live allocation, `dstDevice`/
+    // `dstPitch` the caller's live region, `width*4`×`height` within both. Wrapper → live table.
+    unsafe { copy_blocking(&copy, "cuMemcpy2DAsync_v2(dev->dev)") }
 }
 
 /// Copy our imported NV12 [`DeviceBuffer`] (Y + UV planes) into NVENC's two-plane CUDA surface
 /// `(y_dst, y_pitch)` / `(uv_dst, uv_pitch)` (`av_hwframe_get_buffer`'s `data[0]`/`data[1]` +
 /// `linesize[0]`/`linesize[1]`). The Y plane is `width`×`height` bytes; the chroma plane is
 /// `(width/2)·2` bytes × `height/2` rows. The caller must have the shared context current.
-/// `sync: false` enqueues without a CPU wait (stream-ordered consumers only — `src` must stay
-/// valid until the downstream stream work completes; see [`copy_stream_handle`]).
 pub fn copy_nv12_to_device(
     src: &DeviceBuffer,
     y_dst: CUdeviceptr,
     y_pitch: usize,
     uv_dst: CUdeviceptr,
     uv_pitch: usize,
-    sync: bool,
 ) -> Result<()> {
     let (src_uv_ptr, src_uv_pitch) = src
         .uv
@@ -1234,16 +1183,15 @@ pub fn copy_nv12_to_device(
         Height: h / 2,
         ..Default::default()
     };
-    // SAFETY: two unsafe `copy_issue` device→device copies; the caller must have the shared
+    // SAFETY: two unsafe `copy_blocking` device→device copies; the caller must have the shared
     // context current (documented). `&y`/`&uv` are live local `CUDA_MEMCPY2D`s outliving each
-    // enqueue. All four device pointers are valid: `src.ptr`/`src_uv_ptr` come from a live
+    // synchronous call. All four device pointers are valid: `src.ptr`/`src_uv_ptr` come from a live
     // NV12 `DeviceBuffer` (its `.uv` presence was checked via `ok_or_else`), `y_dst`/`uv_dst` are
     // the caller's live NVENC surface planes; the luma copy is `w`×`h`, the chroma copy
-    // `(w/2)*2`×`h/2`, each within its planes; `sync: false` shifts the source-lifetime obligation
-    // to the caller (documented above). Wrappers → live table.
+    // `(w/2)*2`×`h/2`, each within its planes. Wrappers → live table.
     unsafe {
-        copy_issue(&y, "cuMemcpy2DAsync_v2(nv12 Y dev->dev)", sync)?;
-        copy_issue(&uv, "cuMemcpy2DAsync_v2(nv12 UV dev->dev)", sync)
+        copy_blocking(&y, "cuMemcpy2DAsync_v2(nv12 Y dev->dev)")?;
+        copy_blocking(&uv, "cuMemcpy2DAsync_v2(nv12 UV dev->dev)")
     }
 }
 
@@ -1251,13 +1199,7 @@ pub fn copy_nv12_to_device(
 /// (`av_hwframe_get_buffer`'s `data[0..3]` + `linesize[0..3]` for a `yuv444p` frames context).
 /// Each plane is `width`×`height` bytes; the source planes sit at row offsets `0/H/2H` of the
 /// single allocation. The caller must have the shared context current.
-/// `sync: false` enqueues without a CPU wait (stream-ordered consumers only — `src` must stay
-/// valid until the downstream stream work completes; see [`copy_stream_handle`]).
-pub fn copy_yuv444_to_device(
-    src: &DeviceBuffer,
-    dsts: [(CUdeviceptr, usize); 3],
-    sync: bool,
-) -> Result<()> {
+pub fn copy_yuv444_to_device(src: &DeviceBuffer, dsts: [(CUdeviceptr, usize); 3]) -> Result<()> {
     anyhow::ensure!(src.yuv444, "copy_yuv444_to_device on a non-YUV444 buffer");
     let w = src.width as usize;
     let h = src.height as usize;
@@ -1273,13 +1215,12 @@ pub fn copy_yuv444_to_device(
             Height: h,
             ..Default::default()
         };
-        // SAFETY: unsafe `copy_issue` device→device copy; the caller must have the shared
-        // context current (documented). `&copy` is a live local outliving the enqueue;
+        // SAFETY: unsafe `copy_blocking` device→device copy; the caller must have the shared
+        // context current (documented). `&copy` is a live local outliving the synchronous call;
         // `src.ptr + pitch·h·i` stays within the live 3·H-row stacked allocation (`yuv444`
         // checked above), `dst_ptr`/`dst_pitch` is the caller's live NVENC plane; `w`×`h` fits
-        // both; `sync: false` shifts the source-lifetime obligation to the caller (documented
-        // above). Wrapper → live table.
-        unsafe { copy_issue(&copy, "cuMemcpy2DAsync_v2(yuv444 plane dev->dev)", sync)? };
+        // both. Wrapper → live table.
+        unsafe { copy_blocking(&copy, "cuMemcpy2DAsync_v2(yuv444 plane dev->dev)")? };
     }
     Ok(())
 }

crates/pf-zerocopy/src/imp/egl.rs

@@ -691,15 +691,6 @@ impl EglImporter {
         width: u32,
         height: u32,
     ) -> Result<DeviceBuffer> {
-        // Even dimensions only: the UV copy walks `height.div_ceil(2)` chroma rows (the correct NV12
-        // count), but the pooled UV plane is sized at `height/2` rows — for an odd height those
-        // disagree by one row and the copy writes a full `uv_pitch` past the allocation (OOB device
-        // write / CUDA_ERROR_ILLEGAL_ADDRESS that poisons the shared context). Reject here, matching
-        // the guards `Nv12Blit::new`/`Yuv444Blit::new` already carry.
-        anyhow::ensure!(
-            width % 2 == 0 && height % 2 == 0,
-            "LINEAR NV12 needs even dimensions (got {width}x{height})"
-        );
         cuda::make_current()?;
         if self
             .linear_nv12_pool

crates/pf-zerocopy/src/imp/vulkan.rs

@@ -86,11 +86,9 @@ impl VkBridge {
         // SAFETY: standard ash bring-up — every call is `unsafe` only because ash cannot statically
         // verify Vulkan handle/CreateInfo validity. `ash::Entry::load` dlopens a real system
         // libvulkan. Each `*CreateInfo`/`AllocateInfo` is built by ash's builders from locals (`app`,
-        // `exts`, `prio`, `qci`, `gp_info`, and the inline infos) that all live for the duration of
-        // the synchronous `create_*`/`enumerate_*` call that reads them — the ladder loop rebuilds
-        // `prio`/`gp_info`/`qci`/`exts` fresh per attempt, so every `enabled_extension_names(&exts)`
-        // / `queue_priorities(&prio)` / `push_next(&mut gp_info)` borrow outlives its own
-        // `create_device` call.
+        // `exts`, `prio`, `qci`, and the inline infos) that all live for the duration of the
+        // synchronous `create_*`/`enumerate_*` call that reads them — in particular the
+        // `enabled_extension_names(&exts)` and `queue_priorities(&prio)` borrows outlive their calls.
         // Every handle passed (`instance`, `phys`, `device`, `qf`, `cmd_pool`) was just created and
         // checked via `?`/`ok_or_else` in this same function, so no invalid handle is ever used. This
         // constructor shares nothing across threads.
@@ -124,93 +122,23 @@ impl VkBridge {
                 .ok_or_else(|| anyhow!("no compute-capable queue family"))?
                 as u32;
 
-            // Global-priority queue (latency plan §7 LN4, PyroWave's `ac0e7332` lever for the
-            // VkBridge): the LINEAR/gamescope CSC dispatch shares the SM/compute cores with the
-            // game, so ask for an elevated global priority to get scheduled ahead of it.
-            // `PUNKTFUNK_VK_QUEUE_PRIORITY` = off | high | realtime (default realtime); the
-            // create loop downgrades REALTIME→HIGH→none on NOT_PERMITTED (and retries a plain
-            // create on INITIALIZATION_FAILED) so a refused class never fails the bridge.
-            let gp_ext = std::env::var("PUNKTFUNK_VK_QUEUE_PRIORITY")
-                .ok()
-                .as_deref()
-                .map_or(Some(vk::QueueGlobalPriorityKHR::REALTIME), |v| match v {
-                    "off" | "0" => None,
-                    "high" => Some(vk::QueueGlobalPriorityKHR::HIGH),
-                    _ => Some(vk::QueueGlobalPriorityKHR::REALTIME),
-                })
-                .and_then(|want| {
-                    // Enable whichever alias the driver advertises (KHR = the promoted name).
-                    let props = instance.enumerate_device_extension_properties(phys).ok()?;
-                    let has = |name: &std::ffi::CStr| {
-                        props
-                            .iter()
-                            .any(|p| p.extension_name_as_c_str() == Ok(name))
-                    };
-                    if has(vk::KHR_GLOBAL_PRIORITY_NAME) {
-                        Some((vk::KHR_GLOBAL_PRIORITY_NAME, want))
-                    } else if has(vk::EXT_GLOBAL_PRIORITY_NAME) {
-                        Some((vk::EXT_GLOBAL_PRIORITY_NAME, want))
-                    } else {
-                        None
-                    }
-                });
-            let base_exts = [
+            let exts = [
                 ash::khr::external_memory_fd::NAME.as_ptr(),
                 ash::ext::external_memory_dma_buf::NAME.as_ptr(),
             ];
-            let mut try_priority = gp_ext.map(|(_, want)| want);
-            let device = loop {
-                let prio = [1.0f32];
-                let mut gp_info = vk::DeviceQueueGlobalPriorityCreateInfoKHR::default()
-                    .global_priority(try_priority.unwrap_or(vk::QueueGlobalPriorityKHR::MEDIUM));
-                let mut qci0 = vk::DeviceQueueCreateInfo::default()
-                    .queue_family_index(qf)
-                    .queue_priorities(&prio);
-                let mut exts: Vec<*const std::ffi::c_char> = base_exts.to_vec();
-                if try_priority.is_some() {
-                    qci0 = qci0.push_next(&mut gp_info);
-                    exts.push(gp_ext.expect("try_priority implies gp_ext").0.as_ptr());
-                }
-                let qci = [qci0];
-                match instance.create_device(
+            let prio = [1.0f32];
+            let qci = [vk::DeviceQueueCreateInfo::default()
+                .queue_family_index(qf)
+                .queue_priorities(&prio)];
+            let device = instance
+                .create_device(
                     phys,
                     &vk::DeviceCreateInfo::default()
                         .queue_create_infos(&qci)
                         .enabled_extension_names(&exts),
                     None,
-                ) {
-                    Ok(d) => {
-                        if let Some(p) = try_priority {
-                            tracing::info!(
-                                priority = ?p,
-                                "VkBridge queue at elevated global priority (CSC schedules \
-                                 ahead of a GPU-bound game where the driver honors it)"
-                            );
-                        }
-                        break d;
-                    }
-                    // A refused class must never fail the bridge — walk the ladder down.
-                    Err(
-                        vk::Result::ERROR_NOT_PERMITTED_KHR
-                        | vk::Result::ERROR_INITIALIZATION_FAILED,
-                    ) if try_priority == Some(vk::QueueGlobalPriorityKHR::REALTIME) => {
-                        try_priority = Some(vk::QueueGlobalPriorityKHR::HIGH);
-                    }
-                    Err(
-                        vk::Result::ERROR_NOT_PERMITTED_KHR
-                        | vk::Result::ERROR_INITIALIZATION_FAILED,
-                    ) if try_priority.is_some() => {
-                        tracing::debug!(
-                            "global-priority queue not permitted — VkBridge at default priority"
-                        );
-                        try_priority = None;
-                    }
-                    Err(e) => {
-                        return Err(e)
-                            .context("vkCreateDevice (external-memory extensions supported?)")
-                    }
-                }
-            };
+                )
+                .context("vkCreateDevice (external-memory extensions supported?)")?;
             let ext_fd = ash::khr::external_memory_fd::Device::new(&instance, &device);
             let queue = device.get_device_queue(qf, 0);
 
@@ -265,17 +193,10 @@ impl VkBridge {
 
     /// Import `fd` (dup'd internally; Vulkan owns the dup) as a transfer-src buffer of `size`.
     unsafe fn import_src(&mut self, fd: i32, size: u64) -> Result<()> {
-        use std::os::fd::{AsRawFd, FromRawFd, IntoRawFd, OwnedFd};
         let dup = libc::dup(fd);
         if dup < 0 {
             bail!("dup(dmabuf fd)");
         }
-        // Own the dup so every early return BEFORE Vulkan consumes it (at `allocate_memory` success)
-        // closes it. `SrcBuf` holds raw handles with no Drop and is only populated on the success
-        // path, so each fallible step below must also destroy the buffer it created — otherwise a
-        // failed import (which the worker survives and the caller retries every frame) leaks a
-        // VkBuffer + VkDeviceMemory + fd per frame for the worker's whole lifetime.
-        let dup = OwnedFd::from_raw_fd(dup);
         let mut ext_info = vk::ExternalMemoryBufferCreateInfo::default()
             .handle_types(vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT);
         let buffer = self
@@ -291,55 +212,41 @@ impl VkBridge {
                     .push_next(&mut ext_info),
                 None,
             )
-            .context("create import buffer")?; // `dup` drops → closes on failure
+            .context("create import buffer")?;
         let mut fd_props = vk::MemoryFdPropertiesKHR::default();
-        if let Err(e) = self.ext_fd.get_memory_fd_properties(
-            vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT,
-            dup.as_raw_fd(),
-            &mut fd_props,
-        ) {
-            self.device.destroy_buffer(buffer, None);
-            return Err(e).context("vkGetMemoryFdPropertiesKHR");
-        }
+        self.ext_fd
+            .get_memory_fd_properties(
+                vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT,
+                dup,
+                &mut fd_props,
+            )
+            .context("vkGetMemoryFdPropertiesKHR")?;
         let reqs = self.device.get_buffer_memory_requirements(buffer);
-        let mem_type = match self.memory_type(
+        let mem_type = self.memory_type(
             reqs.memory_type_bits & fd_props.memory_type_bits,
             vk::MemoryPropertyFlags::empty(),
-        ) {
-            Ok(t) => t,
-            Err(e) => {
-                self.device.destroy_buffer(buffer, None);
-                return Err(e);
-            }
-        };
-        // Vulkan takes ownership of the fd on a SUCCESSFUL import: hand over the raw fd now, and on
-        // failure close it ourselves (matching the original contract) plus destroy the buffer.
-        let raw = dup.into_raw_fd();
+        )?;
         let mut import = vk::ImportMemoryFdInfoKHR::default()
             .handle_type(vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT)
-            .fd(raw);
+            .fd(dup); // Vulkan takes ownership of `dup` on success
         let mut dedicated = vk::MemoryDedicatedAllocateInfo::default().buffer(buffer);
-        let memory = match self.device.allocate_memory(
-            &vk::MemoryAllocateInfo::default()
-                .allocation_size(reqs.size.max(size))
-                .memory_type_index(mem_type)
-                .push_next(&mut import)
-                .push_next(&mut dedicated),
-            None,
-        ) {
-            Ok(m) => m,
-            Err(e) => {
-                libc::close(raw); // failed import does not consume the fd
-                self.device.destroy_buffer(buffer, None);
-                return Err(anyhow!("import dmabuf memory: {e}"));
-            }
-        };
-        if let Err(e) = self.device.bind_buffer_memory(buffer, memory, 0) {
-            // `memory` owns the imported fd — freeing it releases the fd too.
-            self.device.free_memory(memory, None);
-            self.device.destroy_buffer(buffer, None);
-            return Err(e).context("bind import memory");
-        }
+        let memory = self
+            .device
+            .allocate_memory(
+                &vk::MemoryAllocateInfo::default()
+                    .allocation_size(reqs.size.max(size))
+                    .memory_type_index(mem_type)
+                    .push_next(&mut import)
+                    .push_next(&mut dedicated),
+                None,
+            )
+            .map_err(|e| {
+                libc::close(dup); // failed import does not consume the fd
+                anyhow!("import dmabuf memory: {e}")
+            })?;
+        self.device
+            .bind_buffer_memory(buffer, memory, 0)
+            .context("bind import memory")?;
         self.src_cache.insert(
             fd,
             SrcBuf {
@@ -356,11 +263,11 @@ impl VkBridge {
         if self.dst.as_ref().is_some_and(|d| d.size >= size) {
             return Ok(());
         }
-        // Build the replacement FULLY before retiring the old one. Previously the old dst was
-        // destroyed and `self.dst` nulled up front, so a failed rebuild both dropped the working
-        // buffer AND leaked every object the partial rebuild created (`buffer`/`memory` are raw ash
-        // handles with no Drop, and `VkBridge::drop` only frees the live `self.dst`). Now every
-        // fallible step unwinds locally, and the swap happens only on full success.
+        if let Some(old) = self.dst.take() {
+            self.device.destroy_buffer(old.buffer, None);
+            self.device.free_memory(old.memory, None);
+            // old.cuda drops its mapping with it
+        }
         let mut ext_info = vk::ExternalMemoryBufferCreateInfo::default()
             .handle_types(vk::ExternalMemoryHandleTypeFlags::OPAQUE_FD);
         let buffer = self
@@ -378,63 +285,35 @@ impl VkBridge {
             .context("create export buffer")?;
         let reqs = self.device.get_buffer_memory_requirements(buffer);
         let mem_type =
-            match self.memory_type(reqs.memory_type_bits, vk::MemoryPropertyFlags::DEVICE_LOCAL) {
-                Ok(t) => t,
-                Err(e) => {
-                    self.device.destroy_buffer(buffer, None);
-                    return Err(e);
-                }
-            };
+            self.memory_type(reqs.memory_type_bits, vk::MemoryPropertyFlags::DEVICE_LOCAL)?;
         let mut export = vk::ExportMemoryAllocateInfo::default()
             .handle_types(vk::ExternalMemoryHandleTypeFlags::OPAQUE_FD);
         let mut dedicated = vk::MemoryDedicatedAllocateInfo::default().buffer(buffer);
-        let memory = match self.device.allocate_memory(
-            &vk::MemoryAllocateInfo::default()
-                .allocation_size(reqs.size)
-                .memory_type_index(mem_type)
-                .push_next(&mut export)
-                .push_next(&mut dedicated),
-            None,
-        ) {
-            Ok(m) => m,
-            Err(e) => {
-                self.device.destroy_buffer(buffer, None);
-                return Err(e).context("allocate exportable memory");
-            }
-        };
-        if let Err(e) = self.device.bind_buffer_memory(buffer, memory, 0) {
-            self.device.free_memory(memory, None);
-            self.device.destroy_buffer(buffer, None);
-            return Err(e).context("bind export memory");
-        }
-        let opaque_fd = match self.ext_fd.get_memory_fd(
-            &vk::MemoryGetFdInfoKHR::default()
-                .memory(memory)
-                .handle_type(vk::ExternalMemoryHandleTypeFlags::OPAQUE_FD),
-        ) {
-            Ok(f) => f,
-            Err(e) => {
-                self.device.free_memory(memory, None);
-                self.device.destroy_buffer(buffer, None);
-                return Err(e).context("vkGetMemoryFdKHR");
-            }
-        };
+        let memory = self
+            .device
+            .allocate_memory(
+                &vk::MemoryAllocateInfo::default()
+                    .allocation_size(reqs.size)
+                    .memory_type_index(mem_type)
+                    .push_next(&mut export)
+                    .push_next(&mut dedicated),
+                None,
+            )
+            .context("allocate exportable memory")?;
+        self.device
+            .bind_buffer_memory(buffer, memory, 0)
+            .context("bind export memory")?;
+        let opaque_fd = self
+            .ext_fd
+            .get_memory_fd(
+                &vk::MemoryGetFdInfoKHR::default()
+                    .memory(memory)
+                    .handle_type(vk::ExternalMemoryHandleTypeFlags::OPAQUE_FD),
+            )
+            .context("vkGetMemoryFdKHR")?;
         // CUDA imports (and on success owns) the exported fd. Size must match the allocation.
-        // `import_owned_fd` closes `opaque_fd` on its own failure, so only the Vulkan objects unwind.
-        let cuda = match cuda::ExternalDmabuf::import_owned_fd(opaque_fd, reqs.size) {
-            Ok(c) => c,
-            Err(e) => {
-                self.device.free_memory(memory, None);
-                self.device.destroy_buffer(buffer, None);
-                return Err(e).context("cuImportExternalMemory(OPAQUE_FD from Vulkan)");
-            }
-        };
-        // Full success: retire the previous buffer now, then publish the new one.
-        if let Some(old) = self.dst.take() {
-            self.device.destroy_buffer(old.buffer, None);
-            self.device.free_memory(old.memory, None);
-            // old.cuda drops its mapping with it
-        }
+        let cuda = cuda::ExternalDmabuf::import_owned_fd(opaque_fd, reqs.size)
+            .context("cuImportExternalMemory(OPAQUE_FD from Vulkan)")?;
         tracing::info!(size, "Vulkan→CUDA exportable staging buffer ready");
         self.dst = Some(DstBuf {
             buffer,
@@ -665,19 +544,9 @@ impl VkBridge {
             self.device
                 .queue_submit(self.queue, &[submit], self.fence)
                 .context("queue submit")?;
-            // Exception-safe wait: a TIMEOUT/DEVICE_LOST must not `?` out with the submission still
-            // executing — `self.cmd` and `self.fence` are reused every frame, and the caller retries
-            // on the SAME bridge (and `ensure_dst` later destroys `dst.buffer` assuming no in-flight
-            // work references it). Drain the GPU and reset the fence before propagating so the shared
-            // cmd/fence return clean.
-            if let Err(e) = self
-                .device
+            self.device
                 .wait_for_fences(&[self.fence], true, 1_000_000_000)
-            {
-                let _ = self.device.device_wait_idle();
-                let _ = self.device.reset_fences(&[self.fence]);
-                return Err(e).context("fence wait");
-            }
+                .context("fence wait")?;
             self.device
                 .reset_fences(&[self.fence])
                 .context("reset fence")?;
@@ -770,19 +639,9 @@ impl VkBridge {
             self.device
                 .queue_submit(self.queue, &[submit], self.fence)
                 .context("queue submit")?;
-            // Exception-safe wait: a TIMEOUT/DEVICE_LOST must not `?` out with the submission still
-            // executing — `self.cmd` and `self.fence` are reused every frame, and the caller retries
-            // on the SAME bridge (and `ensure_dst` later destroys `dst.buffer` assuming no in-flight
-            // work references it). Drain the GPU and reset the fence before propagating so the shared
-            // cmd/fence return clean.
-            if let Err(e) = self
-                .device
+            self.device
                 .wait_for_fences(&[self.fence], true, 1_000_000_000)
-            {
-                let _ = self.device.device_wait_idle();
-                let _ = self.device.reset_fences(&[self.fence]);
-                return Err(e).context("fence wait");
-            }
+                .context("fence wait")?;
             self.device
                 .reset_fences(&[self.fence])
                 .context("reset fence")?;

crates/punktfunk-core/build.rs

@@ -10,6 +10,7 @@ fn main() {
     println!("cargo:rerun-if-changed=src/abi.rs");
     println!("cargo:rerun-if-changed=src/config.rs");
     println!("cargo:rerun-if-changed=src/input.rs");
+    println!("cargo:rerun-if-changed=src/client.rs");
     println!("cargo:rerun-if-changed=src/error.rs");
     println!("cargo:rerun-if-changed=cbindgen.toml");
 

crates/punktfunk-core/src/abi.rs

@@ -78,11 +78,6 @@ impl PunktfunkConfig {
             u8::try_from(self.fec_percent).map_err(|_| PunktfunkStatus::InvalidArg)?;
         let max_data_per_block =
             u16::try_from(self.max_data_per_block).map_err(|_| PunktfunkStatus::InvalidArg)?;
-        // The one narrowing here that differs by target width: on 32-bit (armeabi-v7a) an
-        // `as usize` silently truncates a >4 GiB value to a plausible-looking residue that
-        // passes validate() — reject it instead, like every narrowing above.
-        let max_frame_bytes =
-            usize::try_from(self.max_frame_bytes).map_err(|_| PunktfunkStatus::InvalidArg)?;
         let cfg = Config {
             role,
             phase,
@@ -92,7 +87,7 @@ impl PunktfunkConfig {
                 max_data_per_block,
             },
             shard_payload: self.shard_payload as usize,
-            max_frame_bytes,
+            max_frame_bytes: self.max_frame_bytes as usize,
             encrypt: self.encrypt != 0,
             key: self.key,
             salt: self.salt,
@@ -130,12 +125,6 @@ pub struct PunktfunkFrame {
     pub frame_index: u32,
     pub pts_ns: u64,
     pub flags: u32,
-    /// Wall-clock reassembly-completion instant (ns since the Unix epoch, CLOCK_REALTIME — the
-    /// clock `pts_ns` and the skew handshake use). THIS is the receipt stamp for latency math:
-    /// a stamp the embedder takes itself at the poll return additionally contains the
-    /// pre-decode hand-off queue wait, so a client-side standing backlog would masquerade as
-    /// network latency (ABI v9 — the 2026-07 two-pair standing-latency investigation).
-    pub received_ns: u64,
 }
 
 /// Snapshot of session counters.
@@ -402,7 +391,6 @@ pub unsafe extern "C" fn punktfunk_client_poll_frame(
                         frame_index: f.frame_index,
                         pts_ns: f.pts_ns,
                         flags: f.flags,
-                        received_ns: f.received_ns,
                     };
                 }
                 PunktfunkStatus::Ok
@@ -468,31 +456,23 @@ pub unsafe extern "C" fn punktfunk_set_input_callback(
 #[no_mangle]
 pub unsafe extern "C" fn punktfunk_host_poll_input(s: *mut PunktfunkSession) -> i32 {
     let r = std::panic::catch_unwind(AssertUnwindSafe(|| {
+        let s = match unsafe { s.as_mut() } {
+            Some(s) => s,
+            None => return PunktfunkStatus::NullPointer as i32,
+        };
+        let cb = s.input_cb;
         let mut count = 0i32;
         loop {
-            // Narrow scope: re-derive the handle and pull ONE event, then drop the borrow
-            // before dispatching. The callback may legally re-enter `punktfunk_*` on this
-            // handle (get_stats, send_input, clearing the callback) — with a `&mut` held
-            // across the call that re-entry aliased it (UB under noalias). Re-reading
-            // `input_cb` per iteration also makes a mid-drain
-            // `punktfunk_set_input_callback(s, NULL, NULL)` take effect immediately instead
-            // of firing the cleared callback for the queued remainder. (Freeing the session
-            // from inside the callback remains forbidden, as on every entry point.)
-            let (ev, cb) = {
-                let s = match unsafe { s.as_mut() } {
-                    Some(s) => s,
-                    None => return PunktfunkStatus::NullPointer as i32,
-                };
-                match s.inner.poll_input() {
-                    Ok(Some(ev)) => (ev, s.input_cb),
-                    Ok(None) => break,
-                    Err(e) => return e.status() as i32,
+            match s.inner.poll_input() {
+                Ok(Some(ev)) => {
+                    if let Some((cb, user)) = cb {
+                        cb(&ev as *const InputEvent, user);
+                    }
+                    count += 1;
                 }
-            };
-            if let Some((cb, user)) = cb {
-                cb(&ev as *const InputEvent, user);
+                Ok(None) => break,
+                Err(e) => return e.status() as i32,
             }
-            count += 1;
         }
         count
     }));
@@ -898,8 +878,8 @@ pub const PUNKTFUNK_GAMEPAD_AUTO: u32 = 0;
 /// uinput X-Box 360 pad (the universal default — every game speaks XInput).
 pub const PUNKTFUNK_GAMEPAD_XBOX360: u32 = 1;
 /// UHID DualSense (kernel `hid-playstation`): adaptive triggers, lightbar, touchpad, motion —
-/// feedback arrives on the HID-output plane ([`punktfunk_connection_next_hidout`]). Honored on
-/// Linux (UHID) and Windows (UMDF minidriver) hosts; otherwise the host falls back to X-Box 360.
+/// feedback arrives on the HID-output plane ([`punktfunk_connection_next_hidout`]). Honored
+/// only where available (Linux hosts); otherwise the host falls back to X-Box 360.
 pub const PUNKTFUNK_GAMEPAD_DUALSENSE: u32 = 2;
 /// uinput X-Box One / Series pad — the X-Box 360 backend with the One/Series USB identity, so
 /// games show One/Series glyphs. XInput-identical to `XBOX360` otherwise (no game-visible gain;
@@ -908,8 +888,8 @@ pub const PUNKTFUNK_GAMEPAD_DUALSENSE: u32 = 2;
 pub const PUNKTFUNK_GAMEPAD_XBOXONE: u32 = 3;
 /// UHID DualShock 4 (kernel `hid-playstation` ≥ 6.2): lightbar, touchpad, motion, rumble — the
 /// touchpad/motion arrive over the rich-input plane and lightbar over the HID-output plane, like
-/// DualSense (minus adaptive triggers / player LEDs / mute). Honored on Linux (UHID) and Windows
-/// (UMDF minidriver) hosts; otherwise the host falls back to X-Box 360.
+/// DualSense (minus adaptive triggers / player LEDs / mute). Honored only where available (Linux
+/// hosts); otherwise the host falls back to X-Box 360.
 pub const PUNKTFUNK_GAMEPAD_DUALSHOCK4: u32 = 4;
 /// UHID classic Steam Controller (Valve `28DE:1102`, kernel `hid-steam`): one stick + dual
 /// trackpads + two grip paddles. Honored only where available (Linux hosts); else Xbox 360.
@@ -919,12 +899,10 @@ pub const PUNKTFUNK_GAMEPAD_STEAMCONTROLLER: u32 = 5;
 /// host. Honored on Linux AND Windows hosts; else folds to X-Box 360.
 pub const PUNKTFUNK_GAMEPAD_STEAMDECK: u32 = 6;
 /// DualSense Edge (Sony `054C:0DF2`): the DualSense plus two back buttons + two Fn buttons, so a
-/// client's back paddles land on native slots. Honored on Linux (UHID `hid-playstation`) and
-/// Windows (UMDF) hosts; otherwise the host falls back to X-Box 360.
+/// client's back paddles land on native slots. Folds to `DUALSENSE` until its backend lands.
 pub const PUNKTFUNK_GAMEPAD_DUALSENSEEDGE: u32 = 7;
 /// Nintendo Switch Pro Controller (Nintendo `057E:2009`, kernel `hid-nintendo`): Nintendo glyphs +
-/// positional layout, gyro/accel, HD rumble. Honored only where available (Linux hosts, UHID
-/// `hid-nintendo`); otherwise the host falls back to X-Box 360.
+/// positional layout, gyro/accel, HD rumble. Folds to `XBOX360` until its backend lands.
 pub const PUNKTFUNK_GAMEPAD_SWITCHPRO: u32 = 8;
 /// New Steam Controller (2026, Valve `28DE:1302`) passed through AS-IS: the host mirrors the
 /// client's raw Triton input reports out of a virtual SC2 with the real identity, and Steam's
@@ -1766,7 +1744,6 @@ pub unsafe extern "C" fn punktfunk_connection_next_au(
                         frame_index: f.frame_index,
                         pts_ns: f.pts_ns,
                         flags: f.flags,
-                        received_ns: f.received_ns,
                     };
                 }
                 PunktfunkStatus::Ok
@@ -1929,13 +1906,6 @@ pub unsafe extern "C" fn punktfunk_connection_next_audio_pcm(
         }
         let AudioPcmState { decoder, pcm } = &mut *state;
         let dec = decoder.as_mut().unwrap();
-        // A header-only datagram (DTX silence — a legal wire form) must be SKIPPED, not
-        // decoded: `decode_float` treats an empty payload as a loss and synthesizes a full
-        // 120 ms of concealment for a ~5 ms slot, growing the playout ring without bound.
-        // Mirrors the host mic pump's guard; the sink underruns to silence on its own.
-        if pkt.data.is_empty() {
-            return PunktfunkStatus::NoFrame;
-        }
         // `decode_float` divides the output buffer length by the channel count to get the
         // per-channel capacity; an empty payload requests packet-loss concealment.
         match dec.decode_float(&pkt.data, pcm, false) {
@@ -2986,14 +2956,7 @@ pub unsafe extern "C" fn punktfunk_connection_next_clipboard(
                 unsafe { *out = out_ev };
                 PunktfunkStatus::Ok
             }
-            Err(e) => {
-                // Release the parked payload once the embedder polls past it: clipboard
-                // traffic is sporadic, so without this a one-off 50 MiB paste stays resident
-                // for the rest of the session (there is no other release entry point). The
-                // borrow contract already says `out` data is valid only until the next call.
-                *c.last_clip.lock().unwrap() = None;
-                e.status()
-            }
+            Err(e) => e.status(),
         }
     })
 }
@@ -3083,35 +3046,6 @@ pub unsafe extern "C" fn punktfunk_connection_clock_offset_ns(
     })
 }
 
-/// The **live** host↔client wall-clock offset (nanoseconds, host minus client): the
-/// connect-time estimate of [`punktfunk_connection_clock_offset_ns`], updated by every applied
-/// mid-stream clock re-sync. Ongoing latency math (per-frame `received − pts` splits, the
-/// glass-to-glass meter) must use this one — after a wall-clock step/slew the frozen
-/// connect-time value reads tens of milliseconds wrong for the rest of the session, while the
-/// core itself has already re-synced. Same clock contract as the connect-time getter.
-///
-/// # Safety
-/// `c` is a valid connection handle; `offset_ns` is writable (NULL is skipped).
-#[cfg(feature = "quic")]
-#[no_mangle]
-pub unsafe extern "C" fn punktfunk_connection_clock_offset_now_ns(
-    c: *const PunktfunkConnection,
-    offset_ns: *mut i64,
-) -> PunktfunkStatus {
-    guard(|| {
-        let c = match unsafe { c.as_ref() } {
-            Some(c) => c,
-            None => return PunktfunkStatus::NullPointer,
-        };
-        unsafe {
-            if !offset_ns.is_null() {
-                *offset_ns = c.inner.clock_offset_now_ns();
-            }
-        }
-        PunktfunkStatus::Ok
-    })
-}
-
 /// Ask the host to switch the live session to `width`x`height`@`refresh_hz` without
 /// reconnecting (window resized, refresh changed). Non-blocking enqueue: on acceptance the
 /// stream continues at the new mode — the first new-mode access unit is an IDR with
@@ -3251,11 +3185,6 @@ pub unsafe extern "C" fn punktfunk_connection_frames_dropped(
     out: *mut u64,
 ) -> PunktfunkStatus {
     guard(|| {
-        // The header promises "writes 0 on a NULL connection" — honor it BEFORE the handle
-        // check, so an embedder that skips the status never reads an uninitialized slot.
-        if !out.is_null() {
-            unsafe { *out = 0 };
-        }
         let c = match unsafe { c.as_ref() } {
             Some(c) => c,
             None => return PunktfunkStatus::NullPointer,
@@ -3313,11 +3242,6 @@ pub unsafe extern "C" fn punktfunk_connection_wants_decode_latency(
     out: *mut bool,
 ) -> PunktfunkStatus {
     guard(|| {
-        // The header promises "writes 0 on a NULL connection" — honor it BEFORE the handle
-        // check: an uninitialized byte is not even a valid C++/Swift bool to read.
-        if !out.is_null() {
-            unsafe { *out = false };
-        }
         let c = match unsafe { c.as_ref() } {
             Some(c) => c,
             None => return PunktfunkStatus::NullPointer,

crates/punktfunk-core/src/client/frame_channel.rs

@@ -73,142 +73,6 @@ pub(crate) const NOOP_CLOCK_FLUSHES_TO_DISARM: u32 = 2;
 /// FIRST no-op clock flush — the moment a step is actually suspected.
 pub(crate) const CLOCK_RESYNC_INTERVAL: Duration = Duration::from_secs(60);
 
-/// Standing-latency bleed (the 2026-07 two-pair investigation): how far above the session's own
-/// one-way-delay floor a report window's MINIMUM must sit to count as a standing elevation. The
-/// jump-to-live detectors above deliberately ignore anything below ~6 frames / 400 ms, so a
-/// small standing state — a sub-frame kernel/reassembly backlog, or a stale clock offset after a
-/// wall-clock step — is carried forever and reads as permanent extra "network" latency. 10 ms
-/// sits above skew-handshake error + normal LAN jitter, and below a single 60 fps frame period,
-/// so the observed one-frame plateau (~17 ms) trips it while a healthy stream cannot.
-pub(crate) const STANDING_LAT_THRESH_NS: i128 = 10_000_000;
-
-/// Consecutive elevated report windows (~750 ms each) before the bleed escalates — ~4.5 s of a
-/// continuously standing, loss-free elevation. Windows with any loss reset the run: loss means
-/// genuine congestion, which the FEC/ABR machinery owns, not this detector.
-pub(crate) const STANDING_LAT_WINDOWS: u32 = 6;
-
-/// Per-session cap on flush+keyframe bleeds. A standing state that survives a clock re-sync AND
-/// this many local flushes is not local and not clock — the path latency itself changed; the
-/// detector disarms with a warning instead of paying a recovery keyframe every few seconds.
-pub(crate) const STANDING_LAT_MAX_BLEEDS: u32 = 3;
-
-/// What the standing-latency detector asks the pump to do this window (see [`StandingLatency`]).
-#[derive(Debug, PartialEq, Eq)]
-pub(crate) enum StandingLatAction {
-    None,
-    /// First escalation: ask for a mid-stream clock re-sync — free, and a stale offset from a
-    /// stepped/slewed wall clock produces exactly this signature (an applied re-sync re-bases
-    /// the floor via the pump's `clock_gen` watch, clearing the elevation if that was the cause).
-    Resync {
-        above_ms: i64,
-    },
-    /// The elevation survived a re-sync attempt: flush the local receive backlog + request a
-    /// keyframe (the jump-to-live action), draining a real sub-threshold standing queue. The
-    /// pump reports execution back via [`StandingLatency::bled`]; an unexecuted action simply
-    /// re-arms next window.
-    Bleed {
-        above_ms: i64,
-    },
-    /// Bleed cap reached and the elevation is back: give up and say so.
-    Disarm {
-        above_ms: i64,
-    },
-}
-
-/// Detector for a small, constant, loss-free one-way-delay elevation — the standing state the
-/// jump-to-live thresholds deliberately tolerate. Tracks the session's OWD floor (minimum of
-/// report-window minimums since start / last re-base) and escalates when windows sit
-/// persistently above it: re-sync first, then a bounded number of flush+keyframe bleeds, then
-/// disarm. Pure state machine (no clocks, no I/O) so the escalation ladder is unit-testable.
-pub(crate) struct StandingLatency {
-    /// Lowest window-minimum OWD seen since session start / last [`rebase`](Self::rebase).
-    floor_ns: Option<i128>,
-    /// Minimum per-frame OWD this report window; `None` = no frames yet.
-    window_min_ns: Option<i128>,
-    /// Consecutive elevated windows.
-    run: u32,
-    /// The current elevation already got its re-sync request — next escalation is a bleed.
-    resync_tried: bool,
-    bleeds: u32,
-    disarmed: bool,
-}
-
-impl StandingLatency {
-    pub(crate) fn new() -> Self {
-        StandingLatency {
-            floor_ns: None,
-            window_min_ns: None,
-            run: 0,
-            resync_tried: false,
-            bleeds: 0,
-            disarmed: false,
-        }
-    }
-
-    /// Feed one frame's skew-corrected OWD (capture→reassembly-complete, ns). Caller gates on a
-    /// live clock offset and plausibility (0 < owd < 10 s), like the ABR OWD signal.
-    pub(crate) fn note_frame(&mut self, owd_ns: i128) {
-        self.window_min_ns = Some(match self.window_min_ns {
-            Some(m) => m.min(owd_ns),
-            None => owd_ns,
-        });
-    }
-
-    /// Close a report window. `loss_free` = the window carried zero loss (loss resets the run —
-    /// congestion is the FEC/ABR machinery's problem, and queues under loss are not "standing").
-    pub(crate) fn on_window(&mut self, loss_free: bool) -> StandingLatAction {
-        let Some(wmin) = self.window_min_ns.take() else {
-            return StandingLatAction::None; // no frames this window — no evidence either way
-        };
-        let floor = *self.floor_ns.get_or_insert(wmin);
-        self.floor_ns = Some(floor.min(wmin));
-        let above_ns = wmin - floor;
-        if self.disarmed {
-            return StandingLatAction::None;
-        }
-        if !loss_free || above_ns < STANDING_LAT_THRESH_NS {
-            self.run = 0;
-            if above_ns < STANDING_LAT_THRESH_NS {
-                self.resync_tried = false; // elevation cleared — a future one re-syncs first again
-            }
-            return StandingLatAction::None;
-        }
-        self.run += 1;
-        if self.run < STANDING_LAT_WINDOWS {
-            return StandingLatAction::None;
-        }
-        self.run = 0; // each escalation gets a fresh observation run
-        let above_ms = (above_ns / 1_000_000) as i64;
-        if !self.resync_tried {
-            self.resync_tried = true;
-            StandingLatAction::Resync { above_ms }
-        } else if self.bleeds < STANDING_LAT_MAX_BLEEDS {
-            StandingLatAction::Bleed { above_ms }
-        } else {
-            self.disarmed = true;
-            StandingLatAction::Disarm { above_ms }
-        }
-    }
-
-    /// The pump executed a [`StandingLatAction::Bleed`] (flush + keyframe). The floor is KEPT: a
-    /// successful bleed brings OWD back down to it (elevation clears naturally); an unsuccessful
-    /// one leaves the elevation visible so the ladder continues toward the cap.
-    pub(crate) fn bled(&mut self) {
-        self.bleeds += 1;
-        self.window_min_ns = None;
-    }
-
-    /// A mid-stream clock re-sync was APPLIED (the pump's `clock_gen` watch): every OWD reading
-    /// shifted, so the floor and any elevation measured under the old offset are meaningless —
-    /// re-learn from scratch. The bleed budget survives (it caps keyframes per session).
-    pub(crate) fn rebase(&mut self) {
-        self.floor_ns = None;
-        self.window_min_ns = None;
-        self.run = 0;
-        self.resync_tried = false;
-    }
-}
-
 /// Client decode-stage latency accumulator for the adaptive-bitrate controller's decode signal.
 /// The embedder adds one sample per decoded frame ([`NativeClient::report_decode_us`], µs from the
 /// AU leaving [`NativeClient::next_frame`] to its decoded output) and the data-plane pump drains a
@@ -327,7 +191,6 @@ mod frame_channel_tests {
             pts_ns: i as u64,
             flags: 0,
             complete: true,
-            received_ns: 0,
         }
     }
 
@@ -395,143 +258,3 @@ mod frame_channel_tests {
         assert_eq!(popped(&ch), Some(total - FRAME_QUEUE_HARD_CAP as u32));
     }
 }
-
-#[cfg(test)]
-mod standing_latency_tests {
-    use super::{
-        StandingLatAction, StandingLatency, STANDING_LAT_MAX_BLEEDS, STANDING_LAT_THRESH_NS,
-        STANDING_LAT_WINDOWS,
-    };
-
-    const FLOOR: i128 = 2_000_000; // a healthy 2 ms LAN OWD
-    const ELEVATED: i128 = FLOOR + STANDING_LAT_THRESH_NS + 7_000_000; // ~one 60fps frame above
-
-    /// Run `n` windows at `owd`, asserting every window but the last returns None; returns the
-    /// last window's action.
-    fn run_windows(d: &mut StandingLatency, owd: i128, n: u32) -> StandingLatAction {
-        for i in 0..n {
-            d.note_frame(owd);
-            let a = d.on_window(true);
-            if i + 1 < n {
-                assert_eq!(a, StandingLatAction::None, "window {i} escalated early");
-            } else {
-                return a;
-            }
-        }
-        unreachable!("n > 0 by construction");
-    }
-
-    /// Learn a clean floor: one window at the healthy OWD.
-    fn learned(d: &mut StandingLatency) {
-        d.note_frame(FLOOR);
-        assert_eq!(d.on_window(true), StandingLatAction::None);
-    }
-
-    #[test]
-    fn healthy_stream_never_escalates() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        // Jitter riding above the floor but under the threshold: never a run.
-        for _ in 0..(STANDING_LAT_WINDOWS * 4) {
-            d.note_frame(FLOOR + STANDING_LAT_THRESH_NS - 1);
-            assert_eq!(d.on_window(true), StandingLatAction::None);
-        }
-    }
-
-    #[test]
-    fn escalation_ladder_resync_then_bleeds_then_disarm() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        // First full elevated run asks for the free fix: a clock re-sync.
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Resync { .. }
-        ));
-        // Re-sync didn't help (no rebase came) — each further run is a bleed, up to the cap...
-        for _ in 0..STANDING_LAT_MAX_BLEEDS {
-            assert!(matches!(
-                run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-                StandingLatAction::Bleed { .. }
-            ));
-            d.bled();
-        }
-        // ...then the detector gives up loudly, once, and stays quiet.
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Disarm { .. }
-        ));
-        d.note_frame(ELEVATED);
-        assert_eq!(d.on_window(true), StandingLatAction::None);
-    }
-
-    #[test]
-    fn loss_windows_reset_the_run() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        for _ in 0..(STANDING_LAT_WINDOWS - 1) {
-            d.note_frame(ELEVATED);
-            assert_eq!(d.on_window(true), StandingLatAction::None);
-        }
-        // A lossy window means congestion, not a standing state: run resets...
-        d.note_frame(ELEVATED);
-        assert_eq!(d.on_window(false), StandingLatAction::None);
-        // ...so the ladder needs the full run again before acting.
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Resync { .. }
-        ));
-    }
-
-    #[test]
-    fn recovery_resets_the_ladder_to_resync_first() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Resync { .. }
-        ));
-        // The elevation clears on its own (e.g. the successful bleed case, or transient): the
-        // next episode starts back at the free escalation, not at a bleed.
-        d.note_frame(FLOOR);
-        assert_eq!(d.on_window(true), StandingLatAction::None);
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Resync { .. }
-        ));
-    }
-
-    #[test]
-    fn applied_resync_rebases_and_clears_a_stale_offset_elevation() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        assert!(matches!(
-            run_windows(&mut d, ELEVATED, STANDING_LAT_WINDOWS),
-            StandingLatAction::Resync { .. }
-        ));
-        // The re-sync APPLIES (pump sees clock_gen move) → rebase. The corrected offset brings
-        // OWD readings back to truth; the floor re-learns and nothing ever escalates to a bleed.
-        d.rebase();
-        for _ in 0..(STANDING_LAT_WINDOWS * 2) {
-            d.note_frame(FLOOR);
-            assert_eq!(d.on_window(true), StandingLatAction::None);
-        }
-    }
-
-    #[test]
-    fn empty_windows_are_no_evidence() {
-        let mut d = StandingLatency::new();
-        learned(&mut d);
-        for _ in 0..(STANDING_LAT_WINDOWS - 1) {
-            d.note_frame(ELEVATED);
-            assert_eq!(d.on_window(true), StandingLatAction::None);
-        }
-        // A frameless window (paused stream) neither advances nor resets the run...
-        assert_eq!(d.on_window(true), StandingLatAction::None);
-        // ...so one more elevated window completes it.
-        d.note_frame(ELEVATED);
-        assert!(matches!(
-            d.on_window(true),
-            StandingLatAction::Resync { .. }
-        ));
-    }
-}

crates/punktfunk-core/src/client/mod.rs

@@ -425,12 +425,6 @@ impl NativeClient {
             Ok(Ok(t)) => t,
             Ok(Err(e)) => return Err(e),
             Err(_) => {
-                // A connect we already reported as failed must not leave a lingering host
-                // session if the handshake lands late: mark it a deliberate QUIT (not a plain
-                // drop / close code 0) so the worker's close tells the host to tear down now
-                // instead of holding the session (and its virtual display) for a reconnect
-                // that will never come.
-                quit.store(true, Ordering::SeqCst);
                 shutdown.store(true, Ordering::SeqCst);
                 return Err(PunktfunkError::Timeout);
             }
@@ -462,14 +456,9 @@ impl NativeClient {
             hot_tids,
             clock_offset,
             decode_lat,
-            // The controller arms exactly when the pump does — all three terms, not two: Automatic
-            // (the user asked for bitrate 0), not a rate-pinned PyroWave stream, AND the host
-            // echoed the rate it actually configured. Dropping the last term made this
-            // over-advertise against an old host that reports no rate, so an embedder fed decode
-            // latency to a controller that never runs.
-            wants_decode: bitrate_kbps == 0
-                && negotiated.codec != crate::quic::CODEC_PYROWAVE
-                && negotiated.bitrate_kbps > 0,
+            // The controller arms exactly when the pump does (see `abr::BitrateController::new`
+            // below): Automatic (the user asked for bitrate 0) and not a rate-pinned PyroWave stream.
+            wants_decode: bitrate_kbps == 0 && negotiated.codec != crate::quic::CODEC_PYROWAVE,
             mode: mode_slot,
             host_fingerprint: negotiated.host_fingerprint,
             resolved_compositor: negotiated.compositor,
@@ -714,23 +703,14 @@ impl NativeClient {
         // Reset the accumulator so a fresh run doesn't blend into the previous one.
         *self.probe.lock().unwrap() = ProbeState {
             active: true,
-            duration_ms,
             ..Default::default()
         };
-        let sent = self
-            .ctrl_tx
+        self.ctrl_tx
             .try_send(CtrlRequest::Probe(ProbeRequest {
                 target_kbps,
                 duration_ms,
             }))
-            .map_err(|_| PunktfunkError::Closed);
-        if sent.is_err() {
-            // Nothing was asked of the host, so nothing will ever answer. Leaving `active` latched
-            // would suppress the pump's entire report tick for the rest of the session (the pump
-            // mirrors the startup path's rollback at the same point).
-            self.probe.lock().unwrap().active = false;
-        }
-        sent
+            .map_err(|_| PunktfunkError::Closed)
     }
 
     /// Read the current speed-test measurement (partial until `done`, final once the host's
@@ -765,9 +745,7 @@ impl NativeClient {
             0.0
         } as f32;
         // Host-side drop: what the send buffer couldn't even accept (the host-side ceiling).
-        // Saturating: both counters arrive verbatim off the wire (same discipline as the
-        // saturating_sub/mul above — a hostile sum must not overflow-panic a debug build).
-        let offered_wire = p.host_wire_packets.saturating_add(p.host_send_dropped);
+        let offered_wire = p.host_wire_packets + p.host_send_dropped;
         let host_drop_pct = if offered_wire > 0 {
             p.host_send_dropped as f64 / offered_wire as f64 * 100.0
         } else {

crates/punktfunk-core/src/client/probe.rs

@@ -32,11 +32,6 @@ pub(crate) struct ProbeState {
     pub(crate) host_duration_ms: u32,
     /// The host's `ProbeResult` arrived → the measurement is final.
     pub(crate) done: bool,
-    /// The requested burst length, so the pump can arm a watchdog for a host that never answers.
-    /// Without one, an ignored `ProbeRequest` latches `active` forever and the pump's whole report
-    /// tick — loss reports, the ABR window feed, the standing-latency ladder and pending clock
-    /// re-syncs — stays suppressed for the rest of the session.
-    pub(crate) duration_ms: u32,
 }
 
 /// A finished/partial speed-test measurement, returned by [`NativeClient::probe_result`].

crates/punktfunk-core/src/client/pump/control_task.rs

@@ -1,181 +0,0 @@
-//! Control task: the handshake stream stays open for mid-stream renegotiation + speed tests.
-//! Outbound requests (mode switch, probe) and inbound replies (Reconfigured, ProbeResult) are
-//! multiplexed with `select!`; a single outbound channel (`ctrl_rx`) keeps one writer so the
-//! two `&mut ctrl_send` borrows don't collide across branches.
-
-use super::super::*;
-use super::*;
-
-pub(super) struct ControlTask {
-    pub(super) ctrl_rx: tokio::sync::mpsc::Receiver<CtrlRequest>,
-    pub(super) ctrl_send: quinn::SendStream,
-    pub(super) ctrl_recv: io::MsgReader,
-    /// `None` = no connect-time skew handshake (old host) — clock re-sync stays off.
-    pub(super) clock_rtt_ns: Option<u64>,
-    pub(super) mode_slot: Arc<Mutex<Mode>>,
-    pub(super) probe: Arc<Mutex<ProbeState>>,
-    /// The latest host `BitrateChanged` ack, drained by the pump's ABR on its report tick.
-    pub(super) bitrate_ack: Arc<Mutex<Option<u32>>>,
-    pub(super) clock_offset: Arc<std::sync::atomic::AtomicI64>,
-    pub(super) clock_gen: Arc<AtomicU32>,
-    /// Clipboard metadata events (ClipState/ClipOffer) feed the same event plane the
-    /// clipboard task uses for fetch data.
-    pub(super) clip_event_tx: std::sync::mpsc::SyncSender<ClipEventCore>,
-}
-
-impl ControlTask {
-    pub(super) async fn run(self) {
-        let ControlTask {
-            mut ctrl_rx,
-            mut ctrl_send,
-            mut ctrl_recv,
-            clock_rtt_ns,
-            mode_slot,
-            probe,
-            bitrate_ack,
-            clock_offset,
-            clock_gen,
-            clip_event_tx,
-        } = self;
-        // Mid-stream clock re-sync (see [`ClockResync`]): a batch runs every
-        // CLOCK_RESYNC_INTERVAL and whenever the pump asks (CtrlRequest::ClockResync after
-        // its first no-op clock flush). Echoes interleave with the other control replies in
-        // the read arm below; only when the host answered the connect-time handshake — an
-        // old host would just eat the probes.
-        let mut resync = ClockResync::new();
-        let mut resync_tick = tokio::time::interval_at(
-            tokio::time::Instant::now() + CLOCK_RESYNC_INTERVAL,
-            CLOCK_RESYNC_INTERVAL,
-        );
-        resync_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-        loop {
-            tokio::select! {
-                req = ctrl_rx.recv() => {
-                    let Some(req) = req else { break }; // client dropped
-                    let bytes = match req {
-                        CtrlRequest::Mode(m) => Reconfigure { mode: m }.encode(),
-                        CtrlRequest::Probe(p) => p.encode(),
-                        CtrlRequest::Keyframe => RequestKeyframe.encode(),
-                        CtrlRequest::Rfi(r) => r.encode(),
-                        CtrlRequest::Loss(r) => r.encode(),
-                        CtrlRequest::SetBitrate(k) => SetBitrate { bitrate_kbps: k }.encode(),
-                        CtrlRequest::ClockResync => {
-                            if clock_rtt_ns.is_none() {
-                                continue; // no connect-time handshake — host can't answer
-                            }
-                            resync.begin(wall_clock_ns()).encode()
-                        }
-                        CtrlRequest::ClipControl(c) => c.encode(),
-                        CtrlRequest::ClipOffer(o) => o.encode(),
-                    };
-                    if io::write_msg(&mut ctrl_send, &bytes).await.is_err() {
-                        break;
-                    }
-                }
-                _ = resync_tick.tick(), if clock_rtt_ns.is_some() => {
-                    let probe = resync.begin(wall_clock_ns());
-                    if io::write_msg(&mut ctrl_send, &probe.encode()).await.is_err() {
-                        break;
-                    }
-                }
-                msg = ctrl_recv.read_msg() => {
-                    let Ok(msg) = msg else { break }; // stream closed
-                    if let Ok(ack) = Reconfigured::decode(&msg) {
-                        if ack.accepted {
-                            *mode_slot.lock().unwrap() = ack.mode;
-                            tracing::info!(mode = ?ack.mode, "host accepted mode switch");
-                        } else {
-                            tracing::warn!(active = ?ack.mode, "host rejected mode switch");
-                        }
-                    } else if let Ok(result) = ProbeResult::decode(&msg) {
-                        let mut p = probe.lock().unwrap();
-                        // Freeze the delivered figures now (the burst is done), before resumed
-                        // video can inflate the packet counters.
-                        let base_p = p.base_packets.unwrap_or(p.rx_packets_now);
-                        let base_b = p.base_bytes.unwrap_or(p.rx_bytes_now);
-                        p.delivered_packets = p.rx_packets_now.saturating_sub(base_p);
-                        p.delivered_bytes = p.rx_bytes_now.saturating_sub(base_b);
-                        p.host_goodput_bytes = result.bytes_sent;
-                        p.host_au = result.packets_sent;
-                        p.host_wire_packets = result.wire_packets_sent;
-                        p.host_send_dropped = result.send_dropped;
-                        p.host_duration_ms = result.duration_ms;
-                        p.done = true;
-                        p.active = false; // burst over — the pump stops mirroring counters
-                        tracing::info!(
-                            host_goodput_bytes = result.bytes_sent,
-                            wire_packets_sent = result.wire_packets_sent,
-                            send_dropped = result.send_dropped,
-                            duration_ms = result.duration_ms,
-                            delivered_packets = p.delivered_packets,
-                            "speed-test probe result"
-                        );
-                    } else if let Ok(ack) = BitrateChanged::decode(&msg) {
-                        // Adaptive bitrate: the host's clamp is authoritative — park it for
-                        // the pump's controller (which also reads any ack as "this host
-                        // renegotiates", arming further steps).
-                        tracing::info!(
-                            kbps = ack.bitrate_kbps,
-                            "host re-targeted encoder bitrate"
-                        );
-                        *bitrate_ack.lock().unwrap() = Some(ack.bitrate_kbps);
-                    } else if let Ok(echo) = ClockEcho::decode(&msg) {
-                        match resync.on_echo(&echo, wall_clock_ns()) {
-                            ResyncStep::Probe(p) => {
-                                if io::write_msg(&mut ctrl_send, &p.encode()).await.is_err() {
-                                    break;
-                                }
-                            }
-                            ResyncStep::Done { offset_ns, rtt_ns } => {
-                                // Never let a congested window bias the offset (frames read
-                                // late exactly then) — keep the old estimate and let the next
-                                // periodic batch try again.
-                                if accept_resync(rtt_ns, clock_rtt_ns.unwrap_or(0)) {
-                                    // info, not debug: ≤1/min, and it is THE forensic
-                                    // trail for a stale-offset (stepped/slewed wall clock)
-                                    // latency plateau — the 2026-07 two-pair investigation
-                                    // had to reconstruct this blind.
-                                    tracing::info!(
-                                        offset_ns,
-                                        rtt_us = rtt_ns / 1000,
-                                        "mid-stream clock re-sync applied"
-                                    );
-                                    clock_offset.store(offset_ns, Ordering::Relaxed);
-                                    clock_gen.fetch_add(1, Ordering::Relaxed);
-                                } else {
-                                    tracing::info!(
-                                        rtt_us = rtt_ns / 1000,
-                                        "clock re-sync batch discarded — RTT above the \
-                                         connect-time baseline (congested window)"
-                                    );
-                                }
-                            }
-                            ResyncStep::Idle => {}
-                        }
-                    } else if let Ok(state) = ClipState::decode(&msg) {
-                        // Host ack / policy / backend update for the toggle UI (try_send: a
-                        // lagging embedder drops the newest — a stale toggle heals on the next).
-                        let _ = clip_event_tx.try_send(ClipEventCore::State {
-                            enabled: state.enabled,
-                            policy: state.policy,
-                            reason: state.reason,
-                        });
-                    } else if let Ok(offer) = ClipOffer::decode(&msg) {
-                        // The host copied something: surface the lazy format list; the embedder
-                        // fetches only if a local app pastes.
-                        let _ = clip_event_tx.try_send(ClipEventCore::RemoteOffer {
-                            seq: offer.seq,
-                            kinds: offer.kinds,
-                        });
-                    } else {
-                        tracing::warn!(
-                            tag = ?msg.first(),
-                            len = msg.len(),
-                            "unknown control message — ignoring"
-                        );
-                    }
-                }
-            }
-        }
-    }
-}

crates/punktfunk-core/src/client/pump/data.rs

@@ -1,568 +0,0 @@
-//! The blocking data-plane pump: poll the session for access units, run the adaptive-FEC
-//! loss reports, the ABR controller + startup capacity probe, the jump-to-live detectors,
-//! and the standing-latency bleed, and hand frames to the embedder.
-
-use super::super::*;
-use super::*;
-
-/// Data-plane pump on a blocking thread: poll the session, hand frames to the embedder.
-/// try_send drops the newest frame when the embedder lags (freshness over completeness).
-/// Speed-test filler ([`FLAG_PROBE`]) is folded into the probe accumulator instead of the
-/// decoder queue — it isn't video.
-pub(super) struct DataPump {
-    pub(super) session: Session,
-    pub(super) frames: Arc<FrameChannel>,
-    pub(super) ctrl_tx: tokio::sync::mpsc::Sender<CtrlRequest>,
-    pub(super) shutdown: Arc<std::sync::atomic::AtomicBool>,
-    pub(super) probe: Arc<Mutex<ProbeState>>,
-    pub(super) hot_tids: Arc<Mutex<Vec<i32>>>,
-    pub(super) clock_offset: Arc<std::sync::atomic::AtomicI64>,
-    pub(super) clock_gen: Arc<AtomicU32>,
-    pub(super) decode_lat: Arc<Mutex<DecodeLatAcc>>,
-    pub(super) frames_dropped: Arc<std::sync::atomic::AtomicU64>,
-    pub(super) fec_recovered: Arc<std::sync::atomic::AtomicU64>,
-    pub(super) bitrate_ack: Arc<Mutex<Option<u32>>>,
-    /// The embedder's REQUESTED rate (0 = Automatic — the only case the ABR arms).
-    pub(super) bitrate_kbps: u32,
-    /// The rate the host actually configured (echoed in Welcome).
-    pub(super) resolved_bitrate_kbps: u32,
-    pub(super) negotiated_codec: u8,
-}
-
-impl DataPump {
-    pub(super) fn run(self) {
-        let DataPump {
-            mut session,
-            frames,
-            ctrl_tx,
-            shutdown: pump_shutdown,
-            probe: pump_probe,
-            hot_tids: pump_hot_tids,
-            clock_offset: pump_clock_offset,
-            clock_gen: pump_clock_gen,
-            decode_lat: pump_decode_lat,
-            frames_dropped,
-            fec_recovered,
-            bitrate_ack,
-            bitrate_kbps,
-            resolved_bitrate_kbps,
-            negotiated_codec,
-        } = self;
-        pin_thread_user_interactive(); // feeds the frame channel → the user-interactive video pump
-        register_hot_tid(&pump_hot_tids); // this thread does UDP receive + FEC reassembly — hint it
-                                          // Adaptive-FEC loss reporting: every ADAPT_REPORT_INTERVAL, report the loss observed over the
-                                          // window (shards FEC recovered, plus a bump if any frame went unrecoverable) so the host can
-                                          // size FEC to the link. Suppressed during a speed test (its FLAG_PROBE filler would skew it).
-        const ADAPT_REPORT_INTERVAL: Duration = Duration::from_millis(750);
-        let mut last_report = Instant::now();
-        let (
-            mut last_recovered,
-            mut last_late,
-            mut last_received,
-            mut last_dropped,
-            mut last_bytes,
-        ) = (0u64, 0u64, 0u64, 0u64, 0u64);
-        // PUNKTFUNK_PERF: per-window pump observability — the Session's receive stage split
-        // (recv / decrypt / reassemble+FEC, see `Session::take_pump_perf`) and completed-AU
-        // inter-arrival jitter. Smoothness has no metric otherwise: jump-to-live counters only
-        // fire after the stream is already seconds behind.
-        let pump_perf_on = std::env::var("PUNKTFUNK_PERF").is_ok_and(|v| v != "0");
-        let mut arrivals_us: Vec<u32> = Vec::new();
-        let mut last_arrival: Option<Instant> = None;
-        // Adaptive bitrate (see `crate::abr`): armed only when the embedder asked for Automatic
-        // (`bitrate_kbps == 0`) and the host echoed the rate it actually configured (an old host
-        // echoes 0 → controller stays permanently off). Fed once per report window with the same
-        // deltas the LossReport uses, plus the window's mean skew-corrected one-way delay, the
-        // actual delivered throughput (climb gate + proven-throughput mark), and whether a
-        // jump-to-live flush fired.
-        // PyroWave sessions PIN their rate (§4.6): AIMD descent turns wavelets to mush well
-        // above its floor, and the climb probe's VBV reasoning doesn't apply to hard
-        // per-frame CBR — controller and capacity probe stay off (0 = permanently off).
-        let rate_pinned = negotiated_codec == crate::quic::CODEC_PYROWAVE;
-        let mut abr = BitrateController::new(if bitrate_kbps == 0 && !rate_pinned {
-            resolved_bitrate_kbps
-        } else {
-            0
-        });
-        // Startup link-capacity probe (Automatic sessions): the controller's ceiling is the
-        // negotiated start rate — the conservative 20 Mbps default, historically a box Automatic
-        // could NEVER climb out of. One speed-test burst shortly after the stream settles
-        // measures what the link actually delivers; ×0.7 (headroom for FEC overhead + variance)
-        // becomes the climb ceiling and slow start does the rest. Old hosts decline (all-zero
-        // reply) or never answer (timeout clears the state so LossReports resume) — either way
-        // the ceiling stays negotiated, exactly the old behavior. PUNKTFUNK_ABR_PROBE=0 opts out.
-        const CAPACITY_PROBE_KBPS: u32 = 2_000_000;
-        const CAPACITY_PROBE_MS: u32 = 800;
-        const CAPACITY_PROBE_DELAY: Duration = Duration::from_secs(2);
-        const CAPACITY_PROBE_TIMEOUT: Duration = Duration::from_secs(6);
-        let mut capacity_probe_at: Option<Instant> = (bitrate_kbps == 0
-            && !rate_pinned
-            && resolved_bitrate_kbps > 0
-            && std::env::var("PUNKTFUNK_ABR_PROBE").map_or(true, |v| v != "0"))
-        .then(|| Instant::now() + CAPACITY_PROBE_DELAY);
-        let mut capacity_probe_deadline: Option<Instant> = None;
-        // Edge detector + watchdog for a probe of EITHER origin (the startup capacity probe or an
-        // embedder speed test via `NativeClient::request_probe`). The startup path had both built
-        // in; the embedder path had neither, so an unanswered request wedged the report tick and a
-        // finished one left the ABR window anchored before the burst.
-        let mut was_probing = false;
-        let mut probe_watchdog: Option<Instant> = None;
-        let (mut owd_sum_ns, mut owd_frames) = (0i128, 0u32);
-        let mut flush_in_window = false;
-        // Jump-to-live state (see the guard in the loop below): when the clock-based over-bound
-        // run began (`stale_since`, armed only when the skew handshake succeeded so the clocks
-        // are comparable), when the clock-free non-draining-queue run began (`standing_since`),
-        // and the last-jump instant for the shared cooldown. Wall-clock runs (T1.4), not frame
-        // counts — the detectors' sensitivity must not scale with fps or repeat cadence.
-        let mut stale_since: Option<Instant> = None;
-        let mut standing_since: Option<Instant> = None;
-        let mut last_flush: Option<Instant> = None;
-        // Clock-detector health: consecutive clock-triggered flushes that found no local backlog
-        // (see NOOP_FLUSH_DATAGRAMS). Reaching NOOP_CLOCK_FLUSHES_TO_DISARM turns the clock-based
-        // detector off (a clock step / upstream queue it can't fix) — until a mid-stream clock
-        // re-sync lands and re-arms it (`pump_clock_gen` below). The FIRST no-op flush also asks
-        // the control task for an immediate re-sync (via the report tick): the flush finding no
-        // local backlog IS the "the wall clock stepped under me" signal.
-        let mut noop_clock_flushes: u32 = 0;
-        let mut clock_detector_armed = true;
-        let mut resync_wanted = false;
-        let mut seen_clock_gen = pump_clock_gen.load(Ordering::Relaxed);
-        // Standing-latency bleed (see StandingLatency): the third detector, for the small,
-        // constant, loss-free OWD elevation the two jump-to-live detectors deliberately
-        // tolerate (< QUEUE_HIGH frames, < FLUSH_LATENCY behind) — a sub-frame standing
-        // backlog, or a stale clock offset after a wall-clock step, either of which otherwise
-        // reads as permanent extra "network" latency for the rest of the session.
-        let mut standing_lat = StandingLatency::new();
-        while !pump_shutdown.load(Ordering::SeqCst) {
-            // The live host↔client offset: re-loaded every iteration so an applied mid-stream
-            // re-sync takes effect on the very next frame's latency math.
-            let clock_offset_ns = pump_clock_offset.load(Ordering::Relaxed);
-            // An applied re-sync invalidates the staleness run measured under the OLD offset:
-            // reset the counters and re-arm the clock-based detector if a step had disarmed it.
-            let gen = pump_clock_gen.load(Ordering::Relaxed);
-            if gen != seen_clock_gen {
-                seen_clock_gen = gen;
-                stale_since = None;
-                noop_clock_flushes = 0;
-                // Every OWD reading shifted with the offset — the standing-latency floor and
-                // any elevation measured under the old one are meaningless now. If a stale
-                // offset WAS the elevation, this is also the moment it gets fixed.
-                standing_lat.rebase();
-                if !clock_detector_armed {
-                    clock_detector_armed = true;
-                    tracing::info!("clock re-sync applied — clock-based jump-to-live re-armed");
-                }
-            }
-            // Mirror the reassembler's unrecoverable-drop count for the client's keyframe-recovery
-            // loop, and (during a speed test) the packet-level receive counters for the throughput
-            // measurement. Updated every iteration (not just on a produced frame) so they stay current
-            // through a total-loss drought where no AU completes. Cheap: a few relaxed atomic loads.
-            let st = session.stats();
-            frames_dropped.store(st.frames_dropped, Ordering::Relaxed);
-            fec_recovered.store(st.fec_recovered_shards, Ordering::Relaxed);
-            let probe_active = {
-                let mut p = pump_probe.lock().unwrap();
-                if p.active && !p.done {
-                    p.rx_packets_now = st.packets_received;
-                    p.rx_bytes_now = st.bytes_received;
-                    p.base_packets.get_or_insert(st.packets_received);
-                    p.base_bytes.get_or_insert(st.bytes_received);
-                }
-                p.active && !p.done
-            };
-            // A probe just ended (either kind): rebase EVERY window anchor past the burst. Its
-            // FLAG_PROBE filler landed in `bytes_received`/`packets_received` (session.rs counts
-            // every accepted datagram) but never reached the decoder, and the report tick was
-            // suppressed for the whole burst, so `last_*` still points before it. Without this the
-            // first post-burst window reads the burst rate as `actual_kbps` and poisons the ABR's
-            // monotone proven-throughput high-water mark — which never decays — and divides the
-            // window's loss by a packet count inflated with filler.
-            if was_probing && !probe_active {
-                last_recovered = st.fec_recovered_shards;
-                last_late = st.fec_late_shards;
-                last_received = st.packets_received;
-                last_dropped = st.frames_dropped;
-                last_bytes = st.bytes_received;
-                last_report = Instant::now();
-            }
-            // Arm a watchdog on the leading edge of ANY probe, so a host that silently ignores
-            // `ProbeRequest` (an old build — anticipated, see the capacity-probe timeout below)
-            // cannot latch `active` forever and suppress the report tick for the whole session.
-            if !was_probing && probe_active {
-                let burst = Duration::from_millis(pump_probe.lock().unwrap().duration_ms as u64);
-                probe_watchdog = Some(Instant::now() + burst + CAPACITY_PROBE_TIMEOUT);
-            }
-            if !probe_active {
-                probe_watchdog = None;
-            } else if let Some(deadline) = probe_watchdog {
-                if Instant::now() >= deadline {
-                    probe_watchdog = None;
-                    pump_probe.lock().unwrap().active = false;
-                    tracing::warn!(
-                        "speed-test probe unanswered — clearing it so loss reports and ABR resume"
-                    );
-                }
-            }
-            was_probing = probe_active;
-            // Fire the startup link-capacity probe once the stream has settled (see the constants
-            // above), and fold its measurement into the ABR ceiling when the result lands.
-            // Never steal the slot from an embedder speed test in flight: there is one `ProbeState`
-            // and no correlation id, so a clobber both wrecks the user's "Test connection" figure
-            // (its base counters get re-snapshotted mid-burst against the full-burst denominator)
-            // and mis-scales our own ceiling. Retry once it finishes.
-            if capacity_probe_at.is_some_and(|at| Instant::now() >= at) && probe_active {
-                capacity_probe_at = Some(Instant::now() + CAPACITY_PROBE_DELAY);
-            } else if capacity_probe_at.is_some_and(|at| Instant::now() >= at) {
-                capacity_probe_at = None;
-                *pump_probe.lock().unwrap() = ProbeState {
-                    active: true,
-                    duration_ms: CAPACITY_PROBE_MS,
-                    ..Default::default()
-                };
-                if ctrl_tx
-                    .try_send(CtrlRequest::Probe(ProbeRequest {
-                        target_kbps: CAPACITY_PROBE_KBPS,
-                        duration_ms: CAPACITY_PROBE_MS,
-                    }))
-                    .is_ok()
-                {
-                    capacity_probe_deadline = Some(Instant::now() + CAPACITY_PROBE_TIMEOUT);
-                    tracing::info!(
-                        target_kbps = CAPACITY_PROBE_KBPS,
-                        duration_ms = CAPACITY_PROBE_MS,
-                        "adaptive bitrate: startup link-capacity probe"
-                    );
-                } else {
-                    pump_probe.lock().unwrap().active = false; // ctrl queue full — skip
-                }
-            }
-            if let Some(deadline) = capacity_probe_deadline {
-                let mut p = pump_probe.lock().unwrap();
-                if p.done {
-                    capacity_probe_deadline = None;
-                    // An all-zero reply is a decline (old host / probe-less build) — keep the
-                    // negotiated ceiling. Otherwise: delivered wire kbps × 0.7.
-                    if p.host_duration_ms > 0 && p.delivered_bytes > 0 {
-                        let delivered_kbps = (p.delivered_bytes.saturating_mul(8)
-                            / p.host_duration_ms.max(1) as u64)
-                            as u32;
-                        let ceiling = delivered_kbps.saturating_mul(7) / 10;
-                        abr.set_ceiling(ceiling);
-                        tracing::info!(
-                            delivered_kbps,
-                            ceiling_kbps = ceiling,
-                            "adaptive bitrate: link-capacity probe done — climb ceiling set"
-                        );
-                    } else {
-                        tracing::info!(
-                            "adaptive bitrate: capacity probe declined — keeping negotiated ceiling"
-                        );
-                    }
-                    // The probe's FLAG_PROBE filler landed in `bytes_received` but never reached
-                    // the decoder — rebase the ABR window's byte counter past it, or the next
-                    // window's "actual throughput" reads as the burst rate and poisons the
-                    // controller's proven-throughput high-water mark with the LINK rate.
-                    last_bytes = st.bytes_received;
-                } else if Instant::now() >= deadline {
-                    // The host never answered (a build that ignores ProbeRequest): clear the
-                    // stuck-active state so LossReports resume, keep the negotiated ceiling.
-                    p.active = false;
-                    capacity_probe_deadline = None;
-                    tracing::info!(
-                        "adaptive bitrate: capacity probe timed out (old host?) — keeping negotiated ceiling"
-                    );
-                }
-            }
-            if !probe_active && last_report.elapsed() >= ADAPT_REPORT_INTERVAL {
-                // A no-op clock flush earlier in this window suspected a wall-clock step: fire
-                // the mid-stream re-sync now (once — the 60 s periodic covers everything else).
-                if resync_wanted {
-                    resync_wanted = false;
-                    let _ = ctrl_tx.try_send(CtrlRequest::ClockResync);
-                }
-                let window_dropped = st.frames_dropped.wrapping_sub(last_dropped);
-                let loss_ppm = window_loss_ppm(
-                    st.fec_recovered_shards.wrapping_sub(last_recovered),
-                    st.fec_late_shards.wrapping_sub(last_late),
-                    st.packets_received.wrapping_sub(last_received),
-                    window_dropped,
-                );
-                let _ = ctrl_tx.try_send(CtrlRequest::Loss(LossReport { loss_ppm }));
-                // Standing-latency bleed: close the detector's window with this report's loss
-                // verdict and run its escalation ladder — re-sync first (free; a stale offset
-                // from a stepped wall clock produces exactly this signature and the applied
-                // re-sync rebases the floor), then a bounded flush+keyframe (drains a real
-                // sub-threshold standing backlog the jump-to-live thresholds tolerate), then a
-                // loud disarm (the path latency itself changed; nothing local fixes that).
-                match standing_lat.on_window(loss_ppm == 0 && window_dropped == 0) {
-                    StandingLatAction::None => {}
-                    StandingLatAction::Resync { above_ms } => {
-                        tracing::info!(
-                            above_ms,
-                            "standing latency above the session floor with zero loss — \
-                             requesting a clock re-sync first (a stale offset reads exactly \
-                             like this)"
-                        );
-                        let _ = ctrl_tx.try_send(CtrlRequest::ClockResync);
-                    }
-                    StandingLatAction::Bleed { above_ms } => {
-                        // Shares the jump-to-live cooldown: an unexecuted bleed simply re-arms
-                        // over the next windows (the detector's run rebuilds).
-                        if last_flush.is_none_or(|t| t.elapsed() >= FLUSH_COOLDOWN) {
-                            last_flush = Some(Instant::now());
-                            // Deliberately NOT `flush_in_window = true`: that flag is the ABR's
-                            // SEVERE verdict (an immediate ×0.7 back-off), and the bleed fires
-                            // only after ~6 provably loss-free windows with a sub-25ms elevation
-                            // the controller itself scores as fine. The bleed's effect reaches
-                            // the ABR through the window's own honest signals (OWD/loss/decode);
-                            // the flag stays exclusive to the jump-to-live path below.
-                            let flushed = session.flush_backlog().unwrap_or(0);
-                            let dropped = frames.clear();
-                            let _ = ctrl_tx.try_send(CtrlRequest::Keyframe);
-                            standing_lat.bled();
-                            tracing::warn!(
-                                above_ms,
-                                flushed_datagrams = flushed,
-                                dropped_frames = dropped,
-                                "standing latency survived a clock re-sync — bled the local \
-                                 backlog (flush + keyframe)"
-                            );
-                        }
-                    }
-                    StandingLatAction::Disarm { above_ms } => {
-                        tracing::warn!(
-                            above_ms,
-                            "standing latency persists after a re-sync and every bleed — not \
-                             local, not clock; the path latency changed. Leaving it be \
-                             (reconnect re-baselines)"
-                        );
-                    }
-                }
-                // Adaptive bitrate: drain any host ack first (its clamp is authoritative), then
-                // feed the controller this window's congestion signals; a decision becomes a
-                // SetBitrate on the control stream.
-                if let Some(acked) = bitrate_ack.lock().unwrap().take() {
-                    abr.on_ack(acked);
-                }
-                let owd_mean_us =
-                    (owd_frames > 0).then(|| (owd_sum_ns / owd_frames as i128 / 1000) as i64);
-                (owd_sum_ns, owd_frames) = (0, 0);
-                // Drain the embedder's decode-latency window (always, so it stays bounded even when
-                // the controller is disabled) → the mean feeds the decode signal; `None` when the
-                // embedder reported nothing this window (old embedder / no decoded frames).
-                let decode_mean_us = {
-                    let mut acc = pump_decode_lat.lock().unwrap();
-                    let (sum, count) = (acc.sum_us, acc.count);
-                    *acc = DecodeLatAcc::default();
-                    (count > 0).then(|| (sum / count as u64) as i64)
-                };
-                // The window's ACTUAL delivered throughput — what the pipeline really carried, vs
-                // the target it was allowed. Wire bytes (headers + FEC) slightly overstate the
-                // media rate the decoder ingests; acceptable for the climb gate / proven-mark
-                // semantics (both compare against targets with their own headroom).
-                let window_ms = last_report.elapsed().as_millis().max(1) as u64;
-                let actual_kbps = (st.bytes_received.wrapping_sub(last_bytes).saturating_mul(8)
-                    / window_ms) as u32;
-                if let Some(kbps) = abr.on_window(
-                    Instant::now(),
-                    window_dropped,
-                    loss_ppm,
-                    owd_mean_us,
-                    decode_mean_us,
-                    actual_kbps,
-                    flush_in_window,
-                ) {
-                    // Log the window's signals alongside the decision so an on-glass session can
-                    // tell a decode-driven re-target (the new signal — decode_mean_us elevated with
-                    // loss/OWD flat) from a network-driven one.
-                    tracing::info!(
-                        kbps,
-                        loss_ppm,
-                        owd_mean_us = owd_mean_us.unwrap_or(-1),
-                        decode_mean_us = decode_mean_us.unwrap_or(-1),
-                        actual_kbps,
-                        flushed = flush_in_window,
-                        "adaptive bitrate: requesting encoder re-target"
-                    );
-                    let _ = ctrl_tx.try_send(CtrlRequest::SetBitrate(kbps));
-                }
-                flush_in_window = false;
-                last_report = Instant::now();
-                last_recovered = st.fec_recovered_shards;
-                last_late = st.fec_late_shards;
-                last_received = st.packets_received;
-                last_dropped = st.frames_dropped;
-                last_bytes = st.bytes_received;
-                if pump_perf_on {
-                    if let Some(p) = session.take_pump_perf() {
-                        let per_pkt_ns = |ns: u64| ns.checked_div(p.packets).unwrap_or(0);
-                        tracing::info!(
-                            recv_ms = p.recv_ns / 1_000_000,
-                            decrypt_ms = p.decrypt_ns / 1_000_000,
-                            reasm_ms = p.reasm_ns / 1_000_000,
-                            packets = p.packets,
-                            batches = p.batches,
-                            pkts_per_batch = p.packets.checked_div(p.batches).unwrap_or(0),
-                            decrypt_ns_pkt = per_pkt_ns(p.decrypt_ns),
-                            reasm_ns_pkt = per_pkt_ns(p.reasm_ns),
-                            "pump stage split (window)"
-                        );
-                    }
-                    // Inter-arrival jitter over the window's completed AUs. `late` counts gaps
-                    // over 2× the window median — the "a frame arrived visibly off-beat" tally.
-                    if arrivals_us.len() >= 8 {
-                        arrivals_us.sort_unstable();
-                        let pct = |q: usize| arrivals_us[(arrivals_us.len() - 1) * q / 100];
-                        let (p50, p95) = (pct(50), pct(95));
-                        let late = arrivals_us.iter().filter(|&&d| d > p50 * 2).count();
-                        tracing::info!(
-                            frames = arrivals_us.len() + 1,
-                            arrival_p50_us = p50,
-                            arrival_p95_us = p95,
-                            arrival_max_us = arrivals_us.last().copied().unwrap_or(0),
-                            late,
-                            "frame inter-arrival jitter (window)"
-                        );
-                    }
-                    arrivals_us.clear();
-                }
-            }
-            match session.poll_frame() {
-                Ok(frame) => {
-                    if frame.flags & FLAG_PROBE as u32 != 0 {
-                        continue; // speed-test filler, not video — measured via the counters above
-                    }
-                    if pump_perf_on {
-                        let now = Instant::now();
-                        if let Some(prev) = last_arrival.replace(now) {
-                            // 4096 ≈ 17 s at 240 fps — a stuck window can't grow it unbounded.
-                            if arrivals_us.len() < 4096 {
-                                arrivals_us
-                                    .push((now - prev).as_micros().min(u32::MAX as u128) as u32);
-                            }
-                        }
-                    }
-                    // Jump-to-live guard. A standing receive/hand-off queue never drains by itself —
-                    // the pump consumes strictly in order at the arrival rate, so once behind, the
-                    // stream stays behind for good (observed live: stuck 6–7 s). Pre-decode AUs are
-                    // reference-chained (infinite GOP), so we can NOT drop a frame mid-stream to catch
-                    // up; the only safe recovery is to discard the whole backlog and re-anchor decode
-                    // on a fresh keyframe. Two independent "we're behind" signals arm it, both gated by
-                    // FLUSH_COOLDOWN, both suspended during a speed test (the probe MEASURES a saturated
-                    // queue; flushing would corrupt its counters):
-                    //  * clock-based — completed frames sit > FLUSH_LATENCY behind the skew-corrected
-                    //    capture clock continuously for FLUSH_AFTER. Needs the skew handshake, and
-                    //    also catches kernel/reassembler backlog the hand-off queue hasn't reached yet.
-                    //  * clock-free — the pre-decode hand-off queue stopped draining: its depth stayed
-                    //    ≥ QUEUE_HIGH (never falling to QUEUE_LOW, still high at the trip) for
-                    //    STANDING_TIME. Works with no handshake / a same-clock session (where the
-                    //    clock path is disarmed), and is the direct signal that the embedder can't
-                    //    keep up. A transient Wi-Fi clump drains within ~100 ms and never trips it.
-                    if probe_active {
-                        // Keep both detectors disarmed across a speed test so its (deliberately)
-                        // saturated queue doesn't leave a primed run that fires the moment it ends.
-                        stale_since = None;
-                        standing_since = None;
-                    } else {
-                        let lat_ns = if clock_offset_ns != 0 {
-                            now_realtime_ns() + clock_offset_ns as i128 - frame.pts_ns as i128
-                        } else {
-                            0
-                        };
-                        // Feed the adaptive-bitrate controller's OWD window (mean capture→received
-                        // delay): rising delay under zero loss is queue growth — the pre-loss
-                        // congestion signal. Only meaningful with a clock handshake.
-                        if clock_offset_ns != 0 && lat_ns > 0 {
-                            owd_sum_ns += lat_ns;
-                            owd_frames += 1;
-                            // The standing-latency detector rides the same signal, but off the
-                            // window MINIMUM (robust against jitter/burst spikes — a standing
-                            // state elevates the floor itself). Same 10 s plausibility clamp as
-                            // the hn stats use.
-                            if lat_ns < 10_000_000_000 {
-                                standing_lat.note_frame(lat_ns);
-                            }
-                        }
-                        if clock_detector_armed
-                            && clock_offset_ns != 0
-                            && lat_ns > FLUSH_LATENCY.as_nanos() as i128
-                        {
-                            stale_since.get_or_insert_with(Instant::now);
-                        } else {
-                            stale_since = None;
-                        }
-                        let depth = frames.depth();
-                        if depth >= QUEUE_HIGH {
-                            standing_since.get_or_insert_with(Instant::now);
-                        } else if depth <= QUEUE_LOW {
-                            standing_since = None;
-                        }
-                        // The queue trip additionally requires the depth to still be high NOW, so
-                        // a run that started ≥ high but is hovering in the hysteresis band (a
-                        // clump mid-drain) never fires on elapsed time alone.
-                        let clock_behind = stale_since.is_some_and(|t| t.elapsed() >= FLUSH_AFTER);
-                        let queue_behind = depth >= QUEUE_HIGH
-                            && standing_since.is_some_and(|t| t.elapsed() >= STANDING_TIME);
-                        if (clock_behind || queue_behind)
-                            && last_flush.is_none_or(|t| t.elapsed() >= FLUSH_COOLDOWN)
-                        {
-                            stale_since = None;
-                            standing_since = None;
-                            last_flush = Some(Instant::now());
-                            flush_in_window = true; // strongest "link can't hold the rate" signal
-                            let flushed = session.flush_backlog().unwrap_or(0);
-                            let dropped = frames.clear();
-                            let _ = ctrl_tx.try_send(CtrlRequest::Keyframe);
-                            tracing::warn!(
-                                behind_ms = if clock_behind { lat_ns / 1_000_000 } else { -1 },
-                                queue_depth = depth,
-                                flushed_datagrams = flushed,
-                                dropped_frames = dropped,
-                                "receive backlog stopped draining — jumped to live (flush + keyframe)"
-                            );
-                            // Clock-detector health check: a clock-only trigger whose flush found
-                            // no local backlog is a false "behind" reading (a wall-clock step, or
-                            // an upstream queue a local flush can't drain) — repeated, it would
-                            // cost a recovery IDR every cooldown forever. Disarm after two in a
-                            // row; the clock-free queue detector keeps covering real backlogs.
-                            if clock_behind
-                                && !queue_behind
-                                && flushed < NOOP_FLUSH_DATAGRAMS
-                                && dropped == 0
-                            {
-                                noop_clock_flushes += 1;
-                                if noop_clock_flushes == 1 {
-                                    // First no-op flush = a wall-clock step is the prime
-                                    // suspect: ask for an immediate re-sync (sent on the next
-                                    // report tick). Applied, it resets these counters and
-                                    // re-arms the detector before the disarm below triggers.
-                                    resync_wanted = true;
-                                }
-                                if noop_clock_flushes >= NOOP_CLOCK_FLUSHES_TO_DISARM {
-                                    clock_detector_armed = false;
-                                    tracing::warn!(
-                                        "clock-based jump-to-live disarmed — its flushes found no \
-                                         local backlog (clock step or upstream queueing suspected); \
-                                         the queue-depth detector stays armed"
-                                    );
-                                }
-                            } else {
-                                noop_clock_flushes = 0;
-                            }
-                            continue; // this frame is part of the stale past — don't render it
-                        }
-                    }
-                    frames.push(frame);
-                }
-                Err(PunktfunkError::NoFrame) => {
-                    std::thread::sleep(Duration::from_micros(300));
-                }
-                Err(_) => break,
-            }
-        }
-        // The pump exited (shutdown / fatal session error) — wake any consumer blocked in
-        // `next_frame` with a Closed signal instead of a spurious timeout (the old mpsc did this
-        // implicitly when the sender dropped).
-        frames.close();
-    }
-}

crates/punktfunk-core/src/client/pump/datagram_task.rs

@@ -1,79 +0,0 @@
-//! Datagram demux: host → client audio/rumble (try_send: a lagging embedder drops the
-//! newest packet rather than backing up the QUIC receive path).
-
-use super::*;
-
-pub(super) async fn run(
-    conn: quinn::Connection,
-    audio_tx: std::sync::mpsc::SyncSender<AudioPacket>,
-    rumble_tx: std::sync::mpsc::SyncSender<RumbleUpdate>,
-    rumble_feed: super::super::rumble::RumbleFeed,
-    hidout_tx: std::sync::mpsc::SyncSender<crate::quic::HidOutput>,
-    hdr_meta_tx: std::sync::mpsc::SyncSender<crate::quic::HdrMeta>,
-    host_timing_tx: std::sync::mpsc::SyncSender<crate::quic::HostTiming>,
-) {
-    // Per-pad reorder gate for v2 rumble envelopes (the seq analog of the host's gamepad-state
-    // gate): a datagram the network reordered must not roll a stopped motor back on. Legacy v1
-    // datagrams carry no seq and bypass it (an old host's own periodic re-send is the only heal).
-    let mut rumble_last_seq: [Option<u8>; crate::input::MAX_PADS] = [None; crate::input::MAX_PADS];
-    while let Ok(d) = conn.read_datagram().await {
-        match d.first() {
-            Some(&crate::quic::AUDIO_MAGIC) => {
-                if let Some((seq, pts_ns, opus)) = crate::quic::decode_audio_datagram(&d) {
-                    let _ = audio_tx.try_send(AudioPacket {
-                        seq,
-                        pts_ns,
-                        data: opus.to_vec(),
-                    });
-                }
-            }
-            Some(&crate::quic::RUMBLE_MAGIC) => {
-                if let Some(u) = crate::quic::decode_rumble_envelope(&d) {
-                    // Gate v2 envelopes on their per-pad seq; forward v1 (envelope: None) as-is.
-                    let fresh = match u.envelope {
-                        Some(env) => {
-                            let idx = u.pad as usize;
-                            if idx < crate::input::MAX_PADS {
-                                if crate::input::GamepadSnapshot::seq_newer(
-                                    env.seq,
-                                    rumble_last_seq[idx],
-                                ) {
-                                    rumble_last_seq[idx] = Some(env.seq);
-                                    true
-                                } else {
-                                    false // reordered/duplicate — drop, keep the newer state
-                                }
-                            } else {
-                                true // out-of-range pad (host never sends these): no gate
-                            }
-                        }
-                        None => true,
-                    };
-                    if fresh {
-                        let ttl = u.envelope.map(|e| e.ttl_ms);
-                        // Both consumers are fed; an embedder drains exactly one of them
-                        // (the legacy queue, or the policy engine's command API).
-                        let _ = rumble_tx.try_send((u.pad, u.low, u.high, ttl));
-                        rumble_feed.wire_update(u.pad, u.low, u.high, ttl);
-                    }
-                }
-            }
-            Some(&crate::quic::HIDOUT_MAGIC) => {
-                if let Some(h) = HidOutput::decode(&d) {
-                    let _ = hidout_tx.try_send(h);
-                }
-            }
-            Some(&crate::quic::HDR_META_MAGIC) => {
-                if let Some(m) = crate::quic::decode_hdr_meta_datagram(&d) {
-                    let _ = hdr_meta_tx.try_send(m);
-                }
-            }
-            Some(&crate::quic::HOST_TIMING_MAGIC) => {
-                if let Some(t) = crate::quic::decode_host_timing_datagram(&d) {
-                    let _ = host_timing_tx.try_send(t);
-                }
-            }
-            _ => {} // unknown tag — a newer host; ignore
-        }
-    }
-}

crates/punktfunk-core/src/client/pump/handshake.rs

@@ -1,204 +0,0 @@
-//! Connect + handshake: dial the host (cert-pinned), exchange Hello/Welcome/Start on the
-//! control stream, run the wall-clock skew handshake, hole-punch the data port, and stand
-//! up the data-plane [`Session`]. A typed application close from the host surfaces as
-//! [`PunktfunkError::Rejected`] instead of the generic transport error.
-
-use super::super::*;
-use super::*;
-
-/// Everything [`run_pump`](super::run_pump) needs from a successful connect + handshake.
-pub(super) struct HandshakeOut {
-    pub(super) conn: quinn::Connection,
-    pub(super) session: Session,
-    pub(super) ctrl_send: quinn::SendStream,
-    pub(super) ctrl_recv: io::MsgReader,
-    pub(super) negotiated: Negotiated,
-    pub(super) host_caps: u8,
-}
-
-pub(super) async fn connect_and_handshake(args: &WorkerArgs) -> Result<HandshakeOut> {
-    let (host, port, pin) = (&args.host, args.port, args.pin);
-    let (mode, compositor, gamepad) = (args.mode, args.compositor, args.gamepad);
-    let (bitrate_kbps, video_caps, audio_channels) =
-        (args.bitrate_kbps, args.video_caps, args.audio_channels);
-    let (video_codecs, preferred_codec, display_hdr) =
-        (args.video_codecs, args.preferred_codec, args.display_hdr);
-    let (launch, identity, shutdown) = (&args.launch, &args.identity, &args.shutdown);
-    let remote: std::net::SocketAddr = join_host_port(host, port)
-        .parse()
-        .map_err(|_| PunktfunkError::InvalidArg("host:port"))?;
-    let (ep, observed) = endpoint::client_pinned_with_identity(
-        pin,
-        identity.as_ref().map(|(c, k)| (c.as_str(), k.as_str())),
-    );
-    let ep = ep.map_err(|e| PunktfunkError::Io(std::io::Error::other(e.to_string())))?;
-    let conn = ep
-        .connect(remote, "punktfunk")
-        .map_err(|_| PunktfunkError::InvalidArg("connect"))?
-        .await
-        .map_err(|e| {
-            // A pin mismatch surfaces as a TLS failure; report it as a crypto error so
-            // the embedder can distinguish "wrong host identity" from plain IO trouble.
-            let fp_mismatch =
-                pin.is_some() && observed.lock().unwrap().map(|fp| Some(fp) != pin) == Some(true);
-            if fp_mismatch {
-                PunktfunkError::Crypto
-            } else {
-                PunktfunkError::Io(std::io::Error::other(e.to_string()))
-            }
-        })?;
-    let fingerprint = observed.lock().unwrap().unwrap_or([0u8; 32]);
-    // The rest of the handshake runs in an inner future so a failure can consult
-    // `conn.close_reason()`: a host that turned us away with a typed application close
-    // (pairing not armed / denied / approval timeout / version mismatch / busy) surfaces
-    // as `PunktfunkError::Rejected` instead of the generic transport error the failed
-    // read produces — the difference between "not accepted" and the actual cause.
-    let handshake = async {
-        let (mut send, recv) = conn
-            .open_bi()
-            .await
-            .map_err(|e| PunktfunkError::Io(std::io::Error::other(e.to_string())))?;
-        // Frame every read on this stream through the resumable reader: the control loop
-        // below drives it from a `select!` arm and `clock_sync` wraps it in a timeout, and a
-        // partial frame lost to either would misalign the stream for the whole session.
-        let mut recv = io::MsgReader::new(recv);
-
-        io::write_msg(
-            &mut send,
-            &Hello {
-                abi_version: crate::WIRE_VERSION,
-                mode,
-                compositor,
-                gamepad,
-                bitrate_kbps,
-                // No device name yet: the connect ABI has no name parameter (pairing does). The
-                // host falls back to a fingerprint-derived label in its pending-approval list.
-                name: None,
-                // Library id to launch this session, if the embedder asked for one.
-                launch: launch.clone(),
-                // The embedder's decode/present caps (e.g. the Windows client advertises
-                // VIDEO_CAP_10BIT | VIDEO_CAP_HDR). The host only upgrades to a 10-bit / HDR encode
-                // when the matching bit is set, so `0` stays an 8-bit BT.709 stream. HOST_TIMING is
-                // OR'd in unconditionally: every NativeClient build demuxes the 0xCF plane, and the
-                // bit only asks the host for observability datagrams (never changes the encode).
-                // PROBE_SEQ likewise: the shared reassembler keeps probe filler in its own window
-                // (every embedder inherits it), so the host may burst speed tests without consuming
-                // video frame indexes. STREAMED_AU the same way: the shared reassembler accepts
-                // sentinel-headed streamed blocks (retro-validated at the final block), so the host
-                // may overlap a multi-slice encode's tail with packetize/FEC/pacing.
-                video_caps: video_caps
-                    | crate::quic::VIDEO_CAP_HOST_TIMING
-                    | crate::quic::VIDEO_CAP_PROBE_SEQ
-                    | crate::quic::VIDEO_CAP_STREAMED_AU,
-                // Requested surround channel count; the host echoes the resolved value in Welcome.
-                audio_channels,
-                // The codecs this client can decode + its soft preference (0 = auto). The host
-                // resolves the emitted codec from these and reports it in `Welcome::codec`.
-                video_codecs,
-                preferred_codec,
-                // The client display's HDR volume → the host's virtual-display EDID (host apps
-                // tone-map to the client's real panel). `None` = unknown/SDR.
-                display_hdr,
-            }
-            .encode(),
-        )
-        .await?;
-        let welcome = Welcome::decode(&recv.read_msg().await?)?;
-        if welcome.compositor != CompositorPref::Auto {
-            tracing::info!(
-                compositor = welcome.compositor.as_str(),
-                "host resolved compositor"
-            );
-        }
-        if welcome.gamepad != GamepadPref::Auto {
-            tracing::info!(
-                gamepad = welcome.gamepad.as_str(),
-                "host resolved gamepad backend"
-            );
-        }
-
-        // Reserve our data-plane port, then start the host.
-        let probe = std::net::UdpSocket::bind("0.0.0.0:0")?;
-        let udp_port = probe.local_addr()?.port();
-        drop(probe);
-        io::write_msg(
-            &mut send,
-            &Start {
-                client_udp_port: udp_port,
-            }
-            .encode(),
-        )
-        .await?;
-
-        // Wall-clock skew handshake on the control stream (before the session's control task takes
-        // it): align our clock to the host's so the embedder can express receive/present instants in
-        // the host's capture clock (the AU `pts_ns`). 0 ⇒ an old host that didn't answer (shared-clock
-        // assumption, as before). This is the substrate for glass-to-glass present-time measurement.
-        let (clock_offset_ns, clock_rtt_ns) =
-            match crate::quic::clock_sync(&mut send, &mut recv).await {
-                Some(skew) => {
-                    tracing::info!(
-                        offset_ns = skew.offset_ns,
-                        rtt_us = skew.rtt_ns / 1000,
-                        rounds = skew.rounds,
-                        "clock skew estimated (host-client)"
-                    );
-                    (skew.offset_ns, Some(skew.rtt_ns))
-                }
-                None => (0, None),
-            };
-
-        let host_udp = std::net::SocketAddr::new(remote.ip(), welcome.udp_port);
-        let transport =
-            UdpTransport::connect(&format!("0.0.0.0:{udp_port}"), &host_udp.to_string())?;
-        // Hole-punch the host's data port so video traverses a NAT / stateful inter-VLAN firewall
-        // (control + side planes ride the client-initiated QUIC; the raw video UDP needs the client
-        // to open the path first). Stops with the session via the shared shutdown flag.
-        if let Ok(sock) = transport.try_clone_socket() {
-            crate::transport::spawn_data_punch(sock, shutdown.clone());
-        }
-        let mut session = Session::new(welcome.session_config(Role::Client), Box::new(transport))?;
-        // PyroWave sessions opt into partial delivery (plan §4.4): an aged-out lossy
-        // frame arrives as blocks-with-holes instead of vanishing — the all-intra codec
-        // renders it as one frame of localized blur, strictly better than a freeze.
-        if welcome.codec == crate::quic::CODEC_PYROWAVE {
-            session.set_deliver_partial_frames(true);
-        }
-        Ok::<_, PunktfunkError>((
-            session,
-            send,
-            recv,
-            Negotiated {
-                mode: welcome.mode,
-                compositor: welcome.compositor,
-                gamepad: welcome.gamepad,
-                host_fingerprint: fingerprint,
-                bitrate_kbps: welcome.bitrate_kbps,
-                clock_offset_ns,
-                clock_rtt_ns,
-                bit_depth: welcome.bit_depth,
-                color: welcome.color,
-                chroma_format: welcome.chroma_format,
-                audio_channels: welcome.audio_channels,
-                codec: welcome.codec,
-                shard_payload: welcome.shard_payload,
-                host_caps: welcome.host_caps,
-            },
-            welcome.host_caps,
-        ))
-    };
-    match handshake.await {
-        Ok((session, send, recv, negotiated, host_caps)) => Ok(HandshakeOut {
-            conn,
-            session,
-            ctrl_send: send,
-            ctrl_recv: recv,
-            negotiated,
-            host_caps,
-        }),
-        Err(e) => Err(match reject_from_close(&conn) {
-            Some(r) => PunktfunkError::Rejected(r),
-            None => e,
-        }),
-    }
-}

crates/punktfunk-core/src/client/pump/input_task.rs

@@ -1,139 +0,0 @@
-//! Input task: embedder events → QUIC datagrams. Toward a host that advertised
-//! HOST_CAP_GAMEPAD_STATE, the per-transition gamepad events every embedder still emits are
-//! folded into idempotent, sequence-numbered full-state snapshots (`GamepadSnapshot`): the
-//! datagram plane drops and reorders (and sheds oldest-first at the 4 KiB send cap), so a lost
-//! per-transition event would corrupt held pad state until the *next* change — a held trigger
-//! stuck wrong indefinitely. Snapshots heal on the next send, the seq lets the host drop stale
-//! reorders, and a periodic refresh of every touched pad bounds any loss to one refresh
-//! interval — the same idempotent-state discipline as the host's 500 ms rumble refresh.
-//! Keyboard/mouse/touch events pass through unchanged; an older host (no caps bit) keeps
-//! getting the legacy per-transition gamepad events.
-
-use super::super::*;
-use super::*;
-
-pub(super) async fn run(
-    conn: quinn::Connection,
-    mut input_rx: tokio::sync::mpsc::UnboundedReceiver<InputEvent>,
-    gamepad_snapshots: bool,
-) {
-    use crate::input::{GamepadSnapshot, InputKind, MAX_PADS};
-    // Touched pads only: an entry appears on the first gamepad event for that index, so the
-    // refresh never conjures a virtual pad the embedder didn't drive.
-    let mut pads: [Option<GamepadSnapshot>; MAX_PADS] = [None; MAX_PADS];
-    // Per-pad wrapping seq that PERSISTS across a pad's remove/re-add on the same index (the
-    // snapshot itself is cleared to `None` on removal). A removal takes `seq[idx] + 1` so it
-    // supersedes every prior snapshot; the re-added pad's first snapshot takes the next value
-    // after that, so the host's seq gate accepts it instead of rejecting a restarted-at-0 seq.
-    let mut seq: [u8; MAX_PADS] = [0; MAX_PADS];
-    // Re-sends of a removal still owed on refresh ticks (the removal rides the lossy datagram
-    // plane; a single lost one would silently strand a ghost pad on the host — the exact bug
-    // the removal fixes). Mirrors the host's rumble stop burst: a few time-spread re-sends,
-    // each with a fresh (higher) seq, and canceled the moment the pad is driven again.
-    const REMOVE_RESENDS: u8 = 2;
-    let mut remove_owed: [u8; MAX_PADS] = [0; MAX_PADS];
-    // Per-pad declared controller kind ([`GamepadArrival`]) + its owed re-sends: the host needs
-    // the kind before the pad's first frame to build a matching virtual device (mixed types), so
-    // like the removal it rides the lossy plane with a small time-spread re-send burst.
-    const ARRIVAL_RESENDS: u8 = 2;
-    let mut arrival: [Option<u8>; MAX_PADS] = [None; MAX_PADS];
-    let mut arrival_owed: [u8; MAX_PADS] = [0; MAX_PADS];
-    let mut refresh = tokio::time::interval(Duration::from_millis(100));
-    refresh.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-    loop {
-        tokio::select! {
-            ev = input_rx.recv() => {
-                let Some(ev) = ev else { break };
-                let idx = ev.flags as usize;
-                if gamepad_snapshots
-                    && matches!(ev.kind, InputKind::GamepadButton | InputKind::GamepadAxis)
-                    && idx < MAX_PADS
-                {
-                    // The pad is being driven — cancel any owed removal (a re-plug on this
-                    // index; its fresh snapshot seq already supersedes the removal's).
-                    remove_owed[idx] = 0;
-                    let snap = pads[idx].get_or_insert(GamepadSnapshot {
-                        pad: idx as u8,
-                        ..Default::default()
-                    });
-                    // Unknown axis ids don't send (the host's legacy fold drops them too).
-                    if snap.fold(&ev) {
-                        seq[idx] = seq[idx].wrapping_add(1);
-                        snap.seq = seq[idx];
-                        let _ = conn
-                            .send_datagram(snap.to_event().encode().to_vec().into());
-                    }
-                    continue;
-                }
-                if gamepad_snapshots && ev.kind == InputKind::GamepadRemove && idx < MAX_PADS {
-                    // Stop refreshing the pad and forward a seq-stamped removal (in the shared
-                    // seq space) so the host tears its virtual device down and no reordered
-                    // snapshot can resurrect it; arm the re-send burst against datagram loss.
-                    // Drop any owed kind declaration too — a re-plug on this index sends its own.
-                    pads[idx] = None;
-                    arrival[idx] = None;
-                    arrival_owed[idx] = 0;
-                    seq[idx] = seq[idx].wrapping_add(1);
-                    remove_owed[idx] = REMOVE_RESENDS;
-                    let rem = crate::input::InputEvent {
-                        flags: crate::input::encode_gamepad_remove(idx as u8, seq[idx]),
-                        ..ev
-                    };
-                    let _ = conn.send_datagram(rem.encode().to_vec().into());
-                    continue;
-                }
-                if gamepad_snapshots && ev.kind == InputKind::GamepadArrival && idx < MAX_PADS {
-                    // Remember the declared kind (`code`) and forward it, arming a re-send burst
-                    // so the host learns it before the pad's first frame even under loss.
-                    arrival[idx] = Some(ev.code as u8);
-                    arrival_owed[idx] = ARRIVAL_RESENDS;
-                    let _ = conn.send_datagram(ev.encode().to_vec().into());
-                    continue;
-                }
-                let _ = conn.send_datagram(ev.encode().to_vec().into());
-            }
-            _ = refresh.tick() => {
-                for idx in 0..MAX_PADS {
-                    // Re-send an owed kind declaration (independent of whether the pad has state
-                    // yet — it may be idle-but-connected). Idempotent on the host.
-                    if arrival_owed[idx] > 0 {
-                        if let Some(kind) = arrival[idx] {
-                            arrival_owed[idx] -= 1;
-                            let arr = crate::input::InputEvent {
-                                kind: InputKind::GamepadArrival,
-                                _pad: [0; 3],
-                                code: kind as u32,
-                                x: 0,
-                                y: 0,
-                                flags: idx as u32,
-                            };
-                            let _ = conn.send_datagram(arr.encode().to_vec().into());
-                        } else {
-                            arrival_owed[idx] = 0;
-                        }
-                    }
-                    if let Some(snap) = pads[idx].as_mut() {
-                        seq[idx] = seq[idx].wrapping_add(1);
-                        snap.seq = seq[idx];
-                        let _ = conn.send_datagram(snap.to_event().encode().to_vec().into());
-                    } else if remove_owed[idx] > 0 {
-                        // Idempotent removal re-send with a fresh seq (the host drops it as a
-                        // no-op once the pad is already gone, but a re-plug's later snapshot
-                        // still wins by seq).
-                        remove_owed[idx] -= 1;
-                        seq[idx] = seq[idx].wrapping_add(1);
-                        let rem = crate::input::InputEvent {
-                            kind: InputKind::GamepadRemove,
-                            _pad: [0; 3],
-                            code: 0,
-                            x: 0,
-                            y: 0,
-                            flags: crate::input::encode_gamepad_remove(idx as u8, seq[idx]),
-                        };
-                        let _ = conn.send_datagram(rem.encode().to_vec().into());
-                    }
-                }
-            }
-        }
-    }
-}

crates/punktfunk-core/src/clipboard.rs

@@ -145,11 +145,6 @@ pub async fn run(
                 let Some(cmd) = cmd else { break }; // NativeClient dropped
                 match cmd {
                     ClipCommand::Fetch { xfer_id, seq, file_index, mime } => {
-                        // Prune finished fetches first: a completed/failed/timed-out fetch task
-                        // drops its cancel receiver, so its sender reads closed. Without this
-                        // the map grew by one dead sender per paste for the whole session (only
-                        // an explicit Cancel ever removed entries).
-                        fetch_cancels.retain(|_, tx| !tx.is_closed());
                         let (cancel_tx, cancel_rx) = oneshot::channel();
                         fetch_cancels.insert(xfer_id, cancel_tx);
                         let conn = conn.clone();
@@ -158,36 +153,11 @@ pub async fn run(
                         tokio::spawn(run_outbound_fetch(conn, xfer_id, req, events, cancel_rx));
                     }
                     ClipCommand::Serve { req_id, bytes, last } => {
-                        // Gate on a genuinely parked fetch (the waiter registers before the
-                        // FetchRequest event is emitted, so a live serve always finds it):
-                        // bytes served under a stale/unknown/cancelled req_id would otherwise
-                        // pool here for the whole session with Ok returned for every chunk.
-                        if !serve_waiters.lock().unwrap().contains_key(&req_id) {
-                            serve_bufs.remove(&req_id);
-                        } else {
-                            let buf = serve_bufs.entry(req_id).or_default();
-                            if buf.len().saturating_add(bytes.len()) > CLIP_FETCH_CAP {
-                                // The requester bounds its read at CLIP_FETCH_CAP — anything
-                                // larger is memory burned toward a guaranteed peer rejection.
-                                // Fail the transfer NOW: peer reads UNAVAILABLE, embedder gets
-                                // an Error instead of silent Ok-per-chunk.
-                                serve_bufs.remove(&req_id);
-                                if let Some(tx) = serve_waiters.lock().unwrap().remove(&req_id) {
-                                    let _ = tx.send(None);
-                                }
-                                let _ = events.try_send(ClipEventCore::Error {
-                                    id: req_id,
-                                    code: PunktfunkStatus::InvalidArg as i32,
-                                });
-                            } else {
-                                buf.extend_from_slice(&bytes);
-                                if last {
-                                    let full = serve_bufs.remove(&req_id).unwrap_or_default();
-                                    if let Some(tx) = serve_waiters.lock().unwrap().remove(&req_id)
-                                    {
-                                        let _ = tx.send(Some(full));
-                                    }
-                                }
+                        serve_bufs.entry(req_id).or_default().extend_from_slice(&bytes);
+                        if last {
+                            let full = serve_bufs.remove(&req_id).unwrap_or_default();
+                            if let Some(tx) = serve_waiters.lock().unwrap().remove(&req_id) {
+                                let _ = tx.send(Some(full));
                             }
                         }
                     }
@@ -254,27 +224,8 @@ async fn serve_inbound(
         return;
     }
 
-    // Overall stall bound (§3.4) — the inbound mirror of `run_outbound_fetch`'s: an embedder
-    // that never answers must not hold the waiter, this task, and the accepted bi-stream open
-    // for the rest of the session (~100 unanswered pastes exhaust the connection's bidi-stream
-    // budget and every later host paste stalls). `send.stopped()` additionally wakes us the
-    // moment the peer gives up on its side of the fetch.
-    let answer = tokio::select! {
-        r = rx => r.ok().flatten(),
-        _ = send.stopped() => {
-            let _ = events.try_send(ClipEventCore::Cancelled { id: req_id });
-            None
-        }
-        _ = tokio::time::sleep(std::time::Duration::from_secs(FETCH_STALL_SECS)) => {
-            let _ = events.try_send(ClipEventCore::Cancelled { id: req_id });
-            None
-        }
-    };
-    // Idempotent — the answering/denying paths already removed it; the stall paths must.
-    waiters.lock().unwrap().remove(&req_id);
-
-    match answer {
-        Some(bytes) => {
+    match rx.await {
+        Ok(Some(bytes)) => {
             if clipstream::write_fetch_hdr(
                 &mut send,
                 &ClipFetchHdr {
@@ -351,65 +302,3 @@ async fn run_outbound_fetch(
         }
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::quic::test_util::connect_pair;
-    use crate::quic::CLIP_FILE_INDEX_NONE;
-
-    /// A serve chunk that alone breaches the requester-side CLIP_FETCH_CAP must fail the
-    /// transfer immediately — Error to the embedder, UNAVAILABLE to the peer — instead of
-    /// accumulating Ok-per-chunk toward a guaranteed peer-side rejection. Also pins the
-    /// waiter-membership gate: the serve only accumulated because the fetch was parked.
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn oversized_serve_fails_the_transfer_instead_of_buffering() {
-        let (_s, _c, host_conn, client_conn) = connect_pair().await;
-        let (ev_tx, ev_rx) = std::sync::mpsc::sync_channel(16);
-        let (cmd_tx, cmd_rx) = tokio::sync::mpsc::unbounded_channel();
-        tokio::spawn(run(client_conn, ev_tx, cmd_rx));
-
-        // Host pastes: it opens a fetch bi-stream toward the client.
-        let req = ClipFetch {
-            seq: 1,
-            file_index: CLIP_FILE_INDEX_NONE,
-            mime: "text/plain;charset=utf-8".into(),
-        };
-        let (_send, mut recv) = clipstream::open_fetch(&host_conn, &req).await.unwrap();
-
-        // The client core surfaces the FetchRequest (the waiter is parked now).
-        let (req_id, ev_rx) = tokio::task::spawn_blocking(move || {
-            match ev_rx
-                .recv_timeout(std::time::Duration::from_secs(5))
-                .unwrap()
-            {
-                ClipEventCore::FetchRequest { req_id, .. } => (req_id, ev_rx),
-                other => panic!("expected FetchRequest, got {other:?}"),
-            }
-        })
-        .await
-        .unwrap();
-
-        cmd_tx
-            .send(ClipCommand::Serve {
-                req_id,
-                bytes: vec![0u8; CLIP_FETCH_CAP + 1],
-                last: false,
-            })
-            .unwrap();
-        let ev = tokio::task::spawn_blocking(move || {
-            ev_rx
-                .recv_timeout(std::time::Duration::from_secs(5))
-                .unwrap()
-        })
-        .await
-        .unwrap();
-        match ev {
-            ClipEventCore::Error { id, .. } => assert_eq!(id, req_id),
-            other => panic!("expected Error, got {other:?}"),
-        }
-        // The peer's read side sees the transfer refused, not a hang.
-        let hdr = clipstream::read_fetch_hdr(&mut recv).await.unwrap();
-        assert_eq!(hdr.status, CLIP_FETCH_UNAVAILABLE);
-    }
-}

crates/punktfunk-core/src/config.rs

@@ -548,100 +548,4 @@ mod tests {
             Some(SteamController)
         );
     }
-
-    #[test]
-    fn compositor_pref_wire_and_names() {
-        for p in [
-            CompositorPref::Auto,
-            CompositorPref::Kwin,
-            CompositorPref::Wlroots,
-            CompositorPref::Mutter,
-            CompositorPref::Gamescope,
-        ] {
-            assert_eq!(CompositorPref::from_u8(p.to_u8()), p);
-            assert_eq!(CompositorPref::from_name(p.as_str()), Some(p));
-        }
-        // Aliases + unknowns.
-        assert_eq!(CompositorPref::from_name("KDE"), Some(CompositorPref::Kwin));
-        assert_eq!(
-            CompositorPref::from_name("sway"),
-            Some(CompositorPref::Wlroots)
-        );
-        assert_eq!(CompositorPref::from_name("nope"), None);
-        // Unknown wire byte degrades to Auto (forward-compatible).
-        assert_eq!(CompositorPref::from_u8(200), CompositorPref::Auto);
-    }
-
-    #[test]
-    fn gamepad_pref_wire_and_names() {
-        for p in [
-            GamepadPref::Auto,
-            GamepadPref::Xbox360,
-            GamepadPref::DualSense,
-            GamepadPref::XboxOne,
-            GamepadPref::DualShock4,
-            GamepadPref::SteamController,
-            GamepadPref::SteamDeck,
-            GamepadPref::DualSenseEdge,
-            GamepadPref::SwitchPro,
-            GamepadPref::SteamController2,
-            GamepadPref::SteamController2Puck,
-        ] {
-            assert_eq!(GamepadPref::from_u8(p.to_u8()), p);
-            assert_eq!(GamepadPref::from_name(p.as_str()), Some(p));
-        }
-        // Every wire byte 0..=10 is assigned, distinct, and pinned (forward-compat with peers
-        // that only know a prefix of the range).
-        for (v, p) in [
-            (0, GamepadPref::Auto),
-            (1, GamepadPref::Xbox360),
-            (2, GamepadPref::DualSense),
-            (3, GamepadPref::XboxOne),
-            (4, GamepadPref::DualShock4),
-            (5, GamepadPref::SteamController),
-            (6, GamepadPref::SteamDeck),
-            (7, GamepadPref::DualSenseEdge),
-            (8, GamepadPref::SwitchPro),
-            (9, GamepadPref::SteamController2),
-            (10, GamepadPref::SteamController2Puck),
-        ] {
-            assert_eq!(p.to_u8(), v);
-            assert_eq!(GamepadPref::from_u8(v), p);
-        }
-        // The next unassigned byte degrades to Auto today; assigning it later must update this.
-        assert_eq!(GamepadPref::from_u8(11), GamepadPref::Auto);
-        // Aliases + unknowns.
-        assert_eq!(GamepadPref::from_name("PS5"), Some(GamepadPref::DualSense));
-        assert_eq!(GamepadPref::from_name("x360"), Some(GamepadPref::Xbox360));
-        assert_eq!(GamepadPref::from_name("ps4"), Some(GamepadPref::DualShock4));
-        assert_eq!(GamepadPref::from_name("DS4"), Some(GamepadPref::DualShock4));
-        assert_eq!(
-            GamepadPref::from_name("edge"),
-            Some(GamepadPref::DualSenseEdge)
-        );
-        assert_eq!(
-            GamepadPref::from_name("Switch-Pro"),
-            Some(GamepadPref::SwitchPro)
-        );
-        assert_eq!(
-            GamepadPref::from_name("ibex"),
-            Some(GamepadPref::SteamController2)
-        );
-        assert_eq!(
-            GamepadPref::from_name("sc2"),
-            Some(GamepadPref::SteamController2)
-        );
-        assert_eq!(
-            GamepadPref::from_name("sc2puck"),
-            Some(GamepadPref::SteamController2Puck)
-        );
-        assert_eq!(
-            GamepadPref::from_name("xbox-one"),
-            Some(GamepadPref::XboxOne)
-        );
-        assert_eq!(GamepadPref::from_name("series"), Some(GamepadPref::XboxOne));
-        assert_eq!(GamepadPref::from_name("nope"), None);
-        // Unknown wire byte degrades to Auto (forward-compatible).
-        assert_eq!(GamepadPref::from_u8(200), GamepadPref::Auto);
-    }
 }

crates/punktfunk-core/src/fec/gf8.rs

@@ -86,18 +86,8 @@ impl ErasureCoder for Gf8Coder {
             // No FEC: every original must already be present.
             return collect_originals(received, data_count);
         }
-        // Same (k, m)-keyed cache as `encode_into`: a fresh ReedSolomon per lossy block costs a
-        // full generator build (k×2k Gauss-Jordan + total×k×k multiply) on the real-time pump
-        // thread AND forfeits the instance's decode-matrix cache for stable loss patterns.
-        let mut guard = self.rs.lock().unwrap_or_else(|p| p.into_inner());
-        let cached =
-            matches!(&*guard, Some((ck, cm, _)) if *ck == data_count && *cm == recovery_count);
-        if !cached {
-            let rs = ReedSolomon::new(data_count, recovery_count)
-                .map_err(|_| FecError::Config("invalid GF(2^8) shard counts"))?;
-            *guard = Some((data_count, recovery_count, rs));
-        }
-        let rs = &guard.as_ref().expect("cache populated above").2;
+        let rs = ReedSolomon::new(data_count, recovery_count)
+            .map_err(|_| FecError::Config("invalid GF(2^8) shard counts"))?;
         rs.reconstruct_data(received)
             .map_err(|_| FecError::Backend("gf8 reconstruct"))?;
         collect_originals(received, data_count)
@@ -126,17 +116,8 @@ impl ErasureCoder for Gf8Coder {
         for &(j, bytes) in recovery {
             received[data_count + j] = Some(bytes.to_vec());
         }
-        // Cache the codec by (k, m) exactly as `encode_into`/`reconstruct` do (see the note
-        // there) — this path runs per lossy block on the pump thread.
-        let mut guard = self.rs.lock().unwrap_or_else(|p| p.into_inner());
-        let cached =
-            matches!(&*guard, Some((ck, cm, _)) if *ck == data_count && *cm == recovery_count);
-        if !cached {
-            let rs = ReedSolomon::new(data_count, recovery_count)
-                .map_err(|_| FecError::Config("invalid GF(2^8) shard counts"))?;
-            *guard = Some((data_count, recovery_count, rs));
-        }
-        let rs = &guard.as_ref().expect("cache populated above").2;
+        let rs = ReedSolomon::new(data_count, recovery_count)
+            .map_err(|_| FecError::Config("invalid GF(2^8) shard counts"))?;
         rs.reconstruct_data(&mut received)
             .map_err(|_| FecError::Backend("gf8 reconstruct"))?;
         for (i, h) in have.iter().enumerate() {

crates/punktfunk-core/src/lib.rs

@@ -16,17 +16,6 @@
 //!   (recv → open → reorder → FEC recover → reassemble) state machines.
 //! - [`transport`] — pluggable packet I/O (in-process loopback for tests; UDP for real).
 //! - [`abi`] — the `extern "C"` surface and `cbindgen`-generated `punktfunk_core.h`.
-//! - [`config`] / [`error`] / [`stats`] — session configuration, the shared error/status
-//!   vocabulary, and the counters snapshot.
-//! - [`input`] — the wire input-event vocabulary (keyboard/mouse/touch, gamepad snapshots).
-//! - [`reject`] — typed application-close rejection codes · [`reanchor`] — the post-loss
-//!   freeze-until-reanchor client gate · [`render_scale`] — the shared render-scale setting ·
-//!   [`audio`] — Opus PCM decode for C-ABI embedders · [`wol`] — Wake-on-LAN.
-//! - `quic` (feature `quic`) — the punktfunk/1 control plane: handshake, typed control
-//!   messages, pairing (SPAKE2), the datagram plane codecs, and clock sync. With it come
-//!   `client` (the embeddable NativeClient worker), `abr` (the adaptive-bitrate
-//!   controller), and `clipboard` (the shared-clipboard transport task). `tls`
-//!   (feature `tls`) — the pinned-fingerprint certificate verifier.
 //!
 //! ## Threading contract
 //!
@@ -94,15 +83,7 @@ pub use stats::Stats;
 /// `punktfunk_connection_clipboard_{control,offer,fetch,serve,cancel}` +
 /// `punktfunk_connection_next_clipboard`. Additive; the wire grows only backward-compatible control
 /// messages (0x40-0x44) and a new `Welcome::host_caps` bit, so [`WIRE_VERSION`] is unchanged.
-/// v9: `PunktfunkFrame` grew `received_ns` — the reassembly-completion receipt stamp, so
-/// embedders stop stamping receipt at the hand-off pull (which folds the pre-decode queue wait
-/// into apparent network latency). Struct-size change on the frame poll surface = a hard ABI
-/// break for embedders reading `PunktfunkFrame`; nothing on the wire moved, so [`WIRE_VERSION`]
-/// is unchanged.
-/// v10: added `punktfunk_connection_clock_offset_now_ns` — the LIVE (mid-stream re-synced)
-/// clock offset ongoing latency math must use; the connect-time getter stays frozen by
-/// contract. Additive, client-local — no wire change, so [`WIRE_VERSION`] is unchanged.
-pub const ABI_VERSION: u32 = 10;
+pub const ABI_VERSION: u32 = 8;
 
 /// The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
 /// Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**

crates/punktfunk-core/src/packet/packetize.rs

@@ -39,58 +39,10 @@ pub struct Packetizer {
     /// DATA shards before any block's parity — all blocks' parity must stay alive until the
     /// frame's second emission pass.
     recovery: Vec<Vec<Vec<u8>>>,
-    /// The peer's per-block `data + recovery` acceptance ceiling, frozen from the **negotiated**
-    /// config exactly as the far side derives it in [`ReassemblerLimits::from_config`]. Adaptive
-    /// FEC moves `fec.fec_percent` live ([`set_fec_percent`](Self::set_fec_percent)) but the
-    /// receiver's ceiling is computed once at session construction and never re-derived, so parity
-    /// must be clamped against this or a raised percentage puts blocks over the far side's bound —
-    /// where every packet of the block is dropped wholesale, the frame never completes, and the
-    /// resulting loss pushes adaptive FEC *higher*. See the `recovery_for` clamp in `packetize_each`.
-    max_total_shards: usize,
-    /// The peer's per-frame block ceiling, mirroring [`ReassemblerLimits::from_config`]'s
-    /// `max_blocks` — the streamed path's bound on how many sentinel blocks it may emit (a
-    /// streamed AU's size isn't known up front, so this is the only pre-emission guard against
-    /// producing a frame the receiver must reject).
-    max_blocks: usize,
-}
-
-/// One in-progress **streamed** access unit (design/nvenc-subframe-slice-output.md Phase 2):
-/// the caller feeds encoder chunks in as they exist ([`Packetizer::push_streamed`]) and every
-/// completed `max_data_per_block × shard_payload` block leaves under SENTINEL headers
-/// (`frame_bytes = 0`, `block_count = 0` — "not final yet") before the AU's total size is
-/// known; [`Packetizer::finish_streamed`] seals the tail block with the real totals and
-/// `FLAG_EOF`. Only ever sent to a peer that advertised
-/// [`crate::quic::VIDEO_CAP_STREAMED_AU`].
-pub struct StreamedAu {
-    frame_index: u32,
-    pts_ns: u64,
-    user_flags: u32,
-    /// Bytes not yet sealed into a block. Kept ≤ one block by `push_streamed` (it flushes only
-    /// while STRICTLY more than a block is buffered, so the final block always has ≥ 1 byte and
-    /// a sentinel block is never retroactively the frame's last).
-    pending: Vec<u8>,
-    /// Sentinel blocks already emitted.
-    blocks_out: u16,
-    /// Total AU bytes accumulated so far (`pending` included).
-    total_bytes: u64,
-    /// The frame's first packet (block 0, shard 0 — carries `FLAG_SOF`) has been emitted.
-    opened: bool,
-}
-
-impl StreamedAu {
-    /// The wire frame index this AU is sealed with (the caller's RFI bookkeeping domain).
-    pub fn frame_index(&self) -> u32 {
-        self.frame_index
-    }
 }
 
 impl Packetizer {
     pub fn new(config: &Config) -> Self {
-        let max_data = config.fec.max_data_per_block as usize;
-        let total_data_max = config
-            .max_frame_bytes
-            .div_ceil(config.shard_payload.max(1))
-            .max(1);
         Packetizer {
             next_frame_index: 0,
             next_probe_index: 0,
@@ -100,10 +52,6 @@ impl Packetizer {
             version: config.phase as u8,
             tail: Vec::new(),
             recovery: Vec::new(),
-            // Mirrors `ReassemblerLimits::from_config` — keep the two in step.
-            max_total_shards: (max_data + config.fec.recovery_for(max_data))
-                .min(config.fec.scheme.max_total_shards()),
-            max_blocks: total_data_max.div_ceil(max_data).max(1),
         }
     }
 
@@ -225,15 +173,6 @@ impl Packetizer {
         };
         // Per-block shard geometry (deterministic — recomputed in both passes).
         let block_data_count = |b: usize| ((b + 1) * max_block).min(total_data) - b * max_block;
-        // Parity for a `k`-shard block: the configured percentage, clamped so the block's wire
-        // total never exceeds what the peer will accept (see `max_total_shards`). The clamp only
-        // binds on blocks near `max_data_per_block`; smaller blocks keep the full adaptive range,
-        // so raising FEC still buys real protection wherever there is headroom. Bound as locals,
-        // not as a `&self` method: `emit_one` below would otherwise capture all of `self` and
-        // collide with the `&mut self.recovery[b]` parity borrow.
-        let (fec, max_total_shards) = (self.fec, self.max_total_shards);
-        let recovery_for =
-            move |k: usize| fec.recovery_for(k).min(max_total_shards.saturating_sub(k));
 
         // One parity pool per block, reused across frames (steady-state zero-alloc).
         if self.recovery.len() < block_count {
@@ -244,7 +183,7 @@ impl Packetizer {
         let mut total_recovery = 0usize;
         for b in 0..block_count {
             let k = block_data_count(b);
-            let m = recovery_for(k);
+            let m = self.fec.recovery_for(k);
             if k + m > u16::MAX as usize {
                 return Err(PunktfunkError::Unsupported("block shard count exceeds u16"));
             }
@@ -265,7 +204,7 @@ impl Packetizer {
                     block_index: b as u16,
                     block_count: block_count as u16,
                     data_shards: k as u16,
-                    recovery_shards: recovery_for(k) as u16,
+                    recovery_shards: self.fec.recovery_for(k) as u16,
                     shard_index: shard_index as u16,
                     shard_bytes: payload as u16,
                     magic: PUNKTFUNK_MAGIC,
@@ -284,7 +223,7 @@ impl Packetizer {
 
             // This block's data shards: references into `frame` (plus the staged tail).
             let data_shards: Vec<&[u8]> = (first..first + k).map(shard_at).collect();
-            let recovery_count = recovery_for(k);
+            let recovery_count = self.fec.recovery_for(k);
             coder.encode_into(&data_shards, recovery_count, &mut self.recovery[b])?;
 
             for (shard_index, body) in data_shards.iter().enumerate() {
@@ -303,7 +242,7 @@ impl Packetizer {
         let mut parity_left = total_recovery;
         for b in 0..block_count {
             let k = block_data_count(b);
-            let recovery_count = recovery_for(k);
+            let recovery_count = self.fec.recovery_for(k);
             for r in 0..recovery_count {
                 parity_left -= 1;
                 let mut flags = FLAG_PIC;
@@ -317,202 +256,4 @@ impl Packetizer {
         self.next_seq = next_seq;
         Ok(())
     }
-
-    /// Open a **streamed** access unit (see [`StreamedAu`]). `frame_index` follows the same
-    /// contract as [`packetize_each`](Self::packetize_each): `Some(i)` = the caller owns the
-    /// video numbering; `None` draws from the internal counter.
-    pub fn begin_streamed(
-        &mut self,
-        pts_ns: u64,
-        user_flags: u32,
-        frame_index: Option<u32>,
-    ) -> StreamedAu {
-        let frame_index = frame_index.unwrap_or_else(|| {
-            let i = self.next_frame_index;
-            self.next_frame_index = i.wrapping_add(1);
-            i
-        });
-        StreamedAu {
-            frame_index,
-            pts_ns,
-            user_flags,
-            pending: Vec::new(),
-            blocks_out: 0,
-            total_bytes: 0,
-            opened: false,
-        }
-    }
-
-    /// Feed one encoder chunk into a streamed AU, emitting every block that COMPLETES under
-    /// sentinel headers (`frame_bytes = 0`, `block_count = 0`, exactly `max_data_per_block`
-    /// data shards — the receiver's offset formula needs no total). Flushes only while
-    /// STRICTLY more than one block is buffered, so the frame's last block — whose header must
-    /// carry the real totals — is never emitted here. Packets reach `emit` in wire order (the
-    /// caller's nonce order), data then parity per block.
-    pub fn push_streamed(
-        &mut self,
-        au: &mut StreamedAu,
-        chunk: &[u8],
-        coder: &dyn ErasureCoder,
-        mut emit: impl FnMut(&PacketHeader, &[u8]) -> Result<()>,
-    ) -> Result<()> {
-        au.total_bytes += chunk.len() as u64;
-        au.pending.extend_from_slice(chunk);
-        let block_bytes = self.fec.max_data_per_block as usize * self.shard_payload;
-        while au.pending.len() > block_bytes {
-            // Room for this sentinel block AND the final block after it, within the peer's
-            // per-frame block ceiling and the u16 wire field.
-            if au.blocks_out as usize + 2 > self.max_blocks.min(u16::MAX as usize) {
-                return Err(PunktfunkError::Unsupported(
-                    "streamed AU exceeds the negotiated max_frame_bytes",
-                ));
-            }
-            let sof = !au.opened;
-            let (bi, pts, uf) = (au.blocks_out, au.pts_ns, au.user_flags);
-            let fi = au.frame_index;
-            self.emit_streamed_block(
-                fi,
-                pts,
-                uf,
-                bi,
-                &au.pending[..block_bytes],
-                0,
-                0,
-                sof,
-                false,
-                coder,
-                &mut emit,
-            )?;
-            au.pending.drain(..block_bytes);
-            au.blocks_out += 1;
-            au.opened = true;
-        }
-        Ok(())
-    }
-
-    /// Close a streamed AU: seal the final block — its headers carry the REAL
-    /// `frame_bytes`/`block_count`, which retro-validate the whole frame at the receiver — with
-    /// `FLAG_EOF` on the last emitted packet. An empty AU degenerates to today's single
-    /// zero-padded-shard frame (`block_count = 1`, never a sentinel).
-    pub fn finish_streamed(
-        &mut self,
-        au: StreamedAu,
-        coder: &dyn ErasureCoder,
-        mut emit: impl FnMut(&PacketHeader, &[u8]) -> Result<()>,
-    ) -> Result<()> {
-        let frame_bytes = u32::try_from(au.total_bytes)
-            .map_err(|_| PunktfunkError::Unsupported("streamed AU exceeds u32 bytes"))?;
-        let block_count = au.blocks_out + 1;
-        self.emit_streamed_block(
-            au.frame_index,
-            au.pts_ns,
-            au.user_flags,
-            au.blocks_out,
-            &au.pending,
-            frame_bytes,
-            block_count,
-            !au.opened,
-            true,
-            coder,
-            &mut emit,
-        )
-    }
-
-    /// Seal ONE streamed block (data shards + its parity, in wire order). Sentinel blocks pass
-    /// `frame_bytes = 0` / `block_count = 0`; the final block passes the real totals. `sof`
-    /// marks the frame's very first packet, `eof` its very last.
-    #[allow(clippy::too_many_arguments)]
-    fn emit_streamed_block(
-        &mut self,
-        frame_index: u32,
-        pts_ns: u64,
-        user_flags: u32,
-        block_index: u16,
-        bytes: &[u8],
-        frame_bytes: u32,
-        block_count: u16,
-        sof: bool,
-        eof: bool,
-        coder: &dyn ErasureCoder,
-        emit: &mut impl FnMut(&PacketHeader, &[u8]) -> Result<()>,
-    ) -> Result<()> {
-        let payload = self.shard_payload;
-        if payload > u16::MAX as usize {
-            return Err(PunktfunkError::InvalidArg("shard_payload exceeds u16"));
-        }
-        // At least one (zero-padded) data shard even for an empty final block (empty AU).
-        let k = bytes.len().div_ceil(payload).max(1);
-        let m = self
-            .fec
-            .recovery_for(k)
-            .min(self.max_total_shards.saturating_sub(k));
-        if k + m > u16::MAX as usize {
-            return Err(PunktfunkError::Unsupported("block shard count exceeds u16"));
-        }
-        // Stage the one possibly-partial (or empty-frame) shard in the zero-padded scratch.
-        let full_shards = bytes.len() / payload;
-        self.tail.clear();
-        self.tail.resize(payload, 0);
-        let rem = bytes.len() % payload;
-        if rem > 0 {
-            self.tail[..rem].copy_from_slice(&bytes[full_shards * payload..]);
-        }
-        let tail = &self.tail;
-        let shard_at = |s: usize| -> &[u8] {
-            if s < full_shards {
-                &bytes[s * payload..(s + 1) * payload]
-            } else {
-                tail.as_slice()
-            }
-        };
-        let data_shards: Vec<&[u8]> = (0..k).map(shard_at).collect();
-        if self.recovery.is_empty() {
-            self.recovery.push(Vec::new());
-        }
-        coder.encode_into(&data_shards, m, &mut self.recovery[0])?;
-
-        let mut next_seq = self.next_seq;
-        let mut emit_one = |next_seq: &mut u32, shard_index: usize, body: &[u8], flags: u8| {
-            let seq = *next_seq;
-            *next_seq = next_seq.wrapping_add(1);
-            let hdr = PacketHeader {
-                pts_ns,
-                frame_index,
-                stream_seq: seq,
-                frame_bytes,
-                user_flags,
-                block_index,
-                block_count,
-                data_shards: k as u16,
-                recovery_shards: m as u16,
-                shard_index: shard_index as u16,
-                shard_bytes: payload as u16,
-                magic: PUNKTFUNK_MAGIC,
-                version: self.version,
-                fec_scheme: coder.scheme() as u8,
-                flags,
-            };
-            emit(&hdr, body)
-        };
-        for (shard_index, body) in data_shards.iter().enumerate() {
-            let mut flags = FLAG_PIC;
-            if sof && shard_index == 0 {
-                flags |= FLAG_SOF;
-            }
-            if eof && m == 0 && shard_index + 1 == k {
-                flags |= FLAG_EOF;
-            }
-            emit_one(&mut next_seq, shard_index, body, flags)?;
-        }
-        for r in 0..m {
-            let mut flags = FLAG_PIC;
-            if eof && r + 1 == m {
-                flags |= FLAG_EOF;
-            }
-            let body: &[u8] = &self.recovery[0][r];
-            emit_one(&mut next_seq, k + r, body, flags)?;
-        }
-        self.next_seq = next_seq;
-        Ok(())
-    }
 }

crates/punktfunk-core/src/packet/reassemble.rs

@@ -70,12 +70,7 @@ struct BlockState {
 }
 
 struct FrameBuf {
-    /// Exact AU size. 0 = unknown: the frame was opened by a streamed-AU SENTINEL packet
-    /// ([`crate::quic::VIDEO_CAP_STREAMED_AU`]) and the final block's real totals haven't
-    /// arrived yet — the frame can't complete before they do (and retro-validate).
     frame_bytes: usize,
-    /// Block count; 0 = unknown (sentinel-opened, totals not yet pinned). A legacy-opened
-    /// frame always has ≥ 1 here, so 0 doubles as the "unpinned streamed" marker.
     block_count: usize,
     pts_ns: u64,
     user_flags: u32,
@@ -111,19 +106,8 @@ pub struct ReassemblerLimits {
 impl ReassemblerLimits {
     pub fn from_config(c: &Config) -> Self {
         let max_data = c.fec.max_data_per_block as usize;
-        // Size the ceiling from the whole range adaptive FEC may reach, NOT from the percentage
-        // negotiated at session start: the sender moves `fec_percent` live (`Packetizer::
-        // set_fec_percent`, clamped to ≤ 90) and the wire is self-describing, so it never
-        // renegotiates. Deriving this from the start value made every packet of a large block
-        // fail the `total > max_total_shards` check once FEC ramped up — the block never
-        // accumulated a shard, the frame aged out, and the resulting loss drove FEC *higher*,
-        // wedging large frames at 100% loss exactly when FEC was meant to rescue the link. A
-        // current sender also clamps its side (`Packetizer::recovery_for`); this keeps an
-        // already-deployed sender that doesn't from wedging a current receiver. Still a hard
-        // pre-allocation bound against hostile headers — just the sender's clamp, not a stale
-        // snapshot of it.
         let max_total =
-            (max_data + (max_data * 90).div_ceil(100)).min(c.fec.scheme.max_total_shards());
+            (max_data + c.fec.recovery_for(max_data)).min(c.fec.scheme.max_total_shards());
         let total_data = c.max_frame_bytes.div_ceil(c.shard_payload.max(1)).max(1);
         ReassemblerLimits {
             shard_bytes: c.shard_payload,
@@ -282,58 +266,33 @@ impl Reassembler {
             || total == 0
             || total > lim.max_total_shards
             || shard_index >= total
+            || block_count == 0
+            || block_count > lim.max_blocks
+            || hdr.block_index as usize >= block_count
             || frame_bytes > lim.max_frame_bytes
         {
             drop(stats);
             return Ok(None);
         }
-        // Streamed-AU sentinel ([`crate::quic::VIDEO_CAP_STREAMED_AU`]): `block_count == 0` — a
-        // value no legacy sender ever emits — marks a NON-FINAL block of an AU whose total size
-        // doesn't exist yet (the host is still encoding its tail). The exact derived-geometry
-        // check below can't run without a total, so a sentinel is bounded by the negotiated
-        // limits instead — and by construction: full-K exactly (the offset formula needs it),
-        // never the last block the limits allow (the real final block must still fit after it),
-        // and no total to lie about. The frame-wide exact check runs retroactively the moment
-        // the final block's real totals arrive (the pinning arm below).
-        let sentinel = block_count == 0;
-        let block_idx = hdr.block_index as usize;
-        // For a sentinel-opened frame the buffer must hold ANY final geometry the totals may
-        // later pin — the maximum the negotiated limits allow (the design's "allocate at
-        // max_frame_bytes"; the existing in-flight budget bounds the amplification).
-        let total_data_max = lim.max_frame_bytes.div_ceil(shard_bytes).max(1);
+        // Derived-geometry firewall: every sender (our Packetizer, any version) slices a frame
+        // into consecutive blocks of exactly `max_data_per_block` data shards with only the LAST
+        // block smaller, and stamps the exact `frame_bytes` in every header. That makes every
+        // data shard's final AU offset computable on arrival —
+        //     offset = (block_index × max_data_per_block + shard_index) × shard_bytes
+        // — which is what lets shards land straight in the frame buffer below. Enforce the
+        // invariant so a header lying about its geometry is dropped instead of scribbling into
+        // another shard's range.
         let total_data = frame_bytes.div_ceil(shard_bytes).max(1);
-        if sentinel {
-            if frame_bytes != 0
-                || data_shards != lim.max_data_shards
-                || block_idx + 1 >= lim.max_blocks
-            {
-                drop(stats);
-                return Ok(None);
-            }
+        let expect_blocks = total_data.div_ceil(lim.max_data_shards).max(1);
+        let block_idx = hdr.block_index as usize;
+        let expect_data_shards = if block_idx + 1 == expect_blocks {
+            total_data - (expect_blocks - 1) * lim.max_data_shards
         } else {
-            if block_count > lim.max_blocks || block_idx >= block_count {
-                drop(stats);
-                return Ok(None);
-            }
-            // Derived-geometry firewall: every sender (our Packetizer, any version) slices a
-            // frame into consecutive blocks of exactly `max_data_per_block` data shards with
-            // only the LAST block smaller, and stamps the exact `frame_bytes` in every
-            // non-sentinel header. That makes every data shard's final AU offset computable on
-            // arrival —
-            //     offset = (block_index × max_data_per_block + shard_index) × shard_bytes
-            // — which is what lets shards land straight in the frame buffer below. Enforce the
-            // invariant so a header lying about its geometry is dropped instead of scribbling
-            // into another shard's range.
-            let expect_blocks = total_data.div_ceil(lim.max_data_shards).max(1);
-            let expect_data_shards = if block_idx + 1 == expect_blocks {
-                total_data - (expect_blocks - 1) * lim.max_data_shards
-            } else {
-                lim.max_data_shards
-            };
-            if block_count != expect_blocks || data_shards != expect_data_shards {
-                drop(stats);
-                return Ok(None);
-            }
+            lim.max_data_shards
+        };
+        if block_count != expect_blocks || data_shards != expect_data_shards {
+            drop(stats);
+            return Ok(None);
         }
         let body = &pkt[HEADER_LEN..HEADER_LEN + shard_bytes];
 
@@ -380,13 +339,8 @@ impl Reassembler {
         }
 
         // First packet of a frame allocates its whole (zeroed) buffer, budget-gated; later
-        // packets must agree with its geometry. A sentinel-opened (streamed) frame allocates at
-        // the limits' maximum — its real size doesn't exist yet.
-        let buf_len = if sentinel {
-            total_data_max * shard_bytes
-        } else {
-            total_data * shard_bytes
-        };
+        // packets must agree with its geometry.
+        let buf_len = total_data * shard_bytes;
         let frame = match win.frames.entry(hdr.frame_index) {
             std::collections::hash_map::Entry::Occupied(e) => e.into_mut(),
             std::collections::hash_map::Entry::Vacant(e) => {
@@ -409,66 +363,7 @@ impl Reassembler {
                 })
             }
         };
-        if sentinel {
-            // Sentinel packets carry no totals to cross-check: while the frame is unpinned
-            // (`block_count == 0`) they match by construction, and once the totals are pinned —
-            // whichever packet arrived first, sentinel or final (reorder is normal) — a
-            // sentinel block must still be NON-final under them. Its full-K shape was already
-            // enforced by the firewall, which is exactly what the pinned geometry demands of
-            // every non-final block, and its shard offsets are within the pinned range by
-            // `block_idx + 1 < block_count`.
-            if frame.block_count != 0 && block_idx + 1 >= frame.block_count {
-                drop(stats);
-                return Ok(None);
-            }
-        } else if frame.block_count == 0 {
-            // A streamed frame meets its FINAL block's real totals: retro-validate every block
-            // the sentinels created against the exact geometry these totals derive (the same
-            // invariant the firewall enforces per-packet for legacy frames), then PIN them. A
-            // header that lies — totals under which an already-received sentinel block is
-            // out of range or not full-K — kills the WHOLE frame: its landed shards can't be
-            // trusted to be at the offsets this geometry means, so delivering any of it would
-            // hand the decoder spliced bytes.
-            let expect_blocks = total_data.div_ceil(lim.max_data_shards).max(1);
-            let final_k = total_data - (expect_blocks - 1) * lim.max_data_shards;
-            let lied = frame.blocks.iter().any(|(&bi, b)| {
-                let bi = bi as usize;
-                bi >= expect_blocks
-                    || (bi + 1 < expect_blocks && b.data_shards != lim.max_data_shards)
-                    || (bi + 1 == expect_blocks && b.data_shards != final_k)
-            });
-            if lied {
-                let mut f = win
-                    .frames
-                    .remove(&hdr.frame_index)
-                    .expect("frame entry exists");
-                *in_flight_bytes -= f.buf.len();
-                // Remember the index (with its late-shard memory, exactly like an aged-out
-                // frame) so stragglers can't resurrect it, reclaim the parity buffers, and
-                // count the loss — the client's recovery request is the right outcome for a
-                // frame that was destroyed by a lying header.
-                win.completed.insert(
-                    hdr.frame_index,
-                    reconstructed_shards(&f.blocks, lim.max_data_shards),
-                );
-                for block in f.blocks.values_mut() {
-                    for slot in block.recovery.iter_mut() {
-                        if let Some(rb) = slot.take() {
-                            if recovery_pool.len() < RECOVERY_POOL_MAX {
-                                recovery_pool.push(rb);
-                            }
-                        }
-                    }
-                }
-                if !is_probe {
-                    StatsCounters::add(&stats.frames_dropped, 1);
-                }
-                drop(stats);
-                return Ok(None);
-            }
-            frame.frame_bytes = frame_bytes;
-            frame.block_count = block_count;
-        } else if frame.block_count != block_count || frame.frame_bytes != frame_bytes {
+        if frame.block_count != block_count || frame.frame_bytes != frame_bytes {
             drop(stats);
             return Ok(None);
         }
@@ -476,7 +371,6 @@ impl Reassembler {
             buf,
             blocks,
             blocks_ok,
-            block_count: frame_block_count,
             ..
         } = frame;
 
@@ -497,14 +391,6 @@ impl Reassembler {
             drop(stats);
             return Ok(None);
         }
-        // Defense-in-depth (2026-07 security review): the geometry invariants above guarantee
-        // every packet of a block agrees on K, so this can't fire today — but `have_data`
-        // indexing and the recovery-slot math below assume it, and an explicit check keeps a
-        // future firewall refactor from turning that assumption into an OOB panic.
-        if block.data_shards != data_shards {
-            drop(stats);
-            return Ok(None);
-        }
         if block.done {
             // A data shard the parity reconstruct already restored (`!have_data`) was late, not
             // lost — net it out of the `fec_recovered_shards` it was counted into (see the
@@ -588,12 +474,8 @@ impl Reassembler {
             }
         }
 
-        // Whole frame ready? Judged against the FRAME's pinned block count, not this packet's
-        // header — a streamed frame can complete on a reordered sentinel packet (header says 0)
-        // after the final block already pinned the real totals, and can never complete before
-        // they're pinned (`0` never equals a non-zero `blocks_ok`).
-        let block_count = *frame_block_count;
-        if block_count != 0 && *blocks_ok == block_count {
+        // Whole frame ready?
+        if *blocks_ok == block_count {
             let mut done = win.frames.remove(&hdr.frame_index).unwrap();
             win.completed.insert(
                 hdr.frame_index,
@@ -607,7 +489,6 @@ impl Reassembler {
                 pts_ns: done.pts_ns,
                 flags: done.user_flags,
                 complete: true,
-                received_ns: 0, // stamped by Session::poll_frame at the session boundary
             }));
         }
         Ok(None)
@@ -625,10 +506,6 @@ impl Reassembler {
         // The dropped frames' buffers (and their parity bufs) go back to the allocator, not the
         // pool — a flush is the rare path. The budget resets with them.
         self.in_flight_bytes = 0;
-        // An aged-out partial parked for delivery is from the discarded past too — without this
-        // it survives `flush_backlog` and gets handed up as the first "frame" after the
-        // jump-to-live, exactly the stale content the flush existed to discard.
-        self.pending_partial = None;
     }
 }
 
@@ -702,10 +579,7 @@ impl ReassemblyWindow {
                 // where shards are missing (the codec's block walk skips zero windows).
                 // Newest-wins if several age out in one prune. Still counted dropped below.
                 if let Some(sink) = partial_sink.as_deref_mut() {
-                    // `frame_bytes > 0` also excludes an UNPINNED streamed frame (its total is
-                    // still the 0 sentinel value): truncating its max-sized buffer to 0 would
-                    // deliver an empty "partial" — worse than the plain drop it gets instead.
-                    if f.user_flags & USER_FLAG_CHUNK_ALIGNED != 0 && f.frame_bytes > 0 {
+                    if f.user_flags & USER_FLAG_CHUNK_ALIGNED != 0 {
                         let mut buf = std::mem::take(&mut f.buf);
                         buf.truncate(f.frame_bytes);
                         let newer = sink
@@ -718,7 +592,6 @@ impl ReassemblyWindow {
                                 pts_ns: f.pts_ns,
                                 flags: f.user_flags,
                                 complete: false,
-                                received_ns: 0, // stamped by Session::poll_frame at the session boundary
                             });
                         }
                     }
@@ -759,35 +632,3 @@ impl ReassemblyWindow {
         }
     }
 }
-
-#[cfg(test)]
-mod reset_tests {
-    use super::*;
-
-    /// `flush_backlog` discards the past wholesale — an aged-out partial parked for delivery is
-    /// part of that past and must not survive [`Reassembler::reset`] to be handed up as the
-    /// first "frame" after a jump-to-live.
-    #[test]
-    fn reset_drops_a_parked_partial() {
-        let mut r = Reassembler::new(ReassemblerLimits {
-            shard_bytes: 64,
-            max_data_shards: 8,
-            max_total_shards: 16,
-            max_blocks: 4,
-            max_frame_bytes: 4096,
-        });
-        r.pending_partial = Some(Frame {
-            data: vec![0u8; 64],
-            frame_index: 7,
-            pts_ns: 1,
-            flags: 0,
-            complete: false,
-            received_ns: 0,
-        });
-        r.reset();
-        assert!(
-            r.take_partial().is_none(),
-            "a pre-flush partial must not survive reset()"
-        );
-    }
-}

crates/punktfunk-core/src/packet/tests.rs

@@ -579,463 +579,3 @@ fn rejects_wrong_shard_bytes_and_oversized_frame() {
         .is_none());
     assert_eq!(stats.snapshot().packets_dropped, 1);
 }
-
-/// Adaptive FEC raises `fec_percent` mid-session while the receiver's per-block acceptance
-/// ceiling is frozen at session construction and never renegotiated. A maximal block must
-/// therefore still land: the sender clamps its parity to the ceiling
-/// (`Packetizer::recovery_for`), and the receiver sizes that ceiling from the whole clamp range
-/// rather than the start percentage. Regression guard for the wedge this caused — every packet
-/// of a large block failing `total > max_total_shards`, so the frame never completed and the
-/// resulting loss drove adaptive FEC higher still.
-#[test]
-fn adaptive_fec_ramp_keeps_maximal_blocks_within_the_peers_ceiling() {
-    let cfg = e2e_config(FecScheme::Gf16, 10);
-    let coder = coder_for(FecScheme::Gf16);
-    let lim = ReassemblerLimits::from_config(&cfg);
-    let mut pk = Packetizer::new(&cfg);
-
-    // Ramp far past the negotiated 10% — exactly what `apply_fec_target` does under loss.
-    pk.set_fec_percent(50);
-
-    // A frame of full `max_data_per_block` blocks: where the ceiling actually binds.
-    let frame_len = cfg.shard_payload * cfg.fec.max_data_per_block as usize * 2;
-    let src: Vec<u8> = (0..frame_len).map(|i| (i * 131 + 7) as u8).collect();
-    let pkts = pk.packetize(&src, 1, 0, coder.as_ref()).unwrap();
-
-    let k = cfg.fec.max_data_per_block as usize;
-    let mut clamped = false;
-    for p in &pkts {
-        let hdr = PacketHeader::read_from_bytes(&p[..HEADER_LEN]).unwrap();
-        let total = hdr.data_shards as usize + hdr.recovery_shards as usize;
-        assert!(
-            total <= lim.max_total_shards,
-            "block total {total} exceeds the peer's ceiling {} — every packet of this block \
-             would be dropped",
-            lim.max_total_shards
-        );
-        // The unclamped 50% would put 2 parity on a full block; the negotiated 10% ceiling
-        // leaves room for 1. Proves the clamp actually bound rather than passing vacuously.
-        if hdr.data_shards as usize == k {
-            assert!(
-                (hdr.recovery_shards as usize) < cfg.fec.recovery_for(k).max(1) + 1,
-                "parity must be clamped to the peer's ceiling"
-            );
-            clamped = true;
-        }
-    }
-    assert!(clamped, "test must exercise a maximal block");
-
-    // And the frame still reassembles byte-identically.
-    let mut r = Reassembler::new(lim);
-    let stats = StatsCounters::default();
-    let mut got = None;
-    for p in &pkts {
-        if let Some(f) = r.push(p, coder.as_ref(), &stats).unwrap() {
-            got = Some(f);
-        }
-    }
-    assert_eq!(
-        got.expect("frame must complete after an adaptive-FEC ramp")
-            .data,
-        src
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Streamed access units (VIDEO_CAP_STREAMED_AU — nvenc-subframe-slice-output.md Phase 2)
-// ---------------------------------------------------------------------------
-
-/// Packetize one streamed AU from `chunks` via begin/push/finish, returning the emitted wire
-/// packets (header ++ shard) and the concatenated source bytes.
-fn streamed_packets(
-    scheme: FecScheme,
-    fec_percent: u8,
-    chunks: &[&[u8]],
-) -> (Vec<Vec<u8>>, Vec<u8>) {
-    let cfg = e2e_config(scheme, fec_percent);
-    let coder = coder_for(scheme);
-    let mut pk = Packetizer::new(&cfg);
-    let mut au = pk.begin_streamed(12345, 0, Some(0));
-    let mut pkts: Vec<Vec<u8>> = Vec::new();
-    let mut src = Vec::new();
-    for c in chunks {
-        src.extend_from_slice(c);
-        pk.push_streamed(&mut au, c, coder.as_ref(), |h: &PacketHeader, b: &[u8]| {
-            let mut p = Vec::with_capacity(HEADER_LEN + b.len());
-            p.extend_from_slice(h.as_bytes());
-            p.extend_from_slice(b);
-            pkts.push(p);
-            Ok(())
-        })
-        .unwrap();
-    }
-    pk.finish_streamed(au, coder.as_ref(), |h: &PacketHeader, b: &[u8]| {
-        let mut p = Vec::with_capacity(HEADER_LEN + b.len());
-        p.extend_from_slice(h.as_bytes());
-        p.extend_from_slice(b);
-        pkts.push(p);
-        Ok(())
-    })
-    .unwrap();
-    (pkts, src)
-}
-
-/// Deliver a streamed AU's packets (optionally with kills within the FEC budget, reversed
-/// order, and a duplicate) and assert byte-identical completion. Reversed order is the
-/// critical case: the FINAL block's real-total headers arrive FIRST, the frame opens
-/// legacy-shaped, and the sentinels must still be accepted against the pinned totals.
-fn streamed_roundtrip(scheme: FecScheme, kill: &[usize], reverse: bool) {
-    let chunks: Vec<Vec<u8>> = (0..3)
-        .map(|c| (0..50).map(|i| (c * 57 + i * 131 + 7) as u8).collect())
-        .collect();
-    let chunk_refs: Vec<&[u8]> = chunks.iter().map(|c| c.as_slice()).collect();
-    let (pkts, src) = streamed_packets(scheme, 50, &chunk_refs);
-    // 150 B / 16 B shards / 4-shard blocks → sentinel blocks 0,1 (4 data + 2 rec each) +
-    // final block (2 data + 1 rec) = 15 packets.
-    assert_eq!(
-        pkts.len(),
-        15,
-        "expected geometry changed — update the kills"
-    );
-
-    let mut delivery: Vec<Vec<u8>> = pkts
-        .iter()
-        .enumerate()
-        .filter(|(i, _)| !kill.contains(i))
-        .map(|(_, p)| p.clone())
-        .collect();
-    if reverse {
-        delivery.reverse();
-    }
-    if let Some(dup) = delivery.first().cloned() {
-        delivery.push(dup);
-    }
-
-    let cfg = e2e_config(scheme, 50);
-    let mut r = Reassembler::new(ReassemblerLimits::from_config(&cfg));
-    let coder = coder_for(scheme);
-    let stats = StatsCounters::default();
-    let mut got = None;
-    for p in &delivery {
-        if let Some(f) = r.push(p, coder.as_ref(), &stats).unwrap() {
-            assert!(got.is_none(), "frame must complete exactly once");
-            got = Some(f);
-        }
-    }
-    let f = got.expect("streamed frame must complete within the FEC budget");
-    assert_eq!(
-        f.data, src,
-        "reassembled streamed AU must be byte-identical"
-    );
-    assert_eq!(f.pts_ns, 12345);
-    assert!(f.complete);
-}
-
-#[test]
-fn streamed_roundtrip_clean_and_reversed() {
-    streamed_roundtrip(FecScheme::Gf16, &[], false);
-    streamed_roundtrip(FecScheme::Gf16, &[], true);
-    streamed_roundtrip(FecScheme::Gf8, &[], true);
-}
-
-/// Loss within each block's FEC budget: one data shard from a sentinel block, one from the
-/// final block — in both delivery orders.
-#[test]
-fn streamed_roundtrip_survives_loss_and_reorder() {
-    // Wire order: blk0 = 0..4 data + 4..6 rec, blk1 = 6..10 data + 10..12 rec,
-    // final = 12..14 data + 14 rec.
-    streamed_roundtrip(FecScheme::Gf16, &[1, 12], false);
-    streamed_roundtrip(FecScheme::Gf16, &[1, 12], true);
-}
-
-/// The wire shape of a streamed AU: sentinel headers (block_count = 0, frame_bytes = 0,
-/// full-K) on every non-final block, real totals + EOF on the final block, SOF on the very
-/// first packet only.
-#[test]
-fn streamed_headers_sentinel_then_final() {
-    let chunks: Vec<Vec<u8>> = (0..3).map(|_| vec![0xA5u8; 50]).collect();
-    let chunk_refs: Vec<&[u8]> = chunks.iter().map(|c| c.as_slice()).collect();
-    let (pkts, src) = streamed_packets(FecScheme::Gf16, 50, &chunk_refs);
-    let mut saw_final = false;
-    for (i, p) in pkts.iter().enumerate() {
-        let h = PacketHeader::read_from_bytes(&p[..HEADER_LEN]).unwrap();
-        assert_eq!(
-            h.flags & FLAG_SOF != 0,
-            i == 0,
-            "SOF exactly on the first packet"
-        );
-        assert_eq!(
-            h.flags & FLAG_EOF != 0,
-            i + 1 == pkts.len(),
-            "EOF exactly on the last packet"
-        );
-        if h.block_index < 2 {
-            assert_eq!(
-                h.block_count, 0,
-                "non-final block must ride sentinel headers"
-            );
-            assert_eq!(h.frame_bytes, 0);
-            assert_eq!(h.data_shards, 4, "sentinel blocks are exactly full-K");
-        } else {
-            saw_final = true;
-            assert_eq!(h.block_count, 3, "final block carries the real block count");
-            assert_eq!(h.frame_bytes as usize, src.len(), "and the real AU size");
-        }
-    }
-    assert!(saw_final);
-}
-
-/// A streamed AU smaller than one block emits NO sentinels — its single (final) block is
-/// byte-identical in shape to a legacy frame, so small frames pay zero streaming overhead
-/// and any receiver accepts them.
-#[test]
-fn streamed_small_frame_degenerates_to_legacy() {
-    let (pkts, src) = streamed_packets(FecScheme::Gf16, 50, &[&[0x5Au8; 40]]);
-    for p in &pkts {
-        let h = PacketHeader::read_from_bytes(&p[..HEADER_LEN]).unwrap();
-        assert_eq!(
-            h.block_count, 1,
-            "single-block streamed AU must be legacy-shaped"
-        );
-        assert_eq!(h.frame_bytes as usize, src.len());
-    }
-}
-
-/// Sentinel firewall: a sentinel header that is not exactly full-K, or claims a non-zero
-/// total, or sits where the final block could no longer follow, is dropped before any
-/// allocation happens.
-#[test]
-fn streamed_sentinel_firewall_bounds() {
-    let mut r = Reassembler::new(limits());
-    let coder = coder_for(FecScheme::Gf8);
-    let stats = StatsCounters::default();
-    let sentinel = |f: fn(&mut PacketHeader)| {
-        let mut h = base_header();
-        h.block_count = 0;
-        h.frame_bytes = 0;
-        h.data_shards = 8; // limits().max_data_shards — the only legal sentinel K
-        h.recovery_shards = 0;
-        f(&mut h);
-        h
-    };
-    // Not full-K.
-    let h = sentinel(|h| h.data_shards = 7);
-    assert!(r
-        .push(&packet(h), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    // Claims a total.
-    let h = sentinel(|h| h.frame_bytes = 64);
-    assert!(r
-        .push(&packet(h), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    // Sits on the last block the limits allow (no room for the final block after it).
-    let h = sentinel(|h| h.block_index = 3); // limits().max_blocks == 4
-    assert!(r
-        .push(&packet(h), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    assert_eq!(stats.snapshot().packets_dropped, 3);
-    // A conformant sentinel IS accepted (proves the rejections above weren't vacuous).
-    let h = sentinel(|_| {});
-    assert!(r
-        .push(&packet(h), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    assert_eq!(
-        stats.snapshot().packets_dropped,
-        3,
-        "conformant sentinel accepted"
-    );
-}
-
-/// Retro-validation: final-block totals under which an already-received sentinel block is
-/// out of range (or mis-sized) kill the WHOLE frame — no spliced delivery — and the killed
-/// index cannot be resurrected by stragglers.
-#[test]
-fn streamed_lying_final_totals_kill_the_frame_wholesale() {
-    let mut r = Reassembler::new(limits());
-    let coder = coder_for(FecScheme::Gf8);
-    let stats = StatsCounters::default();
-    // Two sentinel blocks (indexes 0 and 1) open the frame and land shards.
-    for bi in 0..2u16 {
-        let mut h = base_header();
-        h.block_count = 0;
-        h.frame_bytes = 0;
-        h.data_shards = 8;
-        h.recovery_shards = 0;
-        h.block_index = bi;
-        assert!(r
-            .push(&packet(h), coder.as_ref(), &stats)
-            .unwrap()
-            .is_none());
-    }
-    // A "final" header claiming the whole AU is ONE 16-byte shard: geometry-valid on its own
-    // (expect_blocks = 1, K = 1), but it disowns both sentinel blocks → the frame dies.
-    let mut lying = base_header();
-    lying.block_count = 1;
-    lying.frame_bytes = 16;
-    lying.data_shards = 1;
-    lying.recovery_shards = 0;
-    assert!(r
-        .push(&packet(lying), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    let snap = stats.snapshot();
-    assert_eq!(
-        snap.frames_dropped, 1,
-        "the lying frame must be counted lost"
-    );
-    // A straggler sentinel for the killed index must not resurrect it.
-    let mut h = base_header();
-    h.block_count = 0;
-    h.frame_bytes = 0;
-    h.data_shards = 8;
-    h.recovery_shards = 0;
-    let before = stats.snapshot().packets_dropped;
-    assert!(r
-        .push(&packet(h), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    assert_eq!(
-        stats.snapshot().packets_dropped,
-        before + 1,
-        "straggler for a killed frame must be dropped, not re-open it"
-    );
-}
-
-/// A sentinel first-packet commits a MAX-sized frame buffer, so the in-flight budget must
-/// bite after IN_FLIGHT_BUF_FACTOR frames — the amplification bound for one-datagram opens.
-#[test]
-fn streamed_open_amplification_is_budget_bounded() {
-    let mut r = Reassembler::new(limits());
-    let coder = coder_for(FecScheme::Gf8);
-    let stats = StatsCounters::default();
-    // limits(): max_frame_bytes 4096 → each sentinel open commits 4096 B; budget = 4×4096.
-    for fi in 0..5u32 {
-        let mut h = base_header();
-        h.block_count = 0;
-        h.frame_bytes = 0;
-        h.data_shards = 8;
-        h.recovery_shards = 0;
-        h.frame_index = fi;
-        assert!(r
-            .push(&packet(h), coder.as_ref(), &stats)
-            .unwrap()
-            .is_none());
-    }
-    assert_eq!(
-        stats.snapshot().packets_dropped,
-        1,
-        "the fifth max-sized open must be refused by the in-flight budget"
-    );
-}
-
-/// The final-first order's single buffer-safety guard (2026-07 security review finding 3): a
-/// frame opened by its FINAL block allocates an EXACT-sized buffer; a sentinel aimed at (or
-/// past) the pinned final slot must be dropped — without the guard its full-K write would land
-/// outside that buffer. And the reject must not corrupt the frame: it still completes.
-#[test]
-fn streamed_out_of_range_sentinel_after_final_first_is_dropped() {
-    let mut r = Reassembler::new(limits());
-    let coder = coder_for(FecScheme::Gf8);
-    let stats = StatsCounters::default();
-    // Final block opens the frame: block_count = 1, frame_bytes = 32 → K = 2. Send shard 0
-    // only, so the frame stays in flight with the totals pinned.
-    let mut fin = base_header();
-    fin.block_count = 1;
-    fin.frame_bytes = 32;
-    fin.data_shards = 2;
-    fin.recovery_shards = 0;
-    fin.shard_index = 0;
-    assert!(r
-        .push(&packet(fin), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    // Sentinels at the final slot (0) and past it (1): both non-final-impossible under the
-    // pinned block_count = 1 → dropped, never written into the 32-byte buffer.
-    for bi in 0..2u16 {
-        let mut h = base_header();
-        h.block_count = 0;
-        h.frame_bytes = 0;
-        h.data_shards = 8;
-        h.recovery_shards = 0;
-        h.block_index = bi;
-        assert!(r
-            .push(&packet(h), coder.as_ref(), &stats)
-            .unwrap()
-            .is_none());
-    }
-    assert_eq!(stats.snapshot().packets_dropped, 2);
-    // The frame is unharmed: its real second shard completes it at the exact pinned length.
-    let mut fin2 = fin;
-    fin2.shard_index = 1;
-    let got = r
-        .push(&packet(fin2), coder.as_ref(), &stats)
-        .unwrap()
-        .expect("frame must still complete after the rejected sentinels");
-    assert_eq!(got.data.len(), 32);
-    assert!(got.complete);
-}
-
-/// A second "final" header with DIFFERENT totals must be rejected once a streamed frame is
-/// pinned (re-pinning would re-interpret already-landed shards), and the frame must still
-/// complete under the first totals.
-#[test]
-fn streamed_second_final_with_different_totals_is_rejected() {
-    let mut r = Reassembler::new(limits());
-    let coder = coder_for(FecScheme::Gf8);
-    let stats = StatsCounters::default();
-    let sentinel_shard = |shard_index: u16| {
-        let mut h = base_header();
-        h.block_count = 0;
-        h.frame_bytes = 0;
-        h.data_shards = 8;
-        h.recovery_shards = 0;
-        h.block_index = 0;
-        h.shard_index = shard_index;
-        h
-    };
-    let final_shard = |frame_bytes: u32, data_shards: u16, shard_index: u16| {
-        let mut h = base_header();
-        h.block_count = 2;
-        h.frame_bytes = frame_bytes;
-        h.data_shards = data_shards;
-        h.recovery_shards = 0;
-        h.block_index = 1;
-        h.shard_index = shard_index;
-        h
-    };
-    // Sentinel opens block 0, then the real final pins totals: 10 shards = 160 bytes.
-    assert!(r
-        .push(&packet(sentinel_shard(0)), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    assert!(r
-        .push(&packet(final_shard(160, 2, 0)), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    // A second final claiming 144 bytes (K = 1): geometry-valid alone, but it contradicts the
-    // pinned totals → dropped.
-    let before = stats.snapshot().packets_dropped;
-    assert!(r
-        .push(&packet(final_shard(144, 1, 0)), coder.as_ref(), &stats)
-        .unwrap()
-        .is_none());
-    assert_eq!(stats.snapshot().packets_dropped, before + 1);
-    // The frame still completes under the FIRST totals: the rest of block 0 + the final tail.
-    let mut got = None;
-    for s in 1..8u16 {
-        assert!(got.is_none());
-        got = r
-            .push(&packet(sentinel_shard(s)), coder.as_ref(), &stats)
-            .unwrap();
-    }
-    assert!(got.is_none(), "block 1 still owes a shard");
-    let got = r
-        .push(&packet(final_shard(160, 2, 1)), coder.as_ref(), &stats)
-        .unwrap()
-        .expect("frame completes under the first pinned totals");
-    assert_eq!(got.data.len(), 160);
-}

crates/punktfunk-core/src/quic/caps.rs

@@ -32,18 +32,6 @@ pub const VIDEO_CAP_HOST_TIMING: u8 = 0x08;
 /// older client gets a declined (zeroed) [`ProbeResult`] instead of a measurement its single-window
 /// reassembler would silently drop as stale.
 pub const VIDEO_CAP_PROBE_SEQ: u8 = 0x10;
-/// [`Hello::video_caps`] bit: the client's reassembler accepts **streamed access units**
-/// (design/nvenc-subframe-slice-output.md Phase 2): the host may ship an AU's early FEC blocks
-/// before the AU's total size exists — while the tail of the frame is still encoding — so the
-/// AU's last packet leaves the host sooner (latency plan §7 LN1). Non-final blocks ride
-/// SENTINEL headers (`block_count == 0` — a value no legacy sender emits — with
-/// `frame_bytes == 0` and exactly `max_data_per_block` data shards, so the shard-offset
-/// formula needs no total); the FINAL block's headers carry the real
-/// `frame_bytes`/`block_count` (+ `FLAG_EOF`), which retro-validate the whole frame's geometry
-/// — a mismatch drops the frame wholesale. The host streams ONLY to clients advertising this
-/// bit; every other client gets today's whole-AU path (chunks concatenated before sealing), so
-/// the fallback is zero-risk.
-pub const VIDEO_CAP_STREAMED_AU: u8 = 0x20;
 
 /// [`Welcome::host_caps`] bit: the host applies [`InputKind::GamepadState`]
 /// (crate::input::InputKind::GamepadState) snapshot events — full per-pad state with a reorder
@@ -103,13 +91,8 @@ pub fn resolve_codec(client_codecs: u8, host_capable: u8, preferred: u8) -> Opti
         return None;
     }
     // Honor the client's preference when the host can also emit it; else fall back to precedence.
-    // `preferred` is a single-bit field by contract but arrives as a raw wire byte — isolate ONE
-    // bit of the intersection instead of echoing the request, so a non-conformant multi-bit
-    // value can never escape as a codec id (downstream `from_wire` folds unknown values to HEVC,
-    // which may not even be in the shared set).
     if preferred != 0 && shared & preferred != 0 {
-        let want = shared & preferred;
-        return Some(want & want.wrapping_neg());
+        return Some(preferred);
     }
     // Precedence: HEVC > AV1 > H.264.
     [CODEC_HEVC, CODEC_AV1, CODEC_H264]
@@ -188,75 +171,3 @@ impl Default for ColorInfo {
         Self::SDR_BT709
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::config::{CompositorPref, FecConfig, FecScheme, GamepadPref, Mode};
-    use crate::quic::*;
-
-    #[test]
-    fn host_cap_clipboard_bit_is_distinct_and_survives_welcome() {
-        // The new cap packs into the existing trailing host_caps byte with no layout change.
-        assert_ne!(HOST_CAP_CLIPBOARD, HOST_CAP_GAMEPAD_STATE);
-        let mut w = Welcome {
-            abi_version: 1,
-            udp_port: 1,
-            mode: Mode {
-                width: 1920,
-                height: 1080,
-                refresh_hz: 60,
-            },
-            fec: FecConfig {
-                scheme: FecScheme::Gf16,
-                fec_percent: 0,
-                max_data_per_block: 1024,
-            },
-            shard_payload: 1024,
-            encrypt: false,
-            key: [0; 16],
-            salt: [0; 4],
-            frames: 0,
-            compositor: CompositorPref::Auto,
-            gamepad: GamepadPref::Auto,
-            bitrate_kbps: 0,
-            bit_depth: 8,
-            color: ColorInfo::SDR_BT709,
-            chroma_format: CHROMA_IDC_420,
-            audio_channels: 2,
-            codec: CODEC_HEVC,
-            host_caps: HOST_CAP_GAMEPAD_STATE | HOST_CAP_CLIPBOARD,
-        };
-        let got = Welcome::decode(&w.encode()).unwrap();
-        assert_eq!(got.host_caps & HOST_CAP_CLIPBOARD, HOST_CAP_CLIPBOARD);
-        assert_eq!(
-            got.host_caps & HOST_CAP_GAMEPAD_STATE,
-            HOST_CAP_GAMEPAD_STATE
-        );
-        // Clipboard-off host: the bit is clear, gamepad bit still set.
-        w.host_caps = HOST_CAP_GAMEPAD_STATE;
-        assert_eq!(
-            Welcome::decode(&w.encode()).unwrap().host_caps & HOST_CAP_CLIPBOARD,
-            0
-        );
-    }
-
-    #[test]
-    fn resolve_codec_canonicalizes_a_multi_bit_preference() {
-        // A non-conformant peer may stuff its capability MASK into `preferred` — the result
-        // must still be a single bit of the shared set, never the raw multi-bit echo (which
-        // folds to HEVC downstream and can select a codec the client can't decode).
-        assert_eq!(
-            resolve_codec(CODEC_H264, CODEC_H264 | CODEC_AV1, CODEC_H264 | CODEC_AV1),
-            Some(CODEC_H264)
-        );
-        // Several shared preferred bits: still exactly one bit, and one of the preferred ones.
-        let got = resolve_codec(
-            CODEC_H264 | CODEC_HEVC | CODEC_AV1,
-            CODEC_H264 | CODEC_HEVC | CODEC_AV1,
-            CODEC_AV1 | CODEC_HEVC,
-        )
-        .unwrap();
-        assert_eq!(got.count_ones(), 1);
-        assert_ne!(got & (CODEC_AV1 | CODEC_HEVC), 0);
-    }
-}

crates/punktfunk-core/src/quic/clipstream.rs

@@ -115,134 +115,3 @@ pub async fn read_data(recv: &mut quinn::RecvStream, max_bytes: usize) -> std::i
         .await
         .map_err(std::io::Error::other)
 }
-
-// In-process QUIC loopback: the real clipstream fetch transport, both success and cancel.
-#[cfg(test)]
-mod tests {
-    use crate::quic::clipstream;
-    use crate::quic::test_util::connect_pair;
-    use crate::quic::*;
-
-    #[tokio::test]
-    async fn fetch_text_transfers_then_cancel_resets() {
-        let (_server_ep, _client_ep, host_conn, client_conn) = connect_pair().await;
-
-        let payload = b"hello clipboard \xf0\x9f\x93\x8b".to_vec(); // text + a 4-byte emoji
-        let holder_payload = payload.clone();
-
-        // Holder = the host side: accept two fetch streams. Serve the first; cancel the second.
-        let holder = tokio::spawn(async move {
-            // Fetch #1 — serve the payload.
-            let (mut send, mut recv) = host_conn.accept_bi().await.expect("accept fetch #1");
-            let kind = clipstream::read_stream_header(&mut recv)
-                .await
-                .expect("stream header #1");
-            assert_eq!(kind, clipstream::CLIP_STREAM_KIND_FETCH);
-            let req = clipstream::read_fetch(&mut recv)
-                .await
-                .expect("fetch req #1");
-            assert_eq!(req.seq, 1);
-            assert_eq!(req.file_index, CLIP_FILE_INDEX_NONE);
-            assert_eq!(req.mime, "text/plain;charset=utf-8");
-            clipstream::write_fetch_hdr(
-                &mut send,
-                &ClipFetchHdr {
-                    status: CLIP_FETCH_OK,
-                    total_size: holder_payload.len() as u64,
-                },
-            )
-            .await
-            .expect("write hdr #1");
-            clipstream::write_data(&mut send, &holder_payload)
-                .await
-                .expect("write data #1");
-
-            // Fetch #2 — read the request, then cancel mid-transfer with RESET_STREAM.
-            let (mut send2, mut recv2) = host_conn.accept_bi().await.expect("accept fetch #2");
-            clipstream::read_stream_header(&mut recv2)
-                .await
-                .expect("stream header #2");
-            let _ = clipstream::read_fetch(&mut recv2)
-                .await
-                .expect("fetch req #2");
-            send2.reset(clipstream::cancelled_code()).unwrap();
-
-            host_conn // keep alive until the requester side is done
-        });
-
-        // Requester = the client side.
-        // #1: full lazy fetch of the text payload.
-        let req = ClipFetch {
-            seq: 1,
-            file_index: CLIP_FILE_INDEX_NONE,
-            mime: "text/plain;charset=utf-8".into(),
-        };
-        let (_send, mut recv) = clipstream::open_fetch(&client_conn, &req)
-            .await
-            .expect("open fetch #1");
-        let hdr = clipstream::read_fetch_hdr(&mut recv)
-            .await
-            .expect("read hdr #1");
-        assert_eq!(hdr.status, CLIP_FETCH_OK);
-        assert_eq!(hdr.total_size as usize, payload.len());
-        let got = clipstream::read_data(&mut recv, 8 << 20)
-            .await
-            .expect("read data #1");
-        assert_eq!(got, payload);
-
-        // #2: the holder resets the stream — the requester surfaces an error rather than hanging.
-        let req2 = ClipFetch {
-            seq: 2,
-            file_index: CLIP_FILE_INDEX_NONE,
-            mime: "text/plain;charset=utf-8".into(),
-        };
-        let (_send2, mut recv2) = clipstream::open_fetch(&client_conn, &req2)
-            .await
-            .expect("open fetch #2");
-        assert!(
-            clipstream::read_fetch_hdr(&mut recv2).await.is_err(),
-            "a cancelled fetch must surface as an error, not a hang"
-        );
-
-        let _host_conn = holder.await.unwrap();
-    }
-
-    #[tokio::test]
-    async fn read_data_enforces_size_cap() {
-        let (_server_ep, _client_ep, host_conn, client_conn) = connect_pair().await;
-
-        let big = vec![0xABu8; 200_000]; // > the 64 KiB chunk, and > the cap we set below
-        let holder_payload = big.clone();
-        let holder = tokio::spawn(async move {
-            let (mut send, mut recv) = host_conn.accept_bi().await.expect("accept");
-            clipstream::read_stream_header(&mut recv).await.unwrap();
-            let _ = clipstream::read_fetch(&mut recv).await.unwrap();
-            clipstream::write_fetch_hdr(
-                &mut send,
-                &ClipFetchHdr {
-                    status: CLIP_FETCH_OK,
-                    total_size: holder_payload.len() as u64,
-                },
-            )
-            .await
-            .unwrap();
-            let _ = clipstream::write_data(&mut send, &holder_payload).await;
-            host_conn
-        });
-
-        let req = ClipFetch {
-            seq: 1,
-            file_index: CLIP_FILE_INDEX_NONE,
-            mime: "application/octet-stream".into(),
-        };
-        let (_send, mut recv) = clipstream::open_fetch(&client_conn, &req).await.unwrap();
-        assert_eq!(
-            clipstream::read_fetch_hdr(&mut recv).await.unwrap().status,
-            CLIP_FETCH_OK
-        );
-        // Cap below the payload size ⇒ read_data errors instead of buffering unboundedly.
-        assert!(clipstream::read_data(&mut recv, 64 * 1024).await.is_err());
-
-        let _host_conn = holder.await.unwrap();
-    }
-}

crates/punktfunk-core/src/quic/clock.rs

@@ -38,7 +38,7 @@ pub struct ClockSkew {
 /// with, so the offset aligns a client receive instant to the host's capture clock.
 pub async fn clock_sync(
     send: &mut quinn::SendStream,
-    recv: &mut io::MsgReader,
+    recv: &mut quinn::RecvStream,
 ) -> Option<ClockSkew> {
     use std::time::Duration;
     const ROUNDS: usize = 8;
@@ -50,7 +50,7 @@ pub async fn clock_sync(
         if io::write_msg(send, &probe).await.is_err() {
             break;
         }
-        let read = tokio::time::timeout(read_timeout, recv.read_msg()).await;
+        let read = tokio::time::timeout(read_timeout, io::read_msg(recv)).await;
         let echo = match read {
             Ok(Ok(b)) => match ClockEcho::decode(&b) {
                 Ok(e) => e,
@@ -154,115 +154,3 @@ impl Default for ClockResync {
 pub fn accept_resync(batch_rtt_ns: u64, connect_rtt_ns: u64) -> bool {
     batch_rtt_ns <= (connect_rtt_ns + connect_rtt_ns / 2).max(2_000_000)
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::quic::*;
-
-    #[test]
-    fn clock_offset_picks_min_rtt_and_recovers_offset() {
-        // Host clock is +1_000_000 ns ahead of the client. Construct samples where a symmetric
-        // round-trip recovers exactly that offset, and a noisy (asymmetric, high-RTT) sample is
-        // present but must be ignored by the min-RTT selection.
-        const OFF: i64 = 1_000_000;
-        // Clean sample: client t1=0, one-way=200µs each way → t2 = t1 + 200_000 + OFF (host clock),
-        // t3 = t2 + 50_000 (host processing), t4 = t3 - OFF + 200_000 (back in client clock).
-        let t1 = 0u64;
-        let t2 = (t1 as i64 + 200_000 + OFF) as u64;
-        let t3 = t2 + 50_000;
-        let t4 = (t3 as i64 - OFF + 200_000) as u64;
-        // Noisy sample: same offset but a fat, asymmetric RTT (slow return path) — higher RTT.
-        let n1 = 1_000_000u64;
-        let n2 = (n1 as i64 + 200_000 + OFF) as u64;
-        let n3 = n2 + 50_000;
-        let n4 = (n3 as i64 - OFF + 5_000_000) as u64; // 5 ms return → big RTT
-        let (offset, rtt) =
-            clock_offset_ns(&[(n1, n2, n3, n4), (t1, t2, t3, t4)]).expect("non-empty");
-        // The min-RTT sample recovers the offset exactly; its RTT is 2x200us, and the noisy
-        // (asymmetric, 5 ms return) sample is ignored by the min-RTT selection.
-        assert_eq!(offset, OFF);
-        assert_eq!(rtt, 400_000);
-        assert!(clock_offset_ns(&[]).is_none());
-    }
-
-    /// The mid-stream re-sync state machine: 8 rounds collected via matched echoes, stale
-    /// echoes ignored, a restarted batch abandons the old one, and the batch result is the
-    /// min-RTT estimate — the exact behavior the connect-time `clock_sync` loop has.
-    #[test]
-    fn clock_resync_collects_rounds_and_ignores_stale_echoes() {
-        // Host clock +1 ms ahead; symmetric 100 µs one-way paths except one congested round.
-        const OFF: i64 = 1_000_000;
-        let echo_for = |t1: u64, one_way: u64| ClockEcho {
-            t1_ns: t1,
-            t2_ns: (t1 as i64 + one_way as i64 + OFF) as u64,
-            t3_ns: (t1 as i64 + one_way as i64 + OFF) as u64 + 10_000,
-        };
-        let t4_for = |e: &ClockEcho, one_way: u64| (e.t3_ns as i64 - OFF + one_way as i64) as u64;
-
-        let mut rs = ClockResync::new();
-        // An unsolicited echo before any batch is ignored.
-        assert_eq!(
-            rs.on_echo(&echo_for(42, 100_000), 500_000),
-            ResyncStep::Idle
-        );
-
-        let mut probe = rs.begin(1_000_000);
-        // A stale echo (wrong t1: the abandoned pre-begin probe) is ignored mid-batch.
-        assert_eq!(
-            rs.on_echo(&echo_for(42, 100_000), 500_000),
-            ResyncStep::Idle
-        );
-        for round in 0..ClockResync::ROUNDS {
-            // Round 3 is congested (5 ms one-way) — it must lose the min-RTT selection.
-            let one_way = if round == 3 { 5_000_000 } else { 100_000 };
-            let echo = echo_for(probe.t1_ns, one_way);
-            let t4 = t4_for(&echo, one_way);
-            match rs.on_echo(&echo, t4) {
-                ResyncStep::Probe(p) => {
-                    assert!(round < ClockResync::ROUNDS - 1, "batch overran its rounds");
-                    probe = p;
-                }
-                ResyncStep::Done { offset_ns, rtt_ns } => {
-                    assert_eq!(round, ClockResync::ROUNDS - 1, "batch ended early");
-                    assert_eq!(offset_ns, OFF, "min-RTT round recovers the offset exactly");
-                    assert_eq!(rtt_ns, 200_000); // 2×100 µs; host processing (t3−t2) excluded
-                }
-                ResyncStep::Idle => panic!("matched echo must advance the batch"),
-            }
-        }
-        // The batch is done: even a matching-t1 replay no longer advances anything.
-        assert_eq!(
-            rs.on_echo(&echo_for(probe.t1_ns, 100_000), probe.t1_ns + 300_000),
-            ResyncStep::Idle
-        );
-
-        // begin() mid-batch abandons the in-flight batch: its echo is stale afterwards.
-        let old = rs.begin(2_000_000);
-        let fresh = rs.begin(3_000_000);
-        assert_eq!(
-            rs.on_echo(&echo_for(old.t1_ns, 100_000), 2_300_000),
-            ResyncStep::Idle
-        );
-        assert!(matches!(
-            rs.on_echo(&echo_for(fresh.t1_ns, 100_000), 3_300_000),
-            ResyncStep::Probe(_)
-        ));
-    }
-
-    /// The acceptance guard: a batch measured through a congested window (fat RTT) must not
-    /// replace the offset — its queueing delay biases the estimate exactly when frames
-    /// already read late. Floor of 2 ms so a near-zero connect RTT (same-host/LAN) doesn't
-    /// reject every later batch over normal jitter.
-    #[test]
-    fn clock_resync_acceptance_guard() {
-        // Generous connect RTT (10 ms): accept up to 1.5×.
-        assert!(accept_resync(14_000_000, 10_000_000));
-        assert!(!accept_resync(16_000_000, 10_000_000));
-        // Tiny connect RTT (200 µs, wired LAN): the 2 ms floor governs.
-        assert!(accept_resync(1_900_000, 200_000));
-        assert!(!accept_resync(2_100_000, 200_000));
-        // Boundary: exactly at the bound is accepted.
-        assert!(accept_resync(2_000_000, 0));
-        assert!(accept_resync(15_000_000, 10_000_000));
-    }
-}

crates/punktfunk-core/src/quic/control.rs

@@ -782,369 +782,3 @@ impl ClipFetchHdr {
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::config::Mode;
-    use crate::quic::*;
-
-    #[test]
-    fn reconfigure_roundtrip() {
-        let rq = Reconfigure {
-            mode: Mode {
-                width: 1920,
-                height: 1080,
-                refresh_hz: 144,
-            },
-        };
-        assert_eq!(Reconfigure::decode(&rq.encode()).unwrap(), rq);
-        for accepted in [true, false] {
-            let rs = Reconfigured {
-                accepted,
-                mode: rq.mode,
-            };
-            assert_eq!(Reconfigured::decode(&rs.encode()).unwrap(), rs);
-        }
-        // The type byte separates the post-handshake messages from each other.
-        assert!(Reconfigure::decode(
-            &Reconfigured {
-                accepted: true,
-                mode: rq.mode
-            }
-            .encode()
-        )
-        .is_err());
-    }
-
-    #[test]
-    fn request_keyframe_roundtrip() {
-        let bytes = RequestKeyframe.encode();
-        assert!(RequestKeyframe::decode(&bytes).is_ok());
-        // Distinct from the other control messages — its type byte must not collide.
-        let mode = Mode {
-            width: 1280,
-            height: 720,
-            refresh_hz: 60,
-        };
-        assert!(RequestKeyframe::decode(&Reconfigure { mode }.encode()).is_err());
-        assert!(Reconfigure::decode(&bytes).is_err());
-        // Length is exact (no trailing bytes accepted).
-        assert!(RequestKeyframe::decode(&[bytes.as_slice(), &[0]].concat()).is_err());
-    }
-
-    #[test]
-    fn rfi_request_roundtrip() {
-        for (first_frame, last_frame) in [(0u32, 0u32), (40, 47), (5, 5), (1_000_000, u32::MAX)] {
-            let r = RfiRequest {
-                first_frame,
-                last_frame,
-            };
-            assert_eq!(RfiRequest::decode(&r.encode()).unwrap(), r);
-        }
-        // Disjoint from the bare keyframe request (its loss-unaware sibling) and others: type byte + length.
-        assert!(RfiRequest::decode(&RequestKeyframe.encode()).is_err());
-        assert!(RequestKeyframe::decode(
-            &RfiRequest {
-                first_frame: 1,
-                last_frame: 2
-            }
-            .encode()
-        )
-        .is_err());
-        // Exact length — no trailing bytes.
-        let bytes = RfiRequest {
-            first_frame: 3,
-            last_frame: 9,
-        }
-        .encode();
-        assert!(RfiRequest::decode(&[bytes.as_slice(), &[0]].concat()).is_err());
-        assert!(RfiRequest::decode(&bytes[..bytes.len() - 1]).is_err());
-    }
-
-    #[test]
-    fn loss_report_roundtrip() {
-        for loss_ppm in [0u32, 1, 12_345, 50_000, 1_000_000] {
-            let r = LossReport { loss_ppm };
-            assert_eq!(LossReport::decode(&r.encode()).unwrap(), r);
-        }
-        // Disjoint from the other control messages (type byte + length).
-        assert!(LossReport::decode(&RequestKeyframe.encode()).is_err());
-        assert!(RequestKeyframe::decode(&LossReport { loss_ppm: 0 }.encode()).is_err());
-        assert!(LossReport::decode(
-            &[LossReport { loss_ppm: 0 }.encode().as_slice(), &[0]].concat()
-        )
-        .is_err());
-    }
-
-    #[test]
-    fn window_loss_ppm_estimates_and_caps() {
-        // No traffic → 0. A clean window (nothing recovered) → 0.
-        assert_eq!(window_loss_ppm(0, 0, 0, 0), 0);
-        assert_eq!(window_loss_ppm(0, 0, 1000, 0), 0);
-        // 50 recovered of 1000 total (950 received + 50 recovered) = 5%.
-        assert_eq!(window_loss_ppm(50, 0, 950, 0), 50_000);
-        // An unrecoverable frame adds the +5% bump (push FEC past the current cap).
-        assert_eq!(window_loss_ppm(50, 0, 950, 1), 100_000);
-        // A total-loss window with a drop but nothing received still reports the bump, capped at 1e6.
-        assert_eq!(window_loss_ppm(0, 0, 0, 3), 50_000);
-        assert!(window_loss_ppm(u64::MAX, 0, 1, 9) <= 1_000_000);
-        // Reordering: shards "recovered" early that then arrived are late, not lost — netted out, so
-        // a pure-reorder window reads 0. Partially late nets to the true loss (20 of 1000 = 2%).
-        assert_eq!(window_loss_ppm(50, 50, 1000, 0), 0);
-        assert_eq!(window_loss_ppm(50, 30, 980, 0), 20_000);
-        // `late` can outrun `recovered` across a window boundary (reorder straddling the report
-        // tick) or via a rare wire duplicate — saturate at a clean window, never underflow.
-        assert_eq!(window_loss_ppm(10, 25, 1000, 0), 0);
-    }
-
-    #[test]
-    fn bitrate_messages_roundtrip() {
-        let req = SetBitrate {
-            bitrate_kbps: 14_000,
-        };
-        assert_eq!(SetBitrate::decode(&req.encode()).unwrap(), req);
-        let ack = BitrateChanged {
-            bitrate_kbps: 14_000,
-        };
-        assert_eq!(BitrateChanged::decode(&ack.encode()).unwrap(), ack);
-        // Same payload shape as LossReport — the type byte alone must keep them disjoint.
-        assert!(LossReport::decode(&req.encode()).is_err());
-        assert!(SetBitrate::decode(&ack.encode()).is_err());
-        assert!(BitrateChanged::decode(&req.encode()).is_err());
-        assert!(SetBitrate::decode(&LossReport { loss_ppm: 7 }.encode()).is_err());
-    }
-
-    #[test]
-    fn probe_messages_roundtrip() {
-        let req = ProbeRequest {
-            target_kbps: 250_000,
-            duration_ms: 2000,
-        };
-        assert_eq!(ProbeRequest::decode(&req.encode()).unwrap(), req);
-        let res = ProbeResult {
-            bytes_sent: 62_500_000,
-            packets_sent: 480,
-            duration_ms: 2003,
-            wire_packets_sent: 41_000,
-            send_dropped: 1_200,
-        };
-        assert_eq!(ProbeResult::decode(&res.encode()).unwrap(), res);
-        assert_eq!(res.encode().len(), 29);
-        // A pre-wire-stats host's 21-byte ProbeResult still decodes, with the new fields zeroed.
-        let legacy = {
-            let full = res.encode();
-            full[..21].to_vec()
-        };
-        let decoded = ProbeResult::decode(&legacy).unwrap();
-        assert_eq!(decoded.wire_packets_sent, 0);
-        assert_eq!(decoded.send_dropped, 0);
-        assert_eq!(decoded.bytes_sent, res.bytes_sent);
-        // Type bytes keep the control messages disjoint from each other.
-        assert!(ProbeRequest::decode(&res.encode()).is_err());
-        assert!(Reconfigure::decode(&req.encode()).is_err());
-        assert!(ProbeResult::decode(&req.encode()).is_err());
-    }
-
-    #[test]
-    fn clock_messages_roundtrip() {
-        let probe = ClockProbe {
-            t1_ns: 1_700_000_000_123,
-        };
-        assert_eq!(ClockProbe::decode(&probe.encode()).unwrap(), probe);
-        let echo = ClockEcho {
-            t1_ns: 1_700_000_000_123,
-            t2_ns: 1_700_000_050_456,
-            t3_ns: 1_700_000_050_789,
-        };
-        assert_eq!(ClockEcho::decode(&echo.encode()).unwrap(), echo);
-        // Disjoint from the other control messages (distinct type bytes).
-        assert!(ClockProbe::decode(&echo.encode()).is_err());
-        assert!(ProbeRequest::decode(&probe.encode()).is_err());
-        assert!(ClockEcho::decode(&probe.encode()).is_err());
-    }
-
-    // ---- Shared clipboard control + fetch-stream message codecs (0x40-0x44) -----------------------
-
-    #[test]
-    fn clip_control_roundtrip() {
-        for (enabled, flags) in [
-            (true, 0u8),
-            (false, 0),
-            (true, CLIP_FLAG_FILES),
-            (false, 0xFF),
-        ] {
-            let m = ClipControl { enabled, flags };
-            assert_eq!(ClipControl::decode(&m.encode()).unwrap(), m);
-        }
-        // Disjoint from its host→client sibling (type byte + length) and exact length.
-        assert!(ClipControl::decode(
-            &ClipState {
-                enabled: true,
-                policy: 0,
-                reason: 0
-            }
-            .encode()
-        )
-        .is_err());
-        let bytes = ClipControl {
-            enabled: true,
-            flags: 0,
-        }
-        .encode();
-        assert!(ClipControl::decode(&[bytes.as_slice(), &[0]].concat()).is_err());
-        assert!(ClipControl::decode(&bytes[..bytes.len() - 1]).is_err());
-    }
-
-    #[test]
-    fn clip_state_roundtrip() {
-        let cases = [
-            ClipState {
-                enabled: true,
-                policy: CLIP_POLICY_TEXT | CLIP_POLICY_FILES,
-                reason: CLIP_REASON_OK,
-            },
-            ClipState {
-                enabled: false,
-                policy: 0,
-                reason: CLIP_REASON_BACKEND_UNAVAILABLE,
-            },
-            ClipState {
-                enabled: true,
-                policy: CLIP_POLICY_TEXT,
-                reason: CLIP_REASON_NO_FILES,
-            },
-        ];
-        for m in cases {
-            assert_eq!(ClipState::decode(&m.encode()).unwrap(), m);
-        }
-        // A ClipControl must not decode as a ClipState (type byte).
-        assert!(ClipState::decode(
-            &ClipControl {
-                enabled: true,
-                flags: 0
-            }
-            .encode()
-        )
-        .is_err());
-        let bytes = cases[0].encode();
-        assert!(ClipState::decode(&bytes[..bytes.len() - 1]).is_err());
-    }
-
-    #[test]
-    fn clip_offer_roundtrip() {
-        // Empty offer, one kind, and a full multi-format offer (text/rich/image/files).
-        let cases = [
-            ClipOffer {
-                seq: 0,
-                kinds: vec![],
-            },
-            ClipOffer {
-                seq: 1,
-                kinds: vec![ClipKind {
-                    mime: "text/plain;charset=utf-8".into(),
-                    size_hint: 12,
-                }],
-            },
-            ClipOffer {
-                seq: u32::MAX,
-                kinds: vec![
-                    ClipKind {
-                        mime: "text/plain;charset=utf-8".into(),
-                        size_hint: 0,
-                    },
-                    ClipKind {
-                        mime: "text/html".into(),
-                        size_hint: 4096,
-                    },
-                    ClipKind {
-                        mime: "image/png".into(),
-                        size_hint: 1 << 30,
-                    },
-                    ClipKind {
-                        mime: "application/x-punktfunk-files".into(),
-                        size_hint: 5_000_000_000,
-                    },
-                ],
-            },
-        ];
-        for m in &cases {
-            assert_eq!(&ClipOffer::decode(&m.encode()).unwrap(), m);
-        }
-        // Trailing bytes are rejected (get_clip_kind consumes exactly to the end).
-        let mut padded = cases[1].encode();
-        padded.push(0);
-        assert!(ClipOffer::decode(&padded).is_err());
-        // A count byte over the cap is rejected before allocating.
-        let mut over = cases[0].encode();
-        over[9] = (CLIP_MAX_KINDS + 1) as u8;
-        assert!(ClipOffer::decode(&over).is_err());
-        // Disjoint from a same-family control message.
-        assert!(ClipOffer::decode(
-            &ClipControl {
-                enabled: true,
-                flags: 0
-            }
-            .encode()
-        )
-        .is_err());
-    }
-
-    #[test]
-    fn clip_fetch_roundtrip() {
-        let cases = [
-            ClipFetch {
-                seq: 1,
-                file_index: CLIP_FILE_INDEX_NONE,
-                mime: "text/plain;charset=utf-8".into(),
-            },
-            ClipFetch {
-                seq: 7,
-                file_index: 0,
-                mime: "application/x-punktfunk-files".into(),
-            },
-            ClipFetch {
-                seq: u32::MAX,
-                file_index: 41,
-                mime: String::new(),
-            },
-        ];
-        for m in &cases {
-            assert_eq!(&ClipFetch::decode(&m.encode()).unwrap(), m);
-        }
-        // Trailing + truncation both rejected (exact-length mime check).
-        let bytes = cases[0].encode();
-        assert!(ClipFetch::decode(&[bytes.as_slice(), &[0]].concat()).is_err());
-        assert!(ClipFetch::decode(&bytes[..bytes.len() - 1]).is_err());
-        // A fetch-stream message must not decode as a control-stream offer, and vice-versa.
-        assert!(ClipOffer::decode(&cases[0].encode()).is_err());
-        assert!(ClipFetch::decode(
-            &ClipOffer {
-                seq: 1,
-                kinds: vec![]
-            }
-            .encode()
-        )
-        .is_err());
-    }
-
-    #[test]
-    fn clip_fetch_hdr_roundtrip() {
-        for (status, total_size) in [
-            (CLIP_FETCH_OK, 15u64),
-            (CLIP_FETCH_STALE, 0),
-            (CLIP_FETCH_UNAVAILABLE, 0),
-            (CLIP_FETCH_DENIED, 0),
-            (CLIP_FETCH_OK, u64::MAX),
-        ] {
-            let m = ClipFetchHdr { status, total_size };
-            assert_eq!(ClipFetchHdr::decode(&m.encode()).unwrap(), m);
-        }
-        let bytes = ClipFetchHdr {
-            status: CLIP_FETCH_OK,
-            total_size: 1,
-        }
-        .encode();
-        assert!(ClipFetchHdr::decode(&[bytes.as_slice(), &[0]].concat()).is_err());
-        assert!(ClipFetchHdr::decode(&bytes[..bytes.len() - 1]).is_err());
-    }
-}

crates/punktfunk-core/src/quic/datagram.rs

@@ -605,321 +605,3 @@ pub fn decode_host_timing_datagram(b: &[u8]) -> Option<HostTiming> {
         stages,
     })
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::quic::*;
-
-    #[test]
-    fn hdr_meta_datagram_roundtrip_and_truncation() {
-        let m = HdrMeta {
-            // BT.2020 display primaries in 1/50000 units (the DXGI/ST.2086 reference values).
-            display_primaries: [[8500, 39850], [6550, 2300], [35400, 14600]],
-            white_point: [15635, 16450],                 // D65
-            max_display_mastering_luminance: 10_000_000, // 1000 nits in 0.0001 cd/m²
-            min_display_mastering_luminance: 1,          // 0.0001 nits
-            max_cll: 1000,
-            max_fall: 400,
-        };
-        let d = encode_hdr_meta_datagram(&m);
-        assert_eq!(d[0], HDR_META_MAGIC);
-        assert_eq!(decode_hdr_meta_datagram(&d), Some(m));
-        // Truncated buffers and a wrong tag are rejected (never partially read).
-        for n in 0..d.len() {
-            assert_eq!(decode_hdr_meta_datagram(&d[..n]), None);
-        }
-        let mut bad = d.clone();
-        bad[0] = HIDOUT_MAGIC;
-        assert_eq!(decode_hdr_meta_datagram(&bad), None);
-    }
-
-    #[test]
-    fn host_timing_datagram_roundtrip_and_truncation() {
-        let t = HostTiming {
-            pts_ns: 1_751_500_000_123_456_789, // a realistic 2026 CLOCK_REALTIME capture stamp
-            host_us: 4_321,
-            stages: None,
-        };
-        let d = encode_host_timing_datagram(&t);
-        assert_eq!(d[0], HOST_TIMING_MAGIC);
-        assert_eq!(d.len(), 13);
-        assert_eq!(decode_host_timing_datagram(&d), Some(t));
-        // Truncated buffers and a wrong tag are rejected (never partially read).
-        for n in 0..d.len() {
-            assert_eq!(decode_host_timing_datagram(&d[..n]), None);
-        }
-        let mut bad = d.clone();
-        bad[0] = HDR_META_MAGIC;
-        assert_eq!(decode_host_timing_datagram(&bad), None);
-
-        // Extended form (T0.1): the stage tail roundtrips; a truncated tail (an old host's 13-byte
-        // datagram, or anything short of the full 25) degrades to `stages: None`, never a partial
-        // read; the prefix fields stay identical in both forms (the append-extensibility contract).
-        let ts = HostTiming {
-            stages: Some(HostStages {
-                queue_us: 900,
-                encode_us: 3_100,
-                pace_us: 2_500,
-            }),
-            ..t
-        };
-        let ds = encode_host_timing_datagram(&ts);
-        assert_eq!(ds.len(), 25);
-        assert_eq!(
-            &ds[..13],
-            &d[..13],
-            "prefix is byte-identical to the legacy form"
-        );
-        assert_eq!(decode_host_timing_datagram(&ds), Some(ts));
-        for n in 13..ds.len() {
-            assert_eq!(
-                decode_host_timing_datagram(&ds[..n]),
-                Some(t),
-                "partial stage tail ({n} B) must degrade to the legacy decode"
-            );
-        }
-    }
-
-    #[test]
-    fn audio_datagram_roundtrip() {
-        let opus = [0x42u8; 97];
-        let d = encode_audio_datagram(7, 1_000_000_123, &opus);
-        assert_eq!(d[0], AUDIO_MAGIC);
-        let (seq, pts, payload) = decode_audio_datagram(&d).unwrap();
-        assert_eq!((seq, pts), (7, 1_000_000_123));
-        assert_eq!(payload, opus);
-        assert!(decode_audio_datagram(&d[..12]).is_none()); // truncated header
-        assert!(decode_audio_datagram(&[0u8; 13]).is_none()); // bad magic
-
-        // Empty payload is legal (DTX) — header-only datagram.
-        let header_only = encode_audio_datagram(0, 0, &[]);
-        let (_, _, empty) = decode_audio_datagram(&header_only).unwrap();
-        assert!(empty.is_empty());
-    }
-
-    #[test]
-    fn rumble_datagram_roundtrip() {
-        let d = encode_rumble_datagram(1, 0x1234, 0xFFFF);
-        assert_eq!(d[0], RUMBLE_MAGIC);
-        assert_eq!(decode_rumble_datagram(&d), Some((1, 0x1234, 0xFFFF)));
-        assert!(decode_rumble_datagram(&d[..6]).is_none());
-    }
-
-    #[test]
-    fn rumble_envelope_roundtrip_and_legacy_tolerance() {
-        // v2 envelope round-trips seq + ttl.
-        let d = encode_rumble_datagram_v2(2, 0x4000, 0x8000, 7, 400);
-        assert_eq!(d[0], RUMBLE_MAGIC);
-        assert_eq!(d.len(), RUMBLE_V2_LEN);
-        assert_eq!(
-            decode_rumble_envelope(&d),
-            Some(RumbleUpdate {
-                pad: 2,
-                low: 0x4000,
-                high: 0x8000,
-                envelope: Some(RumbleEnvelope {
-                    seq: 7,
-                    ttl_ms: 400
-                }),
-            })
-        );
-        // The legacy level decoder reads a v2 datagram as a plain level — the tail is ignored, so an
-        // old client running against a new host still renders the right amplitudes.
-        assert_eq!(decode_rumble_datagram(&d), Some((2, 0x4000, 0x8000)));
-
-        // A legacy 7-byte datagram (old host) decodes as a level with no envelope — a new client then
-        // applies its own staleness policy.
-        let v1 = encode_rumble_datagram(3, 0x1111, 0x2222);
-        assert_eq!(
-            decode_rumble_envelope(&v1),
-            Some(RumbleUpdate {
-                pad: 3,
-                low: 0x1111,
-                high: 0x2222,
-                envelope: None,
-            })
-        );
-
-        // A torn/short tail (8 or 9 bytes) is not a valid envelope — degrade to a level, never panic
-        // or drop. (The host never emits these; a truncating middlebox might.)
-        assert_eq!(
-            decode_rumble_envelope(&d[..8]).map(|u| u.envelope),
-            Some(None)
-        );
-        assert_eq!(
-            decode_rumble_envelope(&d[..9]).map(|u| u.envelope),
-            Some(None)
-        );
-
-        // Bad tag / too short → None on both decoders.
-        assert!(decode_rumble_envelope(&d[..6]).is_none());
-        let mut wrong_tag = d;
-        wrong_tag[0] = AUDIO_MAGIC;
-        assert!(decode_rumble_envelope(&wrong_tag).is_none());
-    }
-
-    #[test]
-    fn rumble_envelope_seq_gate_drops_reordered_stale_start() {
-        use crate::input::GamepadSnapshot;
-        // The client-side reorder gate (reused verbatim from gamepad snapshots): a stale start
-        // arriving after a stop must not re-light the motors.
-        let stop = decode_rumble_envelope(&encode_rumble_datagram_v2(0, 0, 0, 10, 0)).unwrap();
-        let stale_start =
-            decode_rumble_envelope(&encode_rumble_datagram_v2(0, 0x8000, 0x8000, 9, 400)).unwrap();
-        let stop_seq = stop.envelope.unwrap().seq;
-        let stale_seq = stale_start.envelope.unwrap().seq;
-        // Nothing applied yet → the first update always passes.
-        assert!(GamepadSnapshot::seq_newer(stop_seq, None));
-        // The reordered older start does NOT supersede the stop.
-        assert!(!GamepadSnapshot::seq_newer(stale_seq, Some(stop_seq)));
-        // A genuine later renewal does.
-        assert!(GamepadSnapshot::seq_newer(11, Some(stop_seq)));
-        // Wraps: seq 1 supersedes 254.
-        assert!(GamepadSnapshot::seq_newer(1, Some(254)));
-    }
-
-    #[test]
-    fn mic_datagram_roundtrip_and_disjoint_from_audio() {
-        let opus = [0x5Au8; 80];
-        let d = encode_mic_datagram(42, 9_999, &opus);
-        assert_eq!(d[0], MIC_MAGIC);
-        let (seq, pts, payload) = decode_mic_datagram(&d).unwrap();
-        assert_eq!((seq, pts), (42, 9_999));
-        assert_eq!(payload, opus);
-        assert!(decode_mic_datagram(&d[..12]).is_none()); // truncated
-                                                          // Tag separation: a mic datagram is not an audio datagram and vice-versa.
-        assert!(decode_audio_datagram(&d).is_none());
-        assert!(decode_mic_datagram(&encode_audio_datagram(1, 2, &opus)).is_none());
-        // Empty payload (DTX) is legal.
-        assert!(decode_mic_datagram(&encode_mic_datagram(0, 0, &[]))
-            .unwrap()
-            .2
-            .is_empty());
-    }
-
-    #[test]
-    fn rich_input_roundtrip() {
-        for ev in [
-            RichInput::Touchpad {
-                pad: 1,
-                finger: 0,
-                active: true,
-                x: 40000,
-                y: 12345,
-            },
-            RichInput::Motion {
-                pad: 0,
-                gyro: [-100, 200, -300],
-                accel: [16384, -8192, 1],
-            },
-            RichInput::TouchpadEx {
-                pad: 2,
-                surface: 1,
-                finger: 1,
-                touch: true,
-                click: false,
-                x: -12345,
-                y: 30000,
-                pressure: 4000,
-            },
-        ] {
-            let d = ev.encode();
-            assert_eq!(d[0], RICH_INPUT_MAGIC);
-            assert_eq!(RichInput::decode(&d), Some(ev));
-        }
-        // A raw Triton state report rides the plane verbatim (as-is SC2 passthrough).
-        let mut data = [0u8; HID_REPORT_MAX];
-        data[0] = 0x42; // ID_TRITON_CONTROLLER_STATE
-        for (i, b) in data.iter_mut().enumerate().take(46).skip(1) {
-            *b = i as u8;
-        }
-        let raw = RichInput::HidReport {
-            pad: 3,
-            len: 46,
-            data,
-        };
-        let d = raw.encode();
-        assert_eq!(d.len(), 4 + 46); // tag + kind + pad + len + body — no fixed-array padding
-        assert_eq!(RichInput::decode(&d), Some(raw));
-        // A torn HidReport truncates to what arrived rather than over-reading (len clamps).
-        assert_eq!(
-            RichInput::decode(&d[..20]),
-            Some(RichInput::HidReport {
-                pad: 3,
-                len: 16,
-                data: {
-                    let mut t = [0u8; HID_REPORT_MAX];
-                    t[..16].copy_from_slice(&data[..16]);
-                    t
-                },
-            })
-        );
-        // Disjoint from the fixed input datagram (0xC8); unknown kind + truncation → None.
-        assert!(RichInput::decode(&[crate::input::INPUT_MAGIC; 18]).is_none());
-        assert!(RichInput::decode(&[RICH_INPUT_MAGIC, 0x7F]).is_none()); // unknown kind
-        assert!(RichInput::decode(&[RICH_INPUT_MAGIC, RICH_TOUCHPAD, 0]).is_none()); // short
-        assert!(RichInput::decode(&[RICH_INPUT_MAGIC, RICH_TOUCHPAD_EX, 0, 0, 0, 0]).is_none());
-        // short
-    }
-
-    #[test]
-    fn hid_output_roundtrip() {
-        let cases = [
-            HidOutput::Led {
-                pad: 2,
-                r: 0xAA,
-                g: 0xBB,
-                b: 0xCC,
-            },
-            HidOutput::PlayerLeds {
-                pad: 0,
-                bits: 0b10101,
-            },
-            HidOutput::Trigger {
-                pad: 1,
-                which: 1,
-                effect: vec![0x26, 0x90, 0xA0, 0xFF, 0x00, 0x00],
-            },
-            HidOutput::TrackpadHaptic {
-                pad: 0,
-                side: 1,
-                amplitude: 0x1234,
-                period: 0x5678,
-                count: 9,
-            },
-            // A raw Triton rumble output report (as-is SC2 passthrough, host→client).
-            HidOutput::HidRaw {
-                pad: 1,
-                kind: HID_RAW_OUTPUT,
-                data: vec![0x80, 0, 0, 0, 0x34, 0x12, 0, 0x78, 0x56, 0],
-            },
-            // A raw 64-byte feature report (lizard-off / IMU-enable settings write).
-            HidOutput::HidRaw {
-                pad: 0,
-                kind: HID_RAW_FEATURE,
-                data: {
-                    let mut f = vec![0u8; HID_REPORT_MAX];
-                    f[0] = 1; // Triton feature reports ride report id 1
-                    f[1] = 0x87; // ID_SET_SETTINGS_VALUES
-                    f
-                },
-            },
-        ];
-        for ev in &cases {
-            let d = ev.encode();
-            assert_eq!(d[0], HIDOUT_MAGIC);
-            assert_eq!(HidOutput::decode(&d).as_ref(), Some(ev));
-        }
-        assert!(HidOutput::decode(&[HIDOUT_MAGIC, 0x7F]).is_none()); // unknown kind
-                                                                     // A rich-input datagram is not a HID-output datagram.
-        assert!(HidOutput::decode(
-            &RichInput::Motion {
-                pad: 0,
-                gyro: [0; 3],
-                accel: [0; 3]
-            }
-            .encode()
-        )
-        .is_none());
-    }
-}

crates/punktfunk-core/src/quic/endpoint.rs

@@ -26,12 +26,10 @@ fn stream_transport() -> Arc<quinn::TransportConfig> {
 /// path is PINGed at least twice per window and a single lost PING (wifi roam / brief blip) won't
 /// false-close. `idle` is clamped to a ≥1s floor so a misconfigured tiny value can't tear live
 /// sessions down. Active sessions are unaffected either way: video keeps the connection live and
-/// the keep-alive holds it open through quiet control periods. Clamped to a 1 s..1 h window:
-/// the ceiling keeps an absurd operator-supplied value inside QUIC's VarInt millisecond range,
-/// so the conversion below genuinely cannot fail (it used to panic host startup instead).
+/// the keep-alive holds it open through quiet control periods.
 fn stream_transport_idle(idle: std::time::Duration) -> Arc<quinn::TransportConfig> {
     use std::time::Duration;
-    let idle = idle.clamp(Duration::from_secs(1), Duration::from_secs(3600));
+    let idle = idle.max(Duration::from_secs(1));
     let keep_alive = (idle / 2).min(Duration::from_secs(4));
     let mut t = quinn::TransportConfig::default();
     t.max_idle_timeout(Some(
@@ -295,25 +293,3 @@ impl rustls::server::danger::ClientCertVerifier for AcceptAnyClientCert {
             .supported_schemes()
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::quic::endpoint;
-
-    #[test]
-    fn fingerprint_is_sha256_of_der() {
-        // Stable across calls, distinct for distinct certs.
-        let a = endpoint::cert_fingerprint(b"cert-a");
-        assert_eq!(a, endpoint::cert_fingerprint(b"cert-a"));
-        assert_ne!(a, endpoint::cert_fingerprint(b"cert-b"));
-    }
-
-    #[test]
-    fn absurd_idle_timeout_is_clamped_not_a_panic() {
-        // The conversion to quinn's IdleTimeout fails past the QUIC VarInt millisecond
-        // ceiling — an operator-supplied huge PUNKTFUNK_IDLE_TIMEOUT_MS used to panic host
-        // startup through the `expect`. Both extremes must construct.
-        let _ = super::stream_transport_idle(std::time::Duration::MAX);
-        let _ = super::stream_transport_idle(std::time::Duration::ZERO);
-    }
-}

crates/punktfunk-core/src/quic/handshake.rs

@@ -182,9 +182,8 @@ pub struct Start {
 }
 
 /// Truncate `s` to at most `max` bytes on a UTF-8 char boundary (so a multi-byte char straddling
-/// the cap is dropped whole, never split). Shared by Hello's length-prefixed name/launch fields
-/// and [`PairRequest`](super::PairRequest)'s copy of the same name cap.
-pub(super) fn truncate_to(s: &str, max: usize) -> &str {
+/// the cap is dropped whole, never split). Shared by Hello's length-prefixed name/launch fields.
+fn truncate_to(s: &str, max: usize) -> &str {
     if s.len() <= max {
         return s;
     }
@@ -496,601 +495,3 @@ impl Start {
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::config::{CompositorPref, FecConfig, FecScheme, GamepadPref, Mode, Role};
-    use crate::quic::*;
-
-    #[test]
-    fn welcome_roundtrip() {
-        let w = Welcome {
-            abi_version: 1,
-            udp_port: 9999,
-            mode: Mode {
-                width: 2560,
-                height: 1440,
-                refresh_hz: 240,
-            },
-            fec: FecConfig {
-                scheme: FecScheme::Gf16,
-                fec_percent: 20,
-                max_data_per_block: 4096,
-            },
-            shard_payload: 1200,
-            encrypt: true,
-            key: [7u8; 16],
-            salt: [1, 2, 3, 4],
-            frames: 600,
-            compositor: CompositorPref::Gamescope,
-            gamepad: GamepadPref::DualSense,
-            bitrate_kbps: 50_000,
-            bit_depth: 10,
-            color: ColorInfo::HDR10_BT2020_PQ,
-            chroma_format: CHROMA_IDC_444,
-            audio_channels: 2,
-            codec: CODEC_H264, // exercise a non-default codec through the roundtrip
-            host_caps: HOST_CAP_GAMEPAD_STATE,
-        };
-        assert_eq!(Welcome::decode(&w.encode()).unwrap(), w);
-
-        // Client-side reassembler ceiling derives from the negotiated rate: 4x the average frame at
-        // 50 Mbps/240 Hz is ~104 KB, so the 8 MiB floor governs. The host keeps the p1_defaults
-        // bound (it never reassembles video), as does a client of a bitrate-0 (older) host.
-        let cc = w.session_config(Role::Client);
-        assert_eq!(cc.max_frame_bytes, 8 << 20);
-        cc.validate().expect("derived client config validates");
-        assert_eq!(w.session_config(Role::Host).max_frame_bytes, 64 << 20);
-        let old_host = Welcome {
-            bitrate_kbps: 0,
-            ..w
-        };
-        assert_eq!(
-            old_host.session_config(Role::Client).max_frame_bytes,
-            64 << 20
-        );
-        // A high-rate mode scales past the floor: 1.5 Gbps at 60 Hz = 4 x 3.125 MB = 12.5 MB.
-        let fat = Welcome {
-            bitrate_kbps: 1_500_000,
-            mode: Mode {
-                width: 5120,
-                height: 1440,
-                refresh_hz: 60,
-            },
-            ..w
-        };
-        let derived = fat.session_config(Role::Client).max_frame_bytes;
-        assert_eq!(derived, 4 * 1_500_000 * 125 / 60);
-        assert!(derived > (8 << 20) && derived < (64 << 20));
-    }
-
-    #[test]
-    fn codec_negotiation_and_back_compat() {
-        // resolve_codec precedence (HEVC > AV1 > H.264), no preference (0).
-        assert_eq!(
-            resolve_codec(CODEC_H264 | CODEC_HEVC, CODEC_HEVC | CODEC_AV1, 0),
-            Some(CODEC_HEVC)
-        );
-        assert_eq!(
-            resolve_codec(CODEC_H264 | CODEC_AV1, CODEC_AV1 | CODEC_H264, 0),
-            Some(CODEC_AV1)
-        );
-        assert_eq!(resolve_codec(CODEC_H264, CODEC_H264, 0), Some(CODEC_H264));
-        // A software host (H.264 only) + an HEVC-only client share nothing → refuse.
-        assert_eq!(resolve_codec(CODEC_HEVC, CODEC_H264, 0), None);
-        // An older client (0 = no codec byte) is treated as HEVC-only.
-        assert_eq!(
-            resolve_codec(0, CODEC_HEVC | CODEC_H264, 0),
-            Some(CODEC_HEVC)
-        );
-        assert_eq!(resolve_codec(0, CODEC_H264, 0), None);
-
-        // Soft preference: honored when the host can also emit it, overriding precedence...
-        assert_eq!(
-            resolve_codec(CODEC_H264 | CODEC_HEVC, CODEC_H264 | CODEC_HEVC, CODEC_H264),
-            Some(CODEC_H264)
-        );
-        assert_eq!(
-            resolve_codec(CODEC_HEVC | CODEC_AV1, CODEC_HEVC | CODEC_AV1, CODEC_AV1),
-            Some(CODEC_AV1)
-        );
-        // ...but falls back to precedence when the preferred codec isn't in the shared set.
-        assert_eq!(
-            resolve_codec(CODEC_HEVC | CODEC_H264, CODEC_HEVC | CODEC_H264, CODEC_AV1),
-            Some(CODEC_HEVC)
-        );
-        // A preference the host can't emit still can't rescue a no-shared-codec case.
-        assert_eq!(resolve_codec(CODEC_HEVC, CODEC_H264, CODEC_HEVC), None);
-
-        // PyroWave is opt-in ONLY (plan §3): mutual support NEVER auto-selects it — the ladder
-        // ignores it entirely...
-        assert_eq!(
-            resolve_codec(CODEC_HEVC | CODEC_PYROWAVE, CODEC_HEVC | CODEC_PYROWAVE, 0),
-            Some(CODEC_HEVC)
-        );
-        // ...even when it is the ONLY shared codec (an all-intra 200 Mbps stream must never be a
-        // silent fallback)...
-        assert_eq!(resolve_codec(CODEC_PYROWAVE, CODEC_PYROWAVE, 0), None);
-        // ...it is reachable exclusively through the client's explicit preference.
-        assert_eq!(
-            resolve_codec(
-                CODEC_HEVC | CODEC_PYROWAVE,
-                CODEC_HEVC | CODEC_PYROWAVE,
-                CODEC_PYROWAVE
-            ),
-            Some(CODEC_PYROWAVE)
-        );
-        // A pyrowave preference against a host without the backend falls back to the ladder.
-        assert_eq!(
-            resolve_codec(CODEC_HEVC | CODEC_PYROWAVE, CODEC_HEVC, CODEC_PYROWAVE),
-            Some(CODEC_HEVC)
-        );
-        // And the negotiated bit SURVIVES the Welcome wire roundtrip — the decode whitelist
-        // once folded unknown codec bytes (incl. PyroWave) to HEVC, which sent wavelet AUs
-        // into an FFmpeg HEVC decoder on the first on-glass run.
-        let mut pw_w = Welcome::decode(
-            &Welcome {
-                abi_version: 2,
-                udp_port: 1,
-                mode: Mode {
-                    width: 1280,
-                    height: 720,
-                    refresh_hz: 60,
-                },
-                fec: FecConfig {
-                    scheme: FecScheme::Gf16,
-                    fec_percent: 0,
-                    max_data_per_block: 1024,
-                },
-                shard_payload: 1024,
-                encrypt: false,
-                key: [0; 16],
-                salt: [0; 4],
-                frames: 0,
-                compositor: CompositorPref::Auto,
-                gamepad: GamepadPref::Auto,
-                bitrate_kbps: 0,
-                bit_depth: 8,
-                color: ColorInfo::SDR_BT709,
-                chroma_format: CHROMA_IDC_420,
-                audio_channels: 2,
-                codec: CODEC_PYROWAVE,
-                host_caps: 0,
-            }
-            .encode(),
-        )
-        .unwrap();
-        assert_eq!(pw_w.codec, CODEC_PYROWAVE);
-        // A genuinely unknown future bit still folds to the HEVC default.
-        pw_w.codec = 0x40;
-        assert_eq!(Welcome::decode(&pw_w.encode()).unwrap().codec, CODEC_HEVC);
-
-        // A Hello advertising codecs roundtrips, and the wire form of a codec-only Hello decodes on
-        // a build that ignores the trailing byte (back-compat: extra bytes are skipped).
-        let h = Hello {
-            abi_version: 2,
-            mode: Mode {
-                width: 1280,
-                height: 720,
-                refresh_hz: 60,
-            },
-            compositor: CompositorPref::Auto,
-            gamepad: GamepadPref::Auto,
-            bitrate_kbps: 0,
-            name: None,
-            launch: None,
-            video_caps: 0,
-            audio_channels: 2, // stereo — forces the video_caps/audio_channels placeholders
-            video_codecs: CODEC_H264 | CODEC_HEVC,
-            preferred_codec: CODEC_H264,
-            display_hdr: None,
-        };
-        let enc = h.encode();
-        let dec = Hello::decode(&enc).unwrap();
-        assert_eq!(dec.video_codecs, CODEC_H264 | CODEC_HEVC);
-        assert_eq!(dec.preferred_codec, CODEC_H264);
-        // Drop the preferred_codec byte → still decodes, video_codecs intact, preference gone.
-        let no_pref = &enc[..enc.len() - 1];
-        assert_eq!(
-            Hello::decode(no_pref).unwrap().video_codecs,
-            CODEC_H264 | CODEC_HEVC
-        );
-        assert_eq!(Hello::decode(no_pref).unwrap().preferred_codec, 0);
-        // A pre-codec Hello (no video_codecs/preferred bytes) decodes to 0 → HEVC-only.
-        let legacy = &enc[..enc.len() - 2];
-        assert_eq!(Hello::decode(legacy).unwrap().video_codecs, 0);
-        assert_eq!(Hello::decode(legacy).unwrap().preferred_codec, 0);
-
-        // A pre-codec Welcome (no codec byte) decodes to HEVC.
-        let mut w = Welcome::decode(
-            &Welcome {
-                abi_version: 2,
-                udp_port: 1,
-                mode: h.mode,
-                fec: FecConfig {
-                    scheme: FecScheme::Gf16,
-                    fec_percent: 0,
-                    max_data_per_block: 1024,
-                },
-                shard_payload: 1024,
-                encrypt: false,
-                key: [0; 16],
-                salt: [0; 4],
-                frames: 0,
-                compositor: CompositorPref::Auto,
-                gamepad: GamepadPref::Auto,
-                bitrate_kbps: 0,
-                bit_depth: 8,
-                color: ColorInfo::SDR_BT709,
-                chroma_format: CHROMA_IDC_420,
-                audio_channels: 2,
-                codec: CODEC_H264,
-                host_caps: 0,
-            }
-            .encode(),
-        )
-        .unwrap();
-        assert_eq!(w.codec, CODEC_H264);
-        w.codec = CODEC_HEVC;
-        let wenc = w.encode();
-        assert_eq!(
-            Welcome::decode(&wenc[..wenc.len() - 1]).unwrap().codec,
-            CODEC_HEVC
-        );
-    }
-
-    #[test]
-    fn hello_start_roundtrip() {
-        let h = Hello {
-            abi_version: 1,
-            mode: Mode {
-                width: 1280,
-                height: 720,
-                refresh_hz: 120,
-            },
-            compositor: CompositorPref::Kwin,
-            gamepad: GamepadPref::DualSense,
-            bitrate_kbps: 25_000,
-            name: Some("Test Device".into()),
-            launch: Some("steam:570".into()),
-            video_caps: VIDEO_CAP_10BIT,
-            audio_channels: 2,
-            video_codecs: CODEC_H264 | CODEC_HEVC, // exercise the codec bitfield roundtrip
-            preferred_codec: CODEC_HEVC,
-            display_hdr: None,
-        };
-        assert_eq!(Hello::decode(&h.encode()).unwrap(), h);
-        let s = Start {
-            client_udp_port: 1234,
-        };
-        assert_eq!(Start::decode(&s.encode()).unwrap(), s);
-    }
-
-    #[test]
-    fn hello_welcome_compositor_back_compat() {
-        // Trailing optional bytes (compositor at 20/53, gamepad at 21/54): a legacy peer's
-        // shorter message still decodes (missing fields = Auto), and a legacy peer reading a
-        // new message ignores the trailing bytes. Simulate both directions by truncation.
-        let h = Hello {
-            abi_version: 2,
-            mode: Mode {
-                width: 1920,
-                height: 1080,
-                refresh_hz: 60,
-            },
-            compositor: CompositorPref::Mutter,
-            gamepad: GamepadPref::DualSense,
-            bitrate_kbps: 80_000,
-            name: None,
-            launch: None,
-            video_caps: 0,
-            audio_channels: 2,
-            video_codecs: 0,
-            preferred_codec: 0,
-            display_hdr: None,
-        };
-        let enc = h.encode();
-        assert_eq!(enc.len(), 26);
-        // Legacy (20-byte) Hello → both Auto, no bitrate, mode intact.
-        let legacy = Hello::decode(&enc[..20]).unwrap();
-        assert_eq!(legacy.compositor, CompositorPref::Auto);
-        assert_eq!(legacy.gamepad, GamepadPref::Auto);
-        assert_eq!(legacy.bitrate_kbps, 0);
-        assert_eq!(legacy.mode, h.mode);
-        // Compositor-era (21-byte) Hello → compositor intact, gamepad Auto.
-        let mid = Hello::decode(&enc[..21]).unwrap();
-        assert_eq!(mid.compositor, CompositorPref::Mutter);
-        assert_eq!(mid.gamepad, GamepadPref::Auto);
-        // Gamepad-era (22-byte) Hello → compositor + gamepad intact, bitrate 0 (host default).
-        let pre_bitrate = Hello::decode(&enc[..22]).unwrap();
-        assert_eq!(pre_bitrate.gamepad, GamepadPref::DualSense);
-        assert_eq!(pre_bitrate.bitrate_kbps, 0);
-        // Full message → bitrate intact.
-        assert_eq!(Hello::decode(&enc).unwrap().bitrate_kbps, 80_000);
-
-        let w = Welcome {
-            abi_version: 2,
-            udp_port: 7000,
-            mode: h.mode,
-            fec: FecConfig {
-                scheme: FecScheme::Gf16,
-                fec_percent: 20,
-                max_data_per_block: 4096,
-            },
-            shard_payload: 1200,
-            encrypt: true,
-            key: [3u8; 16],
-            salt: [9, 8, 7, 6],
-            frames: 0,
-            compositor: CompositorPref::Kwin,
-            gamepad: GamepadPref::Xbox360,
-            bitrate_kbps: 120_000,
-            bit_depth: 10,
-            color: ColorInfo::HDR10_BT2020_PQ,
-            chroma_format: CHROMA_IDC_444,
-            audio_channels: 6, // 5.1 — exercises the non-default trailing byte
-            codec: CODEC_HEVC,
-            host_caps: HOST_CAP_GAMEPAD_STATE,
-        };
-        let wenc = w.encode();
-        assert_eq!(wenc.len(), 68); // 60 base + 4 colour + chroma + audio-channels + codec + host-caps
-        let legacy_w = Welcome::decode(&wenc[..53]).unwrap();
-        assert_eq!(legacy_w.compositor, CompositorPref::Auto);
-        assert_eq!(legacy_w.gamepad, GamepadPref::Auto);
-        assert_eq!(legacy_w.bitrate_kbps, 0);
-        assert_eq!(legacy_w.frames, 0);
-        assert_eq!(legacy_w.key, w.key);
-        let mid_w = Welcome::decode(&wenc[..54]).unwrap();
-        assert_eq!(mid_w.compositor, CompositorPref::Kwin);
-        assert_eq!(mid_w.gamepad, GamepadPref::Auto);
-        // Gamepad-era (55-byte) Welcome → gamepad intact, bitrate 0 (unknown).
-        let pre_bitrate_w = Welcome::decode(&wenc[..55]).unwrap();
-        assert_eq!(pre_bitrate_w.gamepad, GamepadPref::Xbox360);
-        assert_eq!(pre_bitrate_w.bitrate_kbps, 0);
-        assert_eq!(pre_bitrate_w.bit_depth, 8); // older host (no trailing byte) → 8-bit assumed
-        assert_eq!(legacy_w.bit_depth, 8);
-        // A pre-colour (60-byte) Welcome → SDR BT.709 (the only colour those hosts produced).
-        let pre_color_w = Welcome::decode(&wenc[..60]).unwrap();
-        assert_eq!(pre_color_w.bit_depth, 10);
-        assert_eq!(pre_color_w.color, ColorInfo::SDR_BT709);
-        assert_eq!(pre_color_w.chroma_format, CHROMA_IDC_420); // pre-chroma host → 4:2:0
-        assert_eq!(legacy_w.color, ColorInfo::SDR_BT709);
-        assert_eq!(legacy_w.chroma_format, CHROMA_IDC_420);
-        // A pre-chroma (64-byte) Welcome carries colour but no chroma/audio bytes → 4:2:0 + stereo.
-        let pre_chroma_w = Welcome::decode(&wenc[..64]).unwrap();
-        assert_eq!(pre_chroma_w.color, ColorInfo::HDR10_BT2020_PQ);
-        assert_eq!(pre_chroma_w.chroma_format, CHROMA_IDC_420);
-        assert_eq!(pre_chroma_w.audio_channels, 2); // audio byte (offset 65) absent → stereo
-                                                    // A pre-audio (65-byte) Welcome carries chroma but no audio byte → 4:4:4 + stereo.
-        let pre_audio_w = Welcome::decode(&wenc[..65]).unwrap();
-        assert_eq!(pre_audio_w.chroma_format, CHROMA_IDC_444);
-        assert_eq!(pre_audio_w.audio_channels, 2);
-        assert_eq!(Welcome::decode(&wenc).unwrap().bitrate_kbps, 120_000);
-        assert_eq!(Welcome::decode(&wenc).unwrap().bit_depth, 10); // full form carries it
-        assert_eq!(
-            Welcome::decode(&wenc).unwrap().color,
-            ColorInfo::HDR10_BT2020_PQ
-        );
-        assert_eq!(
-            Welcome::decode(&wenc).unwrap().chroma_format,
-            CHROMA_IDC_444
-        ); // full form carries 4:4:4
-        assert_eq!(Welcome::decode(&wenc).unwrap().audio_channels, 6); // ...and 5.1
-                                                                       // A pre-host-caps (67-byte) Welcome → 0 (legacy input only); the full form carries the bit.
-        assert_eq!(Welcome::decode(&wenc[..67]).unwrap().host_caps, 0);
-        assert_eq!(
-            Welcome::decode(&wenc).unwrap().host_caps,
-            HOST_CAP_GAMEPAD_STATE
-        );
-    }
-
-    #[test]
-    fn hello_name_roundtrip_and_back_compat() {
-        let base = Hello {
-            abi_version: 2,
-            mode: Mode {
-                width: 1280,
-                height: 720,
-                refresh_hz: 60,
-            },
-            compositor: CompositorPref::Auto,
-            gamepad: GamepadPref::Auto,
-            bitrate_kbps: 0,
-            name: Some("Enrico's MacBook".into()),
-            launch: None,
-            video_caps: 0,
-            audio_channels: 2,
-            video_codecs: 0,
-            preferred_codec: 0,
-            display_hdr: None,
-        };
-        let enc = base.encode();
-        assert_eq!(
-            Hello::decode(&enc).unwrap().name.as_deref(),
-            Some("Enrico's MacBook")
-        );
-        // A bitrate-era (26-byte) peer reading a named Hello ignores the trailing name; a named
-        // host reading a bitrate-era Hello decodes name = None.
-        assert_eq!(Hello::decode(&enc[..26]).unwrap().name, None);
-        // No name → wire form is byte-identical to the bitrate-era message (26 bytes).
-        let unnamed = Hello {
-            name: None,
-            ..base.clone()
-        };
-        assert_eq!(unnamed.encode().len(), 26);
-        // Over-long names truncate to a char boundary within HELLO_NAME_MAX on encode.
-        let long = Hello {
-            name: Some(format!("{}ü", "x".repeat(HELLO_NAME_MAX - 1))), // ü straddles the cap
-            ..base.clone()
-        };
-        let dec = Hello::decode(&long.encode()).unwrap();
-        let n = dec.name.expect("truncated name still present");
-        assert!(n.len() <= HELLO_NAME_MAX && n.starts_with('x'));
-        // A corrupt length byte (longer than the buffer) or bad UTF-8 degrades to None, never Err.
-        let mut bad_len = unnamed.encode();
-        bad_len.push(40); // claims 40 name bytes, none follow
-        assert_eq!(Hello::decode(&bad_len).unwrap().name, None);
-        let mut bad_utf8 = unnamed.encode();
-        bad_utf8.extend_from_slice(&[2, 0xFF, 0xFE]);
-        assert_eq!(Hello::decode(&bad_utf8).unwrap().name, None);
-    }
-
-    #[test]
-    fn hello_launch_roundtrip_and_back_compat() {
-        let base = Hello {
-            abi_version: 2,
-            mode: Mode {
-                width: 1920,
-                height: 1080,
-                refresh_hz: 60,
-            },
-            compositor: CompositorPref::Auto,
-            gamepad: GamepadPref::Auto,
-            bitrate_kbps: 0,
-            name: None,
-            launch: None,
-            video_caps: 0,
-            audio_channels: 2,
-            video_codecs: 0,
-            preferred_codec: 0,
-            display_hdr: None,
-        };
-        // launch alone (no name): a zero-length name placeholder keeps the offset deterministic.
-        let with_launch = Hello {
-            launch: Some("steam:570".into()),
-            ..base.clone()
-        };
-        assert_eq!(Hello::decode(&with_launch.encode()).unwrap(), with_launch);
-        // launch + name together.
-        let both = Hello {
-            name: Some("Enrico's Mac".into()),
-            launch: Some("custom:abc123".into()),
-            ..base.clone()
-        };
-        assert_eq!(Hello::decode(&both.encode()).unwrap(), both);
-        // name but no launch (a name-era client): launch decodes None.
-        let name_only = Hello {
-            name: Some("Enrico's Mac".into()),
-            ..base.clone()
-        };
-        assert_eq!(Hello::decode(&name_only.encode()).unwrap().launch, None);
-        // Neither field → still the 26-byte bitrate-era form (no launch placeholder emitted).
-        assert_eq!(base.encode().len(), 26);
-        assert_eq!(Hello::decode(&base.encode()).unwrap().launch, None);
-        // A bitrate-era (26-byte) peer reading a launch-bearing Hello ignores it.
-        assert_eq!(
-            Hello::decode(&with_launch.encode()[..26]).unwrap().launch,
-            None
-        );
-        // Over-long ids truncate on a char boundary within HELLO_LAUNCH_MAX.
-        let long = Hello {
-            launch: Some(format!("{}ü", "x".repeat(HELLO_LAUNCH_MAX - 1))),
-            ..base.clone()
-        };
-        let dec = Hello::decode(&long.encode())
-            .unwrap()
-            .launch
-            .expect("present");
-        assert!(dec.len() <= HELLO_LAUNCH_MAX && dec.starts_with('x'));
-    }
-
-    #[test]
-    fn hello_display_hdr_roundtrip_and_back_compat() {
-        let base = Hello {
-            abi_version: 2,
-            mode: Mode {
-                width: 3840,
-                height: 2160,
-                refresh_hz: 120,
-            },
-            compositor: CompositorPref::Auto,
-            gamepad: GamepadPref::Auto,
-            bitrate_kbps: 0,
-            name: None,
-            launch: None,
-            video_caps: VIDEO_CAP_10BIT | VIDEO_CAP_HDR,
-            audio_channels: 2,
-            video_codecs: 0,
-            preferred_codec: 0,
-            display_hdr: None,
-        };
-        // A real client-panel volume (P3 primaries, 800-nit peak, 0.05-nit floor, 400-nit FALL).
-        let vol = HdrMeta {
-            display_primaries: [[13250, 34500], [7500, 3000], [34000, 16000]], // G, B, R
-            white_point: [15635, 16450],                                       // D65
-            max_display_mastering_luminance: 8_000_000,                        // 800 nits
-            min_display_mastering_luminance: 500,                              // 0.05 nits
-            max_cll: 0,
-            max_fall: 400,
-        };
-        let with_hdr = Hello {
-            display_hdr: Some(vol),
-            ..base.clone()
-        };
-        // Full roundtrip, including the forced placeholders for the earlier trailing fields.
-        assert_eq!(Hello::decode(&with_hdr.encode()).unwrap(), with_hdr);
-        // display_hdr alone (every earlier optional at its default) still lands at a deterministic
-        // offset — the placeholder discipline holds through the whole tail.
-        let hdr_only = Hello {
-            video_caps: 0,
-            display_hdr: Some(vol),
-            ..base.clone()
-        };
-        assert_eq!(Hello::decode(&hdr_only.encode()).unwrap(), hdr_only);
-        // An older host reading a display_hdr-bearing Hello ignores the trailing block (its decode
-        // stops at preferred_codec); a new host reading an older client's Hello gets None.
-        let enc = with_hdr.encode();
-        assert_eq!(
-            Hello::decode(&enc[..enc.len() - HDR_META_BODY_LEN]).unwrap(),
-            Hello {
-                display_hdr: None,
-                ..with_hdr.clone()
-            }
-        );
-        assert_eq!(Hello::decode(&base.encode()).unwrap().display_hdr, None);
-        // A TRUNCATED trailing block (mid-datagram cut) degrades to None, never a partial read.
-        assert_eq!(
-            Hello::decode(&enc[..enc.len() - 1]).unwrap().display_hdr,
-            None
-        );
-        // Exact wire length: 26 bitrate-era bytes + the 6 forced single-byte placeholders
-        // (name len, launch len, video_caps, audio_channels, video_codecs, preferred_codec) + the body.
-        assert_eq!(hdr_only.encode().len(), 26 + 6 + HDR_META_BODY_LEN);
-    }
-
-    #[test]
-    fn control_messages_disjoint_from_hello() {
-        // A Hello uses MAGIC (PKF1); control messages use CTL_MAGIC (PKFc). No Hello — at
-        // any abi_version — can be misparsed as a control message, and vice-versa.
-        for abi in [1u32, 2, 16, 0x10, 0x0113, 0x1410] {
-            let h = Hello {
-                abi_version: abi,
-                mode: Mode {
-                    width: 1280,
-                    height: 720,
-                    refresh_hz: 60,
-                },
-                compositor: CompositorPref::Auto,
-                gamepad: GamepadPref::Auto,
-                bitrate_kbps: 0,
-                name: None,
-                launch: None,
-                video_caps: 0,
-                audio_channels: 2,
-                video_codecs: 0,
-                preferred_codec: 0,
-                display_hdr: None,
-            }
-            .encode();
-            assert!(PairRequest::decode(&h).is_err(), "abi {abi} parsed as pair");
-            assert!(Reconfigure::decode(&h).is_err());
-        }
-        // And a PairRequest never parses as a Hello.
-        let pr = PairRequest {
-            name: "x".into(),
-            spake_a: vec![0u8; 33],
-        }
-        .encode();
-        assert!(Hello::decode(&pr).is_err());
-    }
-}

crates/punktfunk-core/src/quic/io.rs

@@ -1,14 +1,6 @@
 //! Length-prefixed framing for QUIC control-stream messages: a `u16` length header followed by the
 //! payload, bounded at 64 KiB (control messages are tiny).
 /// Read one framed message (bounded at 64 KiB — control messages are tiny).
-///
-/// **Not cancel-safe**: it frames with two `quinn::RecvStream::read_exact` calls, and quinn
-/// documents `read_exact` as not cancel-safe (the bytes it has already taken out of the stream
-/// live only in the future's own buffer, and nothing puts them back on drop). Dropping a
-/// partially-progressed future therefore destroys the bytes it consumed and misaligns every
-/// subsequent read on that stream. Use it only where the read runs to completion — the sequential
-/// handshake/pairing exchanges. Anything driving a read from a `select!` arm or a
-/// `tokio::time::timeout` must use [`MsgReader`] instead.
 pub async fn read_msg(recv: &mut quinn::RecvStream) -> std::io::Result<Vec<u8>> {
     let mut len = [0u8; 2];
     recv.read_exact(&mut len)
@@ -22,158 +14,9 @@ pub async fn read_msg(recv: &mut quinn::RecvStream) -> std::io::Result<Vec<u8>>
     Ok(buf)
 }
 
-/// Cancel-safe framed reader for a long-lived control stream.
-///
-/// Keeps the frame in progress in `buf` rather than inside the read future, so dropping the future
-/// — which both control loops do on every iteration where a sibling `select!` arm wins, and which
-/// [`clock_sync`](super::clock_sync) does on a read timeout — resumes instead of losing bytes.
-/// With the plain [`read_msg`] a control frame that straddles two wakeups (a ~2 KB `ClipOffer`
-/// exceeds one QUIC packet; so does any frame whose second half is lost or reordered) left the
-/// stream permanently misaligned: the next read took two payload bytes as a length, every later
-/// message decoded as garbage and was silently ignored, and a bogus 64 KiB length parked the read
-/// forever — killing mode switches, adaptive bitrate, clock re-sync and clipboard for the rest of
-/// the session with nothing but a `warn!` in the log.
-pub struct MsgReader {
-    recv: quinn::RecvStream,
-    /// The frame in progress, length prefix included.
-    buf: Vec<u8>,
-    /// Bytes `buf` must reach: 2 while reading the prefix, then `2 + payload length`.
-    need: usize,
-}
-
-impl MsgReader {
-    pub fn new(recv: quinn::RecvStream) -> Self {
-        MsgReader {
-            recv,
-            buf: Vec::new(),
-            need: 2,
-        }
-    }
-
-    /// Read one framed message. Cancel-safe: dropping the future keeps the partial frame, so the
-    /// next call resumes where this one stopped.
-    pub async fn read_msg(&mut self) -> std::io::Result<Vec<u8>> {
-        loop {
-            while self.buf.len() < self.need {
-                let mut chunk = [0u8; 2048];
-                let want = (self.need - self.buf.len()).min(chunk.len());
-                // `read` IS cancel-safe: it only reports bytes it hands back, and they are
-                // committed to `self.buf` before the next await point.
-                match self
-                    .recv
-                    .read(&mut chunk[..want])
-                    .await
-                    .map_err(std::io::Error::other)?
-                {
-                    Some(n) => self.buf.extend_from_slice(&chunk[..n]),
-                    None => {
-                        return Err(std::io::Error::new(
-                            std::io::ErrorKind::UnexpectedEof,
-                            "control stream finished mid-frame",
-                        ))
-                    }
-                }
-            }
-            if self.need == 2 {
-                self.need = 2 + u16::from_le_bytes([self.buf[0], self.buf[1]]) as usize;
-                if self.need == 2 {
-                    self.buf.clear();
-                    return Ok(Vec::new()); // zero-length frame
-                }
-            } else {
-                let msg = self.buf.split_off(2);
-                self.buf.clear();
-                self.need = 2;
-                return Ok(msg);
-            }
-        }
-    }
-}
-
 /// Write one framed message.
 pub async fn write_msg(send: &mut quinn::SendStream, payload: &[u8]) -> std::io::Result<()> {
     send.write_all(&super::frame(payload))
         .await
         .map_err(std::io::Error::other)
 }
-
-/// The control stream is read from a `select!` arm on both peers, so the read future is dropped
-/// routinely — and quinn documents `read_exact` (what `io::read_msg` uses) as NOT cancel-safe.
-/// [`io::MsgReader`] must survive that: the partial frame lives in the reader, not the future.
-#[cfg(test)]
-mod tests {
-    use crate::quic::io;
-    use crate::quic::test_util::connect_pair;
-
-    /// A frame whose halves land in different wakeups, with the read cancelled in between, must
-    /// still be delivered whole — and the NEXT frame must decode correctly too. Without a
-    /// resumable reader the consumed length prefix is lost, the following read takes two payload
-    /// bytes as a length, and every later control message is garbage for the rest of the session.
-    #[tokio::test]
-    async fn cancelled_mid_frame_read_resumes_without_desync() {
-        let (_server_ep, _client_ep, host_conn, client_conn) = connect_pair().await;
-
-        let first = b"the-frame-that-straddles-two-wakeups".to_vec();
-        let second = b"the-frame-after-it".to_vec();
-        let (f1, f2) = (first.clone(), second.clone());
-
-        let writer = tokio::spawn(async move {
-            let (mut send, _recv) = host_conn.open_bi().await.expect("open bi");
-            let framed = crate::quic::frame(&f1);
-            // Length prefix + only part of the payload, then a real pause: this is the ClipOffer
-            // -sized frame split across two QUIC packets that made the bug reachable.
-            let split = 2 + f1.len() / 3;
-            send.write_all(&framed[..split]).await.expect("write head");
-            tokio::time::sleep(std::time::Duration::from_millis(120)).await;
-            send.write_all(&framed[split..]).await.expect("write tail");
-            send.write_all(&crate::quic::frame(&f2))
-                .await
-                .expect("write second");
-            tokio::time::sleep(std::time::Duration::from_millis(200)).await;
-            host_conn
-        });
-
-        let (_send, recv) = client_conn.accept_bi().await.expect("accept bi");
-        let mut reader = io::MsgReader::new(recv);
-
-        // Cancel mid-frame — exactly what a sibling `select!` arm does.
-        let cancelled =
-            tokio::time::timeout(std::time::Duration::from_millis(30), reader.read_msg()).await;
-        assert!(
-            cancelled.is_err(),
-            "the head-only frame must not complete yet (test setup)"
-        );
-
-        let got = tokio::time::timeout(std::time::Duration::from_secs(5), reader.read_msg())
-            .await
-            .expect("first frame must arrive after resuming")
-            .expect("first frame reads cleanly");
-        assert_eq!(got, first, "the cancelled read must resume, not lose bytes");
-
-        let got2 = tokio::time::timeout(std::time::Duration::from_secs(5), reader.read_msg())
-            .await
-            .expect("second frame must arrive")
-            .expect("second frame reads cleanly");
-        assert_eq!(got2, second, "stream must still be framed correctly");
-
-        let _host_conn = writer.await.unwrap();
-    }
-
-    /// A zero-length frame is a legal encoding and must not stall the reader or eat the next one.
-    #[tokio::test]
-    async fn zero_length_frame_round_trips() {
-        let (_server_ep, _client_ep, host_conn, client_conn) = connect_pair().await;
-        let writer = tokio::spawn(async move {
-            let (mut send, _recv) = host_conn.open_bi().await.expect("open bi");
-            send.write_all(&crate::quic::frame(&[])).await.unwrap();
-            send.write_all(&crate::quic::frame(b"after")).await.unwrap();
-            tokio::time::sleep(std::time::Duration::from_millis(200)).await;
-            host_conn
-        });
-        let (_send, recv) = client_conn.accept_bi().await.expect("accept bi");
-        let mut reader = io::MsgReader::new(recv);
-        assert!(reader.read_msg().await.unwrap().is_empty());
-        assert_eq!(reader.read_msg().await.unwrap(), b"after");
-        let _host_conn = writer.await.unwrap();
-    }
-}

crates/punktfunk-core/src/quic/mod.rs

@@ -22,14 +22,11 @@
 //! reported back for persisting). The data plane adds AES-GCM on top.
 //! All integers little-endian; every message is `u16 length || payload`.
 //!
-//! Split by concern (networking-audit deferred plan §3 — a pure move): `handshake` the
-//! positional Hello/Welcome/Start codecs, `caps` the capability/codec-negotiation
-//! vocabulary, `control` the typed control + clipboard messages, `pairing` the pairing
-//! message codecs with [`pake`] the SPAKE2 itself, `datagram` the 0xC9–0xCF plane codecs,
-//! [`io`] framed stream IO, `clock` skew estimation + mid-stream re-sync, [`endpoint`] the
-//! quinn constructors, [`clipstream`] the per-transfer clipboard fetch streams. Every item
-//! is re-exported here, so all existing `crate::quic::X` paths compile unchanged; each
-//! module's tests sit at its own foot.
+//! Split by concern (networking-audit deferred plan §3 — a pure move): [`msgs`] the
+//! handshake + typed control messages, [`pake`] the pairing SPAKE2, [`datagram`] the
+//! 0xC9–0xCF plane codecs, [`io`] framed stream IO, [`clock`] skew estimation + mid-stream
+//! re-sync, [`endpoint`] the quinn constructors. Every item is re-exported here, so all
+//! existing `crate::quic::X` paths compile unchanged.
 
 /// Protocol magic + version, first bytes of the positional handshake (Hello/Welcome/Start).
 pub const MAGIC: &[u8; 4] = b"PKF1";
@@ -79,4 +76,4 @@ pub use pairing::*;
 pub use crate::reject::*;
 
 #[cfg(test)]
-pub(crate) mod test_util;
+mod tests;

crates/punktfunk-core/src/quic/pairing.rs

@@ -78,16 +78,13 @@ fn get_bytes(b: &[u8], off: usize) -> Result<(&[u8], usize)> {
 
 impl PairRequest {
     pub fn encode(&self) -> Vec<u8> {
-        // Same cap, same rule as Hello's copy of this field: truncate on a char boundary —
-        // a raw byte cut mid-sequence put invalid UTF-8 on the wire, and the host showed the
-        // name with a permanent replacement char in its paired-clients list.
-        let name = super::handshake::truncate_to(&self.name, HELLO_NAME_MAX).as_bytes();
-        let n = name.len();
+        let name = self.name.as_bytes();
+        let n = name.len().min(64);
         let mut b = Vec::with_capacity(8 + n + self.spake_a.len());
         b.extend_from_slice(CTL_MAGIC);
         b.push(MSG_PAIR_REQUEST);
         b.push(n as u8);
-        b.extend_from_slice(name);
+        b.extend_from_slice(&name[..n]);
         put_bytes(&mut b, &self.spake_a);
         b
     }
@@ -174,50 +171,3 @@ impl PairResult {
         Ok(PairResult { ok: b[5] != 0 })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::quic::*;
-
-    #[test]
-    fn pair_messages_roundtrip() {
-        let pr = PairRequest {
-            name: "Enrico's Mac".into(),
-            spake_a: vec![1, 2, 3, 4, 5],
-        };
-        assert_eq!(PairRequest::decode(&pr.encode()).unwrap(), pr);
-        let pc = PairChallenge {
-            spake_b: vec![9; 33],
-            confirm: [7u8; 32],
-        };
-        assert_eq!(PairChallenge::decode(&pc.encode()).unwrap(), pc);
-        let pp = PairProof { confirm: [3u8; 32] };
-        assert_eq!(PairProof::decode(&pp.encode()).unwrap(), pp);
-        for ok in [true, false] {
-            assert_eq!(
-                PairResult::decode(&PairResult { ok }.encode()).unwrap().ok,
-                ok
-            );
-        }
-        // Length-exact: a truncated/padded PairProof is rejected.
-        let mut bad = pp.encode();
-        bad.push(0);
-        assert!(PairProof::decode(&bad).is_err());
-    }
-
-    #[test]
-    fn pair_request_name_cap_respects_char_boundaries() {
-        // A multi-byte char straddling the 64-byte cap must be dropped whole (Hello's rule),
-        // not split mid-sequence into invalid UTF-8 the host then renders as U+FFFD forever.
-        let pr = PairRequest {
-            name: format!("{}\u{00fc}", "x".repeat(HELLO_NAME_MAX - 1)),
-            spake_a: vec![1, 2, 3],
-        };
-        let dec = PairRequest::decode(&pr.encode()).unwrap();
-        assert!(dec.name.len() <= HELLO_NAME_MAX && dec.name.starts_with('x'));
-        assert!(
-            !dec.name.contains('\u{FFFD}'),
-            "name must never be split mid-char on the wire"
-        );
-    }
-}

crates/punktfunk-core/src/quic/pake.rs

@@ -80,36 +80,3 @@ impl PairingPake {
 pub fn verify(expected: &[u8; 32], got: &[u8; 32]) -> bool {
     ct_eq(expected, got)
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::quic::pake;
-
-    #[test]
-    fn spake2_pairing_agrees_only_on_matching_pin_and_certs() {
-        let cfp = [0x11u8; 32];
-        let hfp = [0x22u8; 32];
-
-        // Right PIN, same fingerprint views on both sides → both confirmations agree.
-        let (ca, ma) = pake::start(true, "4321", &cfp, &hfp);
-        let (cb, mb) = pake::start(false, "4321", &cfp, &hfp);
-        let a = ca.finish(&mb).unwrap();
-        let b = cb.finish(&ma).unwrap();
-        assert!(pake::verify(&a.host, &b.host) && pake::verify(&a.client, &b.client));
-
-        // Wrong PIN → different keys → confirmations DON'T match (one online guess wasted).
-        let (ca, ma) = pake::start(true, "0000", &cfp, &hfp);
-        let (cb, mb) = pake::start(false, "4321", &cfp, &hfp);
-        let a = ca.finish(&mb).unwrap();
-        let b = cb.finish(&ma).unwrap();
-        assert!(!pake::verify(&a.client, &b.client));
-
-        // MITM: the two legs saw different host certs → no agreement even with the right PIN.
-        let attacker_hfp = [0x33u8; 32];
-        let (ca, ma) = pake::start(true, "4321", &cfp, &attacker_hfp);
-        let (cb, mb) = pake::start(false, "4321", &cfp, &hfp);
-        let a = ca.finish(&mb).unwrap();
-        let b = cb.finish(&ma).unwrap();
-        assert!(!pake::verify(&a.client, &b.client));
-    }
-}

crates/punktfunk-core/src/quic/test_util.rs

@@ -1,28 +0,0 @@
-//! Shared in-process QUIC loopback plumbing for the quic submodule tests.
-use super::endpoint;
-
-/// Stand up two loopback quinn endpoints, connect, and return
-/// `(server_ep, client_ep, host_conn, client_conn)`. Both endpoints are returned so the caller
-/// keeps them in scope — dropping a `quinn::Endpoint` tears down its connections.
-pub(crate) async fn connect_pair() -> (
-    quinn::Endpoint,
-    quinn::Endpoint,
-    quinn::Connection,
-    quinn::Connection,
-) {
-    let server = endpoint::server("127.0.0.1:0".parse().unwrap()).unwrap();
-    let addr = server.local_addr().unwrap();
-    let client = endpoint::client_insecure().unwrap();
-    let accept = tokio::spawn(async move {
-        let incoming = server.accept().await.expect("incoming connection");
-        let conn = incoming.await.expect("host side connects");
-        (server, conn)
-    });
-    let client_conn = client
-        .connect(addr, "punktfunk")
-        .unwrap()
-        .await
-        .expect("client side connects");
-    let (server, host_conn) = accept.await.unwrap();
-    (server, client, host_conn, client_conn)
-}

crates/punktfunk-core/src/session.rs

@@ -13,9 +13,7 @@ use crate::crypto::SessionCrypto;
 use crate::error::{PunktfunkError, Result};
 use crate::fec::{coder_for, ErasureCoder};
 use crate::input::InputEvent;
-use crate::packet::{
-    PacketHeader, Packetizer, Reassembler, ReassemblerLimits, StreamedAu, MAX_DATAGRAM_BYTES,
-};
+use crate::packet::{Packetizer, Reassembler, ReassemblerLimits, MAX_DATAGRAM_BYTES};
 use crate::stats::{Stats, StatsCounters};
 use crate::transport::Transport;
 use zerocopy::IntoBytes;
@@ -32,14 +30,6 @@ pub struct Frame {
     /// ([`crate::packet::USER_FLAG_CHUNK_ALIGNED`]) are ever delivered partial; missing
     /// shard ranges are zero-filled at their exact offsets.
     pub complete: bool,
-    /// Wall-clock instant (ns since the Unix epoch, CLOCK_REALTIME basis — the same clock the
-    /// skew handshake compares and the host stamps `pts_ns` with) at which this AU finished
-    /// reassembly, stamped by [`Session::poll_frame`] as the frame leaves the session. Embedders
-    /// that previously stamped receipt themselves at the hand-off pull should use this instead:
-    /// the pull stamp additionally contains the pre-decode queue wait, silently folding any
-    /// client-side standing backlog into the apparent NETWORK latency. The reassembler itself
-    /// leaves this 0 (it owns no clock — the stamp is the session boundary's job).
-    pub received_ns: u64,
 }
 
 /// One end of a stream. Constructed for a single [`Role`]; calling the other role's
@@ -92,27 +82,160 @@ pub struct Session {
     lane_scratch: Vec<Vec<u8>>,
 }
 
-/// Stamp [`Frame::received_ns`] as the frame crosses the session boundary in
-/// [`Session::poll_frame`] — completed frames return the moment their last shard lands, so
-/// stamping at return IS stamping at reassembly completion (µs apart). CLOCK_REALTIME to match
-/// `pts_ns` / the skew handshake (deliberately not monotonic — cross-machine latency math).
-fn stamp_received(mut f: Frame) -> Frame {
-    f.received_ns = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_nanos() as u64)
-        .unwrap_or(0);
-    f
+/// Wire-packet count at which a frame's sealing splits across two lanes (plan Phase 1.5):
+/// below it the channel rendezvous (~µs) isn't worth it; at it the halved AES-GCM span
+/// (≥ ~125 µs of ~1 µs/packet work) dwarfs the hand-off. ≈300 KB of wire, i.e. ≥150 Mbps
+/// at 60 fps — small frames and the probe's ~17-packet AUs stay strictly single-lane.
+const TWO_LANE_MIN_PACKETS: usize = 256;
+
+/// One two-lane seal hand-off: the frame's back-half wire buffers, sealed by the worker with
+/// nonces `seq_base + i` (the nonce order is deterministic per shard index, which is what
+/// makes the split sound). Round-trips through the channels so the buffers return to the pool.
+struct SealJob {
+    bufs: Vec<Vec<u8>>,
+    seq_base: u64,
+    timed: bool,
+    /// Worker-lane CPU ns (when `timed`) and the seal outcome, filled in by the worker.
+    ns: u64,
+    result: Result<()>,
 }
 
-mod perf;
-mod replay;
-mod seal;
+/// The persistent second seal lane: a worker thread that AES-GCM-seals the back half of a
+/// large frame's packets while the send thread seals the front half. Rendezvous channels
+/// (bound 1) — the send thread submits, seals its half, then waits; no per-frame spawn.
+/// Dropping the struct closes the channel and the worker exits.
+struct SealLane {
+    to_worker: std::sync::mpsc::SyncSender<SealJob>,
+    from_worker: std::sync::mpsc::Receiver<SealJob>,
+}
 
-pub use perf::{PumpPerf, SealPerf};
+impl SealLane {
+    fn spawn(crypto: std::sync::Arc<SessionCrypto>) -> Option<SealLane> {
+        let (to_worker, jobs) = std::sync::mpsc::sync_channel::<SealJob>(1);
+        let (done_tx, from_worker) = std::sync::mpsc::sync_channel::<SealJob>(1);
+        std::thread::Builder::new()
+            .name("punktfunk-seal2".into())
+            .spawn(move || {
+                while let Ok(mut job) = jobs.recv() {
+                    let t0 = job.timed.then(std::time::Instant::now);
+                    job.result = seal_wire_slice(&crypto, &mut job.bufs, job.seq_base);
+                    if let Some(t0) = t0 {
+                        job.ns = t0.elapsed().as_nanos() as u64;
+                    }
+                    if done_tx.send(job).is_err() {
+                        break; // session gone mid-frame — nothing left to seal for
+                    }
+                }
+            })
+            .ok()?;
+        Some(SealLane {
+            to_worker,
+            from_worker,
+        })
+    }
+}
 
-use perf::TimedCoder;
-use replay::{seq_of, ReplayWindow};
-use seal::{seal_wire_slice, SealJob, SealLane, TWO_LANE_MIN_PACKETS};
+/// Seal a run of pre-written wire buffers in place: buffer `i` is `seq(8) ‖ plaintext ‖ tag
+/// scratch` and seals over `[8..]` with sequence `seq_base + i` — the exact per-packet layout
+/// and nonce order of the fused single-lane path. Shared by both lanes.
+fn seal_wire_slice(c: &SessionCrypto, wires: &mut [Vec<u8>], seq_base: u64) -> Result<()> {
+    for (i, wire) in wires.iter_mut().enumerate() {
+        c.seal_in_place(seq_base.wrapping_add(i as u64), &mut wire[8..])?;
+    }
+    Ok(())
+}
+
+/// Accumulated client receive-path stage timings since the last [`Session::take_pump_perf`].
+/// Answers "where does the pump core go" at line rate: kernel drain (`recv_ns`) vs AES-GCM
+/// (`decrypt_ns`) vs reassembly+FEC (`reasm_ns`, the `Reassembler::push` round-trip including
+/// shard copies and block reconstruction). 2026-07-14 sweep context: the pump pegs one core at
+/// ~1.5 Gbps wire, ~85% of it userspace — this split is what Phase 2.1 (pooled reassembly) is
+/// validated against.
+#[derive(Debug, Default, Clone, Copy)]
+pub struct PumpPerf {
+    /// ns inside `recv_batch` (recvmmsg / recvmsg_x), i.e. syscall + kernel copy.
+    pub recv_ns: u64,
+    /// ns inside `open_in_place` across all datagrams (AES-128-GCM + replay-window upkeep).
+    pub decrypt_ns: u64,
+    /// ns inside `Reassembler::push` (header parse, shard copy, FEC reconstruct, AU assembly).
+    pub reasm_ns: u64,
+    /// recv_batch calls (batches) and datagrams processed over the accumulation window.
+    pub batches: u64,
+    pub packets: u64,
+}
+
+/// Accumulated host send-path stage timings since the last [`Session::take_seal_perf`] (plan
+/// Phase 0.4, host half). Answers "where does the send thread go" at rate: FEC parity
+/// generation (`fec_ns`, inside [`ErasureCoder::encode_into`]) vs AES-GCM (`seal_ns`,
+/// per-packet `seal_in_place`) vs the socket handoff (`sock_ns` — `send_gso`/`sendmmsg`
+/// syscalls; the internal submit paths time it here, the paced video path folds its chunk
+/// sends in via [`Session::note_sock_ns`]). The Phase 1.5 gate reads off this split: build
+/// two-lane seal only if `seal_ns` exceeds ~15% of the send thread at 2 Gbps.
+#[derive(Debug, Default, Clone, Copy)]
+pub struct SealPerf {
+    /// ns inside `ErasureCoder::encode_into` (parity generation).
+    pub fec_ns: u64,
+    /// ns inside `seal_in_place` across all wire packets (AES-128-GCM).
+    pub seal_ns: u64,
+    /// ns inside `send_sealed` (socket syscalls), where the session can see it.
+    pub sock_ns: u64,
+    /// Frames sealed and wire packets sealed over the accumulation window.
+    pub frames: u64,
+    pub packets: u64,
+}
+
+/// [`ErasureCoder`] shim accumulating the time spent in `encode_into` (the send-path FEC
+/// stage) — only constructed when `PUNKTFUNK_PERF` armed the session's [`SealPerf`]. The
+/// counter is atomic purely to satisfy the trait's `Sync` bound; it lives on one thread.
+struct TimedCoder<'a> {
+    inner: &'a dyn ErasureCoder,
+    ns: &'a std::sync::atomic::AtomicU64,
+}
+
+impl ErasureCoder for TimedCoder<'_> {
+    fn scheme(&self) -> crate::config::FecScheme {
+        self.inner.scheme()
+    }
+    fn encode(
+        &self,
+        data: &[&[u8]],
+        recovery_count: usize,
+    ) -> std::result::Result<Vec<Vec<u8>>, crate::fec::FecError> {
+        self.inner.encode(data, recovery_count)
+    }
+    fn encode_into(
+        &self,
+        data: &[&[u8]],
+        recovery_count: usize,
+        out: &mut Vec<Vec<u8>>,
+    ) -> std::result::Result<(), crate::fec::FecError> {
+        let t0 = std::time::Instant::now();
+        let r = self.inner.encode_into(data, recovery_count, out);
+        self.ns.fetch_add(
+            t0.elapsed().as_nanos() as u64,
+            std::sync::atomic::Ordering::Relaxed,
+        );
+        r
+    }
+    fn reconstruct(
+        &self,
+        data_count: usize,
+        recovery_count: usize,
+        received: &mut [Option<Vec<u8>>],
+    ) -> std::result::Result<Vec<Vec<u8>>, crate::fec::FecError> {
+        self.inner.reconstruct(data_count, recovery_count, received)
+    }
+    fn reconstruct_into(
+        &self,
+        recovery_count: usize,
+        data: &mut [&mut [u8]],
+        have: &[bool],
+        recovery: &[(usize, &[u8])],
+    ) -> std::result::Result<(), crate::fec::FecError> {
+        self.inner
+            .reconstruct_into(recovery_count, data, have, recovery)
+    }
+}
 
 /// Datagrams drained per `recvmmsg` syscall on the client (the reused ring's size). 128 keeps
 /// the syscall rate ≤ ~3.4k/s even at the ~430k pkt/s the post-2026-07-14 receive path delivers
@@ -276,68 +399,6 @@ impl Session {
         pts_ns: u64,
         user_flags: u32,
         frame_index: Option<u32>,
-    ) -> Result<Vec<Vec<u8>>> {
-        self.seal_run(true, |p, coder, emit| {
-            p.packetize_each(data, pts_ns, user_flags, frame_index, coder, emit)
-        })
-    }
-
-    /// Host: open a **streamed** access unit ([`crate::quic::VIDEO_CAP_STREAMED_AU`] — only
-    /// toward a client that advertised it; anyone else must get the whole-AU
-    /// [`seal_frame_at`](Self::seal_frame_at) path). The AU's bytes are fed in with
-    /// [`seal_streamed_chunk`](Self::seal_streamed_chunk) as the encoder produces them and
-    /// closed with [`seal_streamed_finish`](Self::seal_streamed_finish); the three calls'
-    /// returned wire batches are ONE frame, and the nonce order is emission order across the
-    /// calls — send each batch as it is returned, before sealing the next.
-    pub fn begin_streamed_frame_at(
-        &mut self,
-        pts_ns: u64,
-        user_flags: u32,
-        frame_index: u32,
-    ) -> Result<StreamedAu> {
-        if self.config.role != Role::Host {
-            return Err(PunktfunkError::InvalidArg(
-                "seal_frame called on a client session",
-            ));
-        }
-        Ok(self
-            .packetizer
-            .begin_streamed(pts_ns, user_flags, Some(frame_index)))
-    }
-
-    /// Feed one encoder chunk into a streamed AU, sealing every FEC block it completes under
-    /// sentinel headers (see [`begin_streamed_frame_at`](Self::begin_streamed_frame_at)). The
-    /// returned batch is often EMPTY (the chunk is buffered until a block fills) — that's
-    /// normal, not an error.
-    pub fn seal_streamed_chunk(
-        &mut self,
-        au: &mut StreamedAu,
-        chunk: &[u8],
-    ) -> Result<Vec<Vec<u8>>> {
-        self.seal_run(false, |p, coder, emit| {
-            p.push_streamed(au, chunk, coder, emit)
-        })
-    }
-
-    /// Close a streamed AU: seal the final block with the real totals (+ `FLAG_EOF`), which
-    /// retro-validate the frame at the receiver. Counts the frame as submitted.
-    pub fn seal_streamed_finish(&mut self, au: StreamedAu) -> Result<Vec<Vec<u8>>> {
-        self.seal_run(true, |p, coder, emit| p.finish_streamed(au, coder, emit))
-    }
-
-    /// The shared packetize → pooled-wire → seal machinery behind [`seal_frame`](Self::seal_frame)
-    /// and the streamed sealers: `run` drives the packetizer against an emit sink that writes
-    /// each packet's plaintext at its final wire offset; the seal pass (two-lane for large runs)
-    /// then encrypts in place. `count_frame` gates the per-frame stats — a streamed AU counts
-    /// once, at its finish call.
-    fn seal_run(
-        &mut self,
-        count_frame: bool,
-        run: impl FnOnce(
-            &mut Packetizer,
-            &dyn ErasureCoder,
-            &mut dyn FnMut(&PacketHeader, &[u8]) -> Result<()>,
-        ) -> Result<()>,
     ) -> Result<Vec<Vec<u8>>> {
         if self.config.role != Role::Host {
             return Err(PunktfunkError::InvalidArg(
@@ -384,10 +445,10 @@ impl Session {
         // sealing itself is a separate pass so it can split across lanes.
         let seq_base = *next_seq;
         let encrypting = crypto.is_some();
-        let result = {
+        let result = packetizer.packetize_each(data, pts_ns, user_flags, frame_index, coder_ref, {
             let wires = &mut wires;
             let used = &mut used;
-            let mut emit = move |hdr: &PacketHeader, body: &[u8]| -> Result<()> {
+            move |hdr, body| {
                 if *used == wires.len() {
                     wires.push(Vec::new());
                 }
@@ -406,9 +467,8 @@ impl Session {
                     wire.extend_from_slice(body);
                 }
                 Ok(())
-            };
-            run(packetizer, coder_ref, &mut emit)
-        };
+            }
+        });
         result?;
         // A smaller frame uses fewer buffers than the pool holds: drop the unused tail, same
         // as the previous `resize_with(packets.len(), ..)` did. (Before the seal phase, so a
@@ -423,10 +483,7 @@ impl Session {
             }
             let mut split_done = false;
             if two_lane && used >= TWO_LANE_MIN_PACKETS {
-                // Take the lane for the frame: a healthy round-trip puts it back; either
-                // failure arm drops the corpse so the next large frame respawns a fresh one
-                // instead of retrying a dead channel forever.
-                if let Some(lane) = seal_lane.take() {
+                if let Some(lane) = seal_lane.as_ref() {
                     let half = used / 2;
                     let mut tail = std::mem::take(lane_scratch);
                     tail.extend(wires.drain(half..));
@@ -437,42 +494,26 @@ impl Session {
                         ns: 0,
                         result: Ok(()),
                     };
-                    match lane.to_worker.send(job) {
-                        Ok(()) => {
-                            // Seal the front half while the worker runs; collect BOTH results
-                            // before erroring so the lane is always drained and reusable.
-                            let t0 = perf_armed.then(std::time::Instant::now);
-                            let front = seal_wire_slice(c, &mut wires, seq_base);
-                            if let Some(t0) = t0 {
-                                seal_ns += t0.elapsed().as_nanos() as u64;
-                            }
-                            match lane.from_worker.recv() {
-                                Ok(mut done) => {
-                                    *seal_lane = Some(lane);
-                                    seal_ns += done.ns;
-                                    wires.append(&mut done.bufs);
-                                    *lane_scratch = done.bufs;
-                                    front?;
-                                    done.result?;
-                                    split_done = true;
-                                }
-                                Err(_) => {
-                                    // The worker died holding the back half — the frame is
-                                    // unrecoverable (its packets are gone), but the error now
-                                    // SURFACES instead of `Ok` with half an access unit.
-                                    front?;
-                                    return Err(PunktfunkError::Unsupported("seal lane died"));
-                                }
-                            }
-                        }
-                        Err(std::sync::mpsc::SendError(job)) => {
-                            // The worker is gone but the channel hands the job back: reclaim
-                            // the back half so the single-lane pass below seals the WHOLE
-                            // frame — previously this fall-through sealed and returned only
-                            // the front half, silently, as `Ok`.
-                            wires.extend(job.bufs);
+                    if lane.to_worker.send(job).is_ok() {
+                        // Seal the front half while the worker runs; collect BOTH results
+                        // before erroring so the lane is always drained and reusable.
+                        let t0 = perf_armed.then(std::time::Instant::now);
+                        let front = seal_wire_slice(c, &mut wires, seq_base);
+                        if let Some(t0) = t0 {
+                            seal_ns += t0.elapsed().as_nanos() as u64;
                         }
+                        let mut done = lane
+                            .from_worker
+                            .recv()
+                            .map_err(|_| PunktfunkError::Unsupported("seal lane died"))?;
+                        seal_ns += done.ns;
+                        wires.append(&mut done.bufs);
+                        *lane_scratch = done.bufs;
+                        front?;
+                        done.result?;
+                        split_done = true;
                     }
+                    // A failed send means the worker is gone — fall through to single-lane.
                 }
             }
             if !split_done {
@@ -486,12 +527,10 @@ impl Session {
         if let Some(p) = self.seal_perf.as_mut() {
             p.fec_ns += fec_ns.load(std::sync::atomic::Ordering::Relaxed);
             p.seal_ns += seal_ns;
-            p.frames += count_frame as u64;
+            p.frames += 1;
             p.packets += used as u64;
         }
-        if count_frame {
-            StatsCounters::add(&self.stats.frames_submitted, 1);
-        }
+        StatsCounters::add(&self.stats.frames_submitted, 1);
         let bytes: u64 = wires.iter().map(|w| w.len() as u64).sum();
         StatsCounters::add(&self.stats.packets_sent, wires.len() as u64);
         StatsCounters::add(&self.stats.bytes_sent, bytes);
@@ -645,7 +684,7 @@ impl Session {
                     // Nothing new on the wire — hand over an aged-out partial if one is
                     // waiting (it can only get staler).
                     if let Some(p) = self.reassembler.take_partial() {
-                        return Ok(stamp_received(p));
+                        return Ok(p);
                     }
                     return Err(PunktfunkError::NoFrame);
                 }
@@ -709,12 +748,12 @@ impl Session {
             }
             if let Some(frame) = pushed {
                 StatsCounters::add(&self.stats.frames_completed, 1);
-                return Ok(stamp_received(frame));
+                return Ok(frame);
             }
             // A push that completed nothing may still have aged a partial out — deliver it
             // ahead of further draining (its successors are already arriving).
             if let Some(p) = self.reassembler.take_partial() {
-                return Ok(stamp_received(p));
+                return Ok(p);
             }
         }
     }
@@ -777,6 +816,102 @@ impl Session {
     }
 }
 
+/// Extract the AEAD-authenticated 8-byte big-endian sequence prefix from a sealed wire datagram.
+/// Only called on the encrypted receive path, where a preceding successful open has already
+/// established `wire.len() >= 8`.
+fn seq_of(wire: &[u8]) -> u64 {
+    u64::from_be_bytes(wire[..8].try_into().unwrap())
+}
+
+/// Depth of the anti-replay window, in sequences. The sender advances its sequence once per
+/// datagram, so this must cover the reassembler's 120 ms loss window
+/// ([`LOSS_WINDOW_NS`](crate::packet)) at line-rate packet rates — otherwise the replay filter
+/// silently re-tightens the "late ≠ lost" fix: a Wi-Fi-retry-delayed shard the reassembler would
+/// still use gets dropped here as "older than the window" first (4096 was only ~33 ms at the
+/// ~125k pkt/s of a 1 Gbps stream; 32768 topped out around ~2 Gbps — which the client now
+/// exceeds: the 2026-07-14 zero-copy + hardware-AES work measured ~4.8 Gbps wire ≈ 430k pkt/s
+/// delivered). 131072 covers 120 ms up to ~1.09M pkt/s (≈12 Gbps wire) and is effectively
+/// unbounded for the sparse input stream, while still bounding how far back a replay could
+/// hide; the bitmap costs 16 KiB per session.
+const REPLAY_WINDOW: u64 = 131072;
+const REPLAY_WORDS: usize = (REPLAY_WINDOW / 64) as usize;
+
+/// Sliding-window anti-replay filter over the AEAD-authenticated wire sequence. The sender counts
+/// its datagrams from 0, and the protocol never legitimately re-sends a sequence (FEC recovery
+/// shards get fresh ones), so a sequence seen twice is a replay. The AEAD tag already authenticates
+/// the sequence — a forged one can't open — so this only has to reject *duplicates* of validly
+/// sealed datagrams (and anything older than the window, which we can no longer prove is fresh).
+/// Genuine reordering within the window is accepted. Bitmap-per-sequence, indexed `seq % WINDOW`.
+struct ReplayWindow {
+    /// Highest sequence accepted so far; `seen` stays false until the first datagram.
+    highest: u64,
+    seen: bool,
+    /// One bit per in-window sequence in `(highest - WINDOW, highest]`.
+    bits: [u64; REPLAY_WORDS],
+}
+
+impl ReplayWindow {
+    fn new() -> ReplayWindow {
+        ReplayWindow {
+            highest: 0,
+            seen: false,
+            bits: [0; REPLAY_WORDS],
+        }
+    }
+
+    #[inline]
+    fn word_bit(seq: u64) -> (usize, u64) {
+        let idx = (seq % REPLAY_WINDOW) as usize;
+        (idx / 64, 1u64 << (idx % 64))
+    }
+    fn is_set(&self, seq: u64) -> bool {
+        let (w, b) = Self::word_bit(seq);
+        self.bits[w] & b != 0
+    }
+    fn set(&mut self, seq: u64) {
+        let (w, b) = Self::word_bit(seq);
+        self.bits[w] |= b;
+    }
+    fn unset(&mut self, seq: u64) {
+        let (w, b) = Self::word_bit(seq);
+        self.bits[w] &= !b;
+    }
+
+    /// Record `seq`, returning `true` if it's fresh (accept) or `false` if it's a replay / too old.
+    fn accept(&mut self, seq: u64) -> bool {
+        if !self.seen {
+            self.seen = true;
+            self.highest = seq;
+            self.set(seq);
+            return true;
+        }
+        if seq > self.highest {
+            // Advance the window. Sequences between the old and new high slide in unseen, so clear
+            // their (possibly stale, from a full window ago) slots — unless we jumped an entire
+            // window, in which case wipe the bitmap wholesale.
+            if seq - self.highest >= REPLAY_WINDOW {
+                self.bits = [0; REPLAY_WORDS];
+            } else {
+                let mut s = self.highest + 1;
+                while s < seq {
+                    self.unset(s);
+                    s += 1;
+                }
+            }
+            self.highest = seq;
+            self.set(seq);
+            true
+        } else if self.highest - seq >= REPLAY_WINDOW || self.is_set(seq) {
+            // Older than the window (can't prove it isn't a replay) or already seen (a duplicate) —
+            // either way, drop it.
+            false
+        } else {
+            self.set(seq); // in-window and not yet seen — a genuine reorder
+            true
+        }
+    }
+}
+
 #[cfg(test)]
 mod wire_equivalence_tests {
     use super::*;
@@ -876,42 +1011,6 @@ mod wire_equivalence_tests {
         (0..len).map(|i| (i * 31 + 7) as u8).collect()
     }
 
-    /// A dead seal lane (worker gone, channels dangling) must degrade to a single-lane seal of
-    /// the WHOLE frame — the old fall-through sealed and returned only the front half as `Ok` —
-    /// and the corpse must be dropped so the next large frame respawns a fresh lane.
-    #[test]
-    fn dead_seal_lane_falls_back_to_single_lane_whole_frame() {
-        let mut opt = host_session(host_cfg(FecScheme::Gf16, 20, true));
-        let mut refr = host_session(host_cfg(FecScheme::Gf16, 20, true));
-        // A lane whose worker has already exited: both far ends dropped, so `send` fails
-        // immediately and hands the job (with the frame's back half) back.
-        let (to_worker, jobs) = std::sync::mpsc::sync_channel::<SealJob>(1);
-        let (done_tx, from_worker) = std::sync::mpsc::sync_channel::<SealJob>(1);
-        drop(jobs);
-        drop(done_tx);
-        opt.seal_lane = Some(SealLane {
-            to_worker,
-            from_worker,
-        });
-        let frame = pattern(20000); // > TWO_LANE_MIN_PACKETS wire packets → takes the split path
-        let got = opt.seal_frame(&frame, 7, 0).unwrap();
-        let want = seal_via_wrapper(&mut refr, &frame, 7, 0);
-        assert_eq!(got, want, "fallback must seal the whole frame, not half");
-        assert!(
-            opt.seal_lane.is_none(),
-            "the dead lane must be dropped, not retried forever"
-        );
-        // The next large frame respawns a fresh, working lane.
-        opt.reclaim_wires(got);
-        let got2 = opt.seal_frame(&frame, 8, 1).unwrap();
-        let want2 = seal_via_wrapper(&mut refr, &frame, 8, 1);
-        assert_eq!(got2, want2);
-        assert!(
-            opt.seal_lane.is_some(),
-            "a fresh lane respawns on the next large frame"
-        );
-    }
-
     /// Partial delivery (plan §4.4): a chunk-aligned frame that loses shards past FEC's
     /// reach is DELIVERED once it ages out — `complete: false`, received shards at their
     /// exact offsets, missing ranges zero-filled — instead of silently dropping. Plain
@@ -1007,3 +1106,78 @@ mod wire_equivalence_tests {
         );
     }
 }
+
+#[cfg(test)]
+mod replay_tests {
+    use super::*;
+
+    #[test]
+    fn accepts_in_order_and_rejects_duplicates() {
+        let mut w = ReplayWindow::new();
+        for seq in 0..1000 {
+            assert!(w.accept(seq), "fresh in-order seq {seq} must be accepted");
+        }
+        // Every one of those is now a replay.
+        for seq in 0..1000 {
+            assert!(!w.accept(seq), "replayed seq {seq} must be rejected");
+        }
+    }
+
+    #[test]
+    fn accepts_reorder_within_window_once() {
+        let mut w = ReplayWindow::new();
+        assert!(w.accept(100));
+        // Earlier-but-in-window sequences (a genuine reorder) are accepted exactly once.
+        assert!(w.accept(80));
+        assert!(!w.accept(80), "second copy of a reordered seq is a replay");
+        assert!(w.accept(99));
+        assert!(
+            !w.accept(100),
+            "the high-water seq itself can't be replayed"
+        );
+    }
+
+    #[test]
+    fn rejects_older_than_window() {
+        let mut w = ReplayWindow::new();
+        assert!(w.accept(REPLAY_WINDOW * 2));
+        // Anything a full window or more behind the high-water mark is dropped (can't prove fresh).
+        assert!(!w.accept(REPLAY_WINDOW * 2 - REPLAY_WINDOW));
+        assert!(!w.accept(0));
+        // But just inside the window is still accepted.
+        assert!(w.accept(REPLAY_WINDOW * 2 - (REPLAY_WINDOW - 1)));
+    }
+
+    #[test]
+    fn large_forward_jump_wipes_stale_bits() {
+        let mut w = ReplayWindow::new();
+        assert!(w.accept(5));
+        // Jump far forward (more than a window). The slot for an old seq that aliases 5 mod WINDOW
+        // must read as unseen afterward, i.e. the jump cleared it — so a NEW seq there is accepted.
+        let far = 10 * REPLAY_WINDOW + 5;
+        assert!(w.accept(far));
+        assert!(
+            !w.accept(5),
+            "the pre-jump seq is now far older than the window"
+        );
+        // A fresh seq aliasing 5 (mod WINDOW) but inside the new window is accepted, proving the
+        // stale bit was cleared rather than mistaken for a replay.
+        assert!(w.accept(far - REPLAY_WINDOW + 1));
+    }
+
+    #[test]
+    fn first_seq_need_not_be_zero() {
+        // Startup loss can mean the first datagram we ever open isn't seq 0.
+        let mut w = ReplayWindow::new();
+        assert!(w.accept(42));
+        assert!(!w.accept(42));
+        assert!(w.accept(43));
+    }
+
+    #[test]
+    fn seq_of_reads_the_big_endian_prefix() {
+        let mut wire = 0x0102_0304_0506_0708u64.to_be_bytes().to_vec();
+        wire.extend_from_slice(b"ciphertext-and-tag");
+        assert_eq!(seq_of(&wire), 0x0102_0304_0506_0708);
+    }
+}

crates/punktfunk-core/src/session/perf.rs

@@ -1,98 +0,0 @@
-//! `PUNKTFUNK_PERF` stage-timing telemetry for the two hot paths: where the client pump
-//! and the host send thread actually spend their time, accumulated per report window and
-//! drained via [`Session::take_pump_perf`](super::Session::take_pump_perf) /
-//! [`Session::take_seal_perf`](super::Session::take_seal_perf).
-
-use crate::fec::ErasureCoder;
-
-/// Accumulated client receive-path stage timings since the last [`Session::take_pump_perf`](super::Session::take_pump_perf).
-/// Answers "where does the pump core go" at line rate: kernel drain (`recv_ns`) vs AES-GCM
-/// (`decrypt_ns`) vs reassembly+FEC (`reasm_ns`, the `Reassembler::push` round-trip including
-/// shard copies and block reconstruction). 2026-07-14 sweep context: the pump pegs one core at
-/// ~1.5 Gbps wire, ~85% of it userspace — this split is what Phase 2.1 (pooled reassembly) is
-/// validated against.
-#[derive(Debug, Default, Clone, Copy)]
-pub struct PumpPerf {
-    /// ns inside `recv_batch` (recvmmsg / recvmsg_x), i.e. syscall + kernel copy.
-    pub recv_ns: u64,
-    /// ns inside `open_in_place` across all datagrams (AES-128-GCM + replay-window upkeep).
-    pub decrypt_ns: u64,
-    /// ns inside `Reassembler::push` (header parse, shard copy, FEC reconstruct, AU assembly).
-    pub reasm_ns: u64,
-    /// recv_batch calls (batches) and datagrams processed over the accumulation window.
-    pub batches: u64,
-    pub packets: u64,
-}
-
-/// Accumulated host send-path stage timings since the last [`Session::take_seal_perf`](super::Session::take_seal_perf) (plan
-/// Phase 0.4, host half). Answers "where does the send thread go" at rate: FEC parity
-/// generation (`fec_ns`, inside [`ErasureCoder::encode_into`]) vs AES-GCM (`seal_ns`,
-/// per-packet `seal_in_place`) vs the socket handoff (`sock_ns` — `send_gso`/`sendmmsg`
-/// syscalls; the internal submit paths time it here, the paced video path folds its chunk
-/// sends in via [`Session::note_sock_ns`](super::Session::note_sock_ns)). The Phase 1.5 gate reads off this split: build
-/// two-lane seal only if `seal_ns` exceeds ~15% of the send thread at 2 Gbps.
-#[derive(Debug, Default, Clone, Copy)]
-pub struct SealPerf {
-    /// ns inside `ErasureCoder::encode_into` (parity generation).
-    pub fec_ns: u64,
-    /// ns inside `seal_in_place` across all wire packets (AES-128-GCM).
-    pub seal_ns: u64,
-    /// ns inside `send_sealed` (socket syscalls), where the session can see it.
-    pub sock_ns: u64,
-    /// Frames sealed and wire packets sealed over the accumulation window.
-    pub frames: u64,
-    pub packets: u64,
-}
-
-/// [`ErasureCoder`] shim accumulating the time spent in `encode_into` (the send-path FEC
-/// stage) — only constructed when `PUNKTFUNK_PERF` armed the session's [`SealPerf`]. The
-/// counter is atomic purely to satisfy the trait's `Sync` bound; it lives on one thread.
-pub(super) struct TimedCoder<'a> {
-    pub(super) inner: &'a dyn ErasureCoder,
-    pub(super) ns: &'a std::sync::atomic::AtomicU64,
-}
-
-impl ErasureCoder for TimedCoder<'_> {
-    fn scheme(&self) -> crate::config::FecScheme {
-        self.inner.scheme()
-    }
-    fn encode(
-        &self,
-        data: &[&[u8]],
-        recovery_count: usize,
-    ) -> std::result::Result<Vec<Vec<u8>>, crate::fec::FecError> {
-        self.inner.encode(data, recovery_count)
-    }
-    fn encode_into(
-        &self,
-        data: &[&[u8]],
-        recovery_count: usize,
-        out: &mut Vec<Vec<u8>>,
-    ) -> std::result::Result<(), crate::fec::FecError> {
-        let t0 = std::time::Instant::now();
-        let r = self.inner.encode_into(data, recovery_count, out);
-        self.ns.fetch_add(
-            t0.elapsed().as_nanos() as u64,
-            std::sync::atomic::Ordering::Relaxed,
-        );
-        r
-    }
-    fn reconstruct(
-        &self,
-        data_count: usize,
-        recovery_count: usize,
-        received: &mut [Option<Vec<u8>>],
-    ) -> std::result::Result<Vec<Vec<u8>>, crate::fec::FecError> {
-        self.inner.reconstruct(data_count, recovery_count, received)
-    }
-    fn reconstruct_into(
-        &self,
-        recovery_count: usize,
-        data: &mut [&mut [u8]],
-        have: &[bool],
-        recovery: &[(usize, &[u8])],
-    ) -> std::result::Result<(), crate::fec::FecError> {
-        self.inner
-            .reconstruct_into(recovery_count, data, have, recovery)
-    }
-}

crates/punktfunk-core/src/session/replay.rs

@@ -1,175 +0,0 @@
-//! Sliding-window anti-replay filter over the AEAD-authenticated wire sequence
-//! (plan §1). Applied on both encrypted receive paths —
-//! [`Session::poll_frame`](super::Session::poll_frame) and
-//! [`Session::poll_input`](super::Session::poll_input).
-
-/// Extract the AEAD-authenticated 8-byte big-endian sequence prefix from a sealed wire datagram.
-/// Only called on the encrypted receive path, where a preceding successful open has already
-/// established `wire.len() >= 8`.
-pub(super) fn seq_of(wire: &[u8]) -> u64 {
-    u64::from_be_bytes(wire[..8].try_into().unwrap())
-}
-
-/// Depth of the anti-replay window, in sequences. The sender advances its sequence once per
-/// datagram, so this must cover the reassembler's 120 ms loss window
-/// ([`LOSS_WINDOW_NS`](crate::packet)) at line-rate packet rates — otherwise the replay filter
-/// silently re-tightens the "late ≠ lost" fix: a Wi-Fi-retry-delayed shard the reassembler would
-/// still use gets dropped here as "older than the window" first (4096 was only ~33 ms at the
-/// ~125k pkt/s of a 1 Gbps stream; 32768 topped out around ~2 Gbps — which the client now
-/// exceeds: the 2026-07-14 zero-copy + hardware-AES work measured ~4.8 Gbps wire ≈ 430k pkt/s
-/// delivered). 131072 covers 120 ms up to ~1.09M pkt/s (≈12 Gbps wire) and is effectively
-/// unbounded for the sparse input stream, while still bounding how far back a replay could
-/// hide; the bitmap costs 16 KiB per session.
-const REPLAY_WINDOW: u64 = 131072;
-const REPLAY_WORDS: usize = (REPLAY_WINDOW / 64) as usize;
-
-/// Sliding-window anti-replay filter over the AEAD-authenticated wire sequence. The sender counts
-/// its datagrams from 0, and the protocol never legitimately re-sends a sequence (FEC recovery
-/// shards get fresh ones), so a sequence seen twice is a replay. The AEAD tag already authenticates
-/// the sequence — a forged one can't open — so this only has to reject *duplicates* of validly
-/// sealed datagrams (and anything older than the window, which we can no longer prove is fresh).
-/// Genuine reordering within the window is accepted. Bitmap-per-sequence, indexed `seq % WINDOW`.
-pub(super) struct ReplayWindow {
-    /// Highest sequence accepted so far; `seen` stays false until the first datagram.
-    highest: u64,
-    seen: bool,
-    /// One bit per in-window sequence in `(highest - WINDOW, highest]`.
-    bits: [u64; REPLAY_WORDS],
-}
-
-impl ReplayWindow {
-    pub(super) fn new() -> ReplayWindow {
-        ReplayWindow {
-            highest: 0,
-            seen: false,
-            bits: [0; REPLAY_WORDS],
-        }
-    }
-
-    #[inline]
-    fn word_bit(seq: u64) -> (usize, u64) {
-        let idx = (seq % REPLAY_WINDOW) as usize;
-        (idx / 64, 1u64 << (idx % 64))
-    }
-    fn is_set(&self, seq: u64) -> bool {
-        let (w, b) = Self::word_bit(seq);
-        self.bits[w] & b != 0
-    }
-    fn set(&mut self, seq: u64) {
-        let (w, b) = Self::word_bit(seq);
-        self.bits[w] |= b;
-    }
-    fn unset(&mut self, seq: u64) {
-        let (w, b) = Self::word_bit(seq);
-        self.bits[w] &= !b;
-    }
-
-    /// Record `seq`, returning `true` if it's fresh (accept) or `false` if it's a replay / too old.
-    pub(super) fn accept(&mut self, seq: u64) -> bool {
-        if !self.seen {
-            self.seen = true;
-            self.highest = seq;
-            self.set(seq);
-            return true;
-        }
-        if seq > self.highest {
-            // Advance the window. Sequences between the old and new high slide in unseen, so clear
-            // their (possibly stale, from a full window ago) slots — unless we jumped an entire
-            // window, in which case wipe the bitmap wholesale.
-            if seq - self.highest >= REPLAY_WINDOW {
-                self.bits = [0; REPLAY_WORDS];
-            } else {
-                let mut s = self.highest + 1;
-                while s < seq {
-                    self.unset(s);
-                    s += 1;
-                }
-            }
-            self.highest = seq;
-            self.set(seq);
-            true
-        } else if self.highest - seq >= REPLAY_WINDOW || self.is_set(seq) {
-            // Older than the window (can't prove it isn't a replay) or already seen (a duplicate) —
-            // either way, drop it.
-            false
-        } else {
-            self.set(seq); // in-window and not yet seen — a genuine reorder
-            true
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_in_order_and_rejects_duplicates() {
-        let mut w = ReplayWindow::new();
-        for seq in 0..1000 {
-            assert!(w.accept(seq), "fresh in-order seq {seq} must be accepted");
-        }
-        // Every one of those is now a replay.
-        for seq in 0..1000 {
-            assert!(!w.accept(seq), "replayed seq {seq} must be rejected");
-        }
-    }
-
-    #[test]
-    fn accepts_reorder_within_window_once() {
-        let mut w = ReplayWindow::new();
-        assert!(w.accept(100));
-        // Earlier-but-in-window sequences (a genuine reorder) are accepted exactly once.
-        assert!(w.accept(80));
-        assert!(!w.accept(80), "second copy of a reordered seq is a replay");
-        assert!(w.accept(99));
-        assert!(
-            !w.accept(100),
-            "the high-water seq itself can't be replayed"
-        );
-    }
-
-    #[test]
-    fn rejects_older_than_window() {
-        let mut w = ReplayWindow::new();
-        assert!(w.accept(REPLAY_WINDOW * 2));
-        // Anything a full window or more behind the high-water mark is dropped (can't prove fresh).
-        assert!(!w.accept(REPLAY_WINDOW * 2 - REPLAY_WINDOW));
-        assert!(!w.accept(0));
-        // But just inside the window is still accepted.
-        assert!(w.accept(REPLAY_WINDOW * 2 - (REPLAY_WINDOW - 1)));
-    }
-
-    #[test]
-    fn large_forward_jump_wipes_stale_bits() {
-        let mut w = ReplayWindow::new();
-        assert!(w.accept(5));
-        // Jump far forward (more than a window). The slot for an old seq that aliases 5 mod WINDOW
-        // must read as unseen afterward, i.e. the jump cleared it — so a NEW seq there is accepted.
-        let far = 10 * REPLAY_WINDOW + 5;
-        assert!(w.accept(far));
-        assert!(
-            !w.accept(5),
-            "the pre-jump seq is now far older than the window"
-        );
-        // A fresh seq aliasing 5 (mod WINDOW) but inside the new window is accepted, proving the
-        // stale bit was cleared rather than mistaken for a replay.
-        assert!(w.accept(far - REPLAY_WINDOW + 1));
-    }
-
-    #[test]
-    fn first_seq_need_not_be_zero() {
-        // Startup loss can mean the first datagram we ever open isn't seq 0.
-        let mut w = ReplayWindow::new();
-        assert!(w.accept(42));
-        assert!(!w.accept(42));
-        assert!(w.accept(43));
-    }
-
-    #[test]
-    fn seq_of_reads_the_big_endian_prefix() {
-        let mut wire = 0x0102_0304_0506_0708u64.to_be_bytes().to_vec();
-        wire.extend_from_slice(b"ciphertext-and-tag");
-        assert_eq!(seq_of(&wire), 0x0102_0304_0506_0708);
-    }
-}

crates/punktfunk-core/src/session/seal.rs

@@ -1,74 +0,0 @@
-//! The second seal lane (plan Phase 1.5): a persistent worker thread that AES-GCM-seals
-//! the back half of a large frame's wire packets while the send thread seals the front.
-//! [`Session`](super::Session)`::seal_frame_inner` owns the split policy; this module owns
-//! the lane machinery and the shared per-slice seal loop.
-
-use crate::crypto::SessionCrypto;
-use crate::error::Result;
-
-/// Wire-packet count at which a frame's sealing splits across two lanes (plan Phase 1.5):
-/// below it the channel rendezvous (~µs) isn't worth it; at it the halved AES-GCM span
-/// (≥ ~125 µs of ~1 µs/packet work) dwarfs the hand-off. ≈300 KB of wire, i.e. ≥150 Mbps
-/// at 60 fps — small frames and the probe's ~17-packet AUs stay strictly single-lane.
-pub(super) const TWO_LANE_MIN_PACKETS: usize = 256;
-
-/// One two-lane seal hand-off: the frame's back-half wire buffers, sealed by the worker with
-/// nonces `seq_base + i` (the nonce order is deterministic per shard index, which is what
-/// makes the split sound). Round-trips through the channels so the buffers return to the pool.
-pub(super) struct SealJob {
-    pub(super) bufs: Vec<Vec<u8>>,
-    pub(super) seq_base: u64,
-    pub(super) timed: bool,
-    /// Worker-lane CPU ns (when `timed`) and the seal outcome, filled in by the worker.
-    pub(super) ns: u64,
-    pub(super) result: Result<()>,
-}
-
-/// The persistent second seal lane: a worker thread that AES-GCM-seals the back half of a
-/// large frame's packets while the send thread seals the front half. Rendezvous channels
-/// (bound 1) — the send thread submits, seals its half, then waits; no per-frame spawn.
-/// Dropping the struct closes the channel and the worker exits.
-pub(super) struct SealLane {
-    pub(super) to_worker: std::sync::mpsc::SyncSender<SealJob>,
-    pub(super) from_worker: std::sync::mpsc::Receiver<SealJob>,
-}
-
-impl SealLane {
-    pub(super) fn spawn(crypto: std::sync::Arc<SessionCrypto>) -> Option<SealLane> {
-        let (to_worker, jobs) = std::sync::mpsc::sync_channel::<SealJob>(1);
-        let (done_tx, from_worker) = std::sync::mpsc::sync_channel::<SealJob>(1);
-        std::thread::Builder::new()
-            .name("punktfunk-seal2".into())
-            .spawn(move || {
-                while let Ok(mut job) = jobs.recv() {
-                    let t0 = job.timed.then(std::time::Instant::now);
-                    job.result = seal_wire_slice(&crypto, &mut job.bufs, job.seq_base);
-                    if let Some(t0) = t0 {
-                        job.ns = t0.elapsed().as_nanos() as u64;
-                    }
-                    if done_tx.send(job).is_err() {
-                        break; // session gone mid-frame — nothing left to seal for
-                    }
-                }
-            })
-            .ok()?;
-        Some(SealLane {
-            to_worker,
-            from_worker,
-        })
-    }
-}
-
-/// Seal a run of pre-written wire buffers in place: buffer `i` is `seq(8) ‖ plaintext ‖ tag
-/// scratch` and seals over `[8..]` with sequence `seq_base + i` — the exact per-packet layout
-/// and nonce order of the fused single-lane path. Shared by both lanes.
-pub(super) fn seal_wire_slice(
-    c: &SessionCrypto,
-    wires: &mut [Vec<u8>],
-    seq_base: u64,
-) -> Result<()> {
-    for (i, wire) in wires.iter_mut().enumerate() {
-        c.seal_in_place(seq_base.wrapping_add(i as u64), &mut wire[8..])?;
-    }
-    Ok(())
-}

crates/punktfunk-core/src/transport/udp/linux.rs

@@ -198,14 +198,8 @@ pub(super) fn send_gso(t: &UdpTransport, packets: &[&[u8]]) -> std::io::Result<u
         return send_batch(t, packets);
     }
     let fd = t.socket.as_raw_fd();
-    // A GSO super-buffer is capped at 64 segments AND, in bytes, by the kernel's UDP payload
-    // ceiling. 65535 is the IP-datagram cap — the payload is that minus the IP + UDP headers
-    // the cork accounts for (IPv4: 65507, IPv6: 65487). Use the tighter v6 figure: it costs at
-    // most one segment per train, while a super-buffer over the ceiling is bounced with
-    // EMSGSIZE — which gso_unsupported() reads as "no GSO on this path" and latches GSO off
-    // process-wide, silently forfeiting the multi-Gbps lever over a local arithmetic slip.
-    const GSO_MAX_PAYLOAD: usize = 65535 - 40 - 8;
-    let max_seg = (GSO_MAX_PAYLOAD / seg).clamp(1, 64);
+    // A GSO super-buffer is capped at 64 segments AND 65535 payload bytes (kernel limits).
+    let max_seg = (65535 / seg).clamp(1, 64);
     let mut scratch: Vec<u8> = Vec::with_capacity(seg * max_seg);
     let mut sent = 0usize;
     for chunk in packets.chunks(max_seg) {

crates/punktfunk-core/src/transport/udp/mod.rs

@@ -110,18 +110,8 @@ pub fn spawn_data_punch(sock: UdpSocket, stop: std::sync::Arc<std::sync::atomic:
         .spawn(move || {
             let mut i = 0u32;
             while !stop.load(std::sync::atomic::Ordering::Relaxed) {
-                match sock.send(PUNCH_MAGIC) {
-                    Ok(_) => {}
-                    // Same contract as `Transport::send`: a momentarily full tx queue, a stale
-                    // ICMP or a network-path blip is a lossy drop, not a reason to stop holding
-                    // the NAT/firewall path open. Breaking here is silent and permanent — the
-                    // path recovers, video keeps flowing, and the stream dies later when the
-                    // idle timer expires the mapping during a static scene.
-                    Err(e) if is_transient_io(&e) => {}
-                    Err(e) => {
-                        tracing::debug!(error = %e, "data-plane punch send failed — stopping keepalive");
-                        break;
-                    }
+                if sock.send(PUNCH_MAGIC).is_err() {
+                    break;
                 }
                 let delay_ms = if i < 15 { 200 } else { 2000 };
                 i = i.saturating_add(1);
@@ -170,65 +160,34 @@ impl UdpTransport {
     /// NAT-translated one, which can differ from the client-reported `fallback_peer`). If no punch
     /// arrives (a client that doesn't hole-punch), fall back to `fallback_peer` — the same flat-LAN
     /// behaviour as [`connect`](Self::connect). Returns `(transport, punched)`.
-    ///
-    /// `expect_ip` is the *authenticated* peer address (the QUIC connection's remote IP) — see
-    /// [`from_socket_punch`](Self::from_socket_punch) for why only punches from it are honoured.
     pub fn connect_via_punch(
         local: &str,
         fallback_peer: &str,
-        expect_ip: std::net::IpAddr,
         punch_timeout: std::time::Duration,
     ) -> std::io::Result<(Self, bool)> {
-        Self::from_socket_punch(
-            UdpSocket::bind(local)?,
-            fallback_peer,
-            expect_ip,
-            punch_timeout,
-        )
+        Self::from_socket_punch(UdpSocket::bind(local)?, fallback_peer, punch_timeout)
     }
 
     /// [`connect_via_punch`](Self::connect_via_punch) on an already-bound socket — see
     /// [`from_socket`](Self::from_socket) for why the host binds the data port up front.
-    ///
-    /// `expect_ip` binds the data plane to the peer the control plane already authenticated.
-    /// [`PUNCH_MAGIC`] is a fixed public constant carrying no key, nonce or session id, so without
-    /// this check *any* source that lands an 8-byte datagram on the (ephemeral, sprayable) data
-    /// port during the punch wait becomes the video destination — the legitimate client is then
-    /// filtered out by the `connect` below and receives nothing, while QUIC stays healthy so no
-    /// reconnect is triggered. Only the *port* is in question here (that is what a NAT remaps, and
-    /// what the punch exists to discover); the IP is known, because the client binds `0.0.0.0:0`
-    /// and dials the same host IP as its QUIC connection, so the kernel picks the same source IP
-    /// for both planes and any NAT on the path presents one source IP for both.
     pub fn from_socket_punch(
         socket: UdpSocket,
         fallback_peer: &str,
-        expect_ip: std::net::IpAddr,
         punch_timeout: std::time::Duration,
     ) -> std::io::Result<(Self, bool)> {
+        socket.set_read_timeout(Some(punch_timeout))?;
         let deadline = std::time::Instant::now() + punch_timeout;
         let mut buf = [0u8; 64];
         let mut observed: Option<std::net::SocketAddr> = None;
         loop {
-            // Budget the read from what's LEFT, not the full window: off-peer datagrams are
-            // discarded below, and a full-window timeout per read would let a stray flood stretch
-            // the punch wait far past `punch_timeout`.
-            let remaining = deadline.saturating_duration_since(std::time::Instant::now());
-            if remaining.is_zero() {
-                break;
-            }
-            socket.set_read_timeout(Some(remaining))?;
             match socket.recv_from(&mut buf) {
                 Ok((n, src))
-                    if src.ip() == expect_ip
-                        && n >= PUNCH_MAGIC.len()
-                        && &buf[..PUNCH_MAGIC.len()] == PUNCH_MAGIC =>
+                    if n >= PUNCH_MAGIC.len() && &buf[..PUNCH_MAGIC.len()] == PUNCH_MAGIC =>
                 {
                     observed = Some(src);
                     break;
                 }
-                // Stray, or a well-formed punch from someone who isn't the authenticated peer —
-                // keep waiting for a real one.
-                Ok(_) => {}
+                Ok(_) => {} // stray datagram — keep waiting for a real punch
                 Err(e)
                     if matches!(
                         e.kind(),
@@ -239,6 +198,9 @@ impl UdpTransport {
                 }
                 Err(e) => return Err(e),
             }
+            if std::time::Instant::now() >= deadline {
+                break;
+            }
         }
         let punched = observed.is_some();
         let target = observed.map(|s| s.to_string());
@@ -520,89 +482,4 @@ mod tests {
             "every datagram should be drained via recv_batch"
         );
     }
-
-    /// The punch discovers the peer's NAT-remapped *port*, so a punch from the authenticated IP on
-    /// a port that differs from the client-reported one must still be adopted — that is the whole
-    /// reason hole-punching exists, and the source-IP check must not break it.
-    #[test]
-    fn punch_adopts_remapped_port_from_the_authenticated_peer() {
-        // Stands in for the client's post-NAT data socket: same IP as the "QUIC peer", new port.
-        let puncher = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        puncher
-            .set_read_timeout(Some(std::time::Duration::from_millis(500)))
-            .unwrap();
-        // The client-*reported* address, which the NAT remapped — video must NOT go here.
-        let reported = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        reported
-            .set_read_timeout(Some(std::time::Duration::from_millis(200)))
-            .unwrap();
-
-        let host_sock = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        let host_addr = host_sock.local_addr().unwrap();
-        puncher.send_to(PUNCH_MAGIC, host_addr).unwrap();
-
-        let (transport, punched) = UdpTransport::from_socket_punch(
-            host_sock,
-            &reported.local_addr().unwrap().to_string(),
-            std::net::IpAddr::from([127, 0, 0, 1]),
-            std::time::Duration::from_millis(500),
-        )
-        .unwrap();
-        assert!(punched, "a punch from the authenticated IP must be adopted");
-
-        transport.send(b"video").unwrap();
-        let mut buf = [0u8; 64];
-        let n = puncher
-            .recv(&mut buf)
-            .expect("video must follow the punched (NAT-remapped) port");
-        assert_eq!(&buf[..n], b"video");
-        assert!(
-            reported.recv(&mut buf).is_err(),
-            "video must not go to the stale reported port"
-        );
-    }
-
-    /// A punch from any source other than the QUIC-authenticated peer must be ignored: `PUNCH_MAGIC`
-    /// is a fixed public constant with no key or session id, so honouring an off-peer punch lets
-    /// anyone who lands an 8-byte datagram on the ephemeral data port steal (or redirect) the video
-    /// plane while the control plane stays healthy. Falling back to the reported address is correct.
-    #[test]
-    fn punch_from_an_unauthenticated_source_is_ignored() {
-        let attacker = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        attacker
-            .set_read_timeout(Some(std::time::Duration::from_millis(200)))
-            .unwrap();
-        let legit = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        legit
-            .set_read_timeout(Some(std::time::Duration::from_millis(500)))
-            .unwrap();
-
-        let host_sock = std::net::UdpSocket::bind("127.0.0.1:0").unwrap();
-        let host_addr = host_sock.local_addr().unwrap();
-        attacker.send_to(PUNCH_MAGIC, host_addr).unwrap();
-
-        // The authenticated peer is TEST-NET-1, so nothing arriving over loopback is the peer.
-        let (transport, punched) = UdpTransport::from_socket_punch(
-            host_sock,
-            &legit.local_addr().unwrap().to_string(),
-            std::net::IpAddr::from([192, 0, 2, 1]),
-            std::time::Duration::from_millis(300),
-        )
-        .unwrap();
-        assert!(
-            !punched,
-            "an off-peer punch must not be adopted as the video destination"
-        );
-
-        transport.send(b"video").unwrap();
-        let mut buf = [0u8; 64];
-        assert!(
-            attacker.recv(&mut buf).is_err(),
-            "video must never be redirected to the punch source"
-        );
-        let n = legit
-            .recv(&mut buf)
-            .expect("video falls back to the reported peer address");
-        assert_eq!(&buf[..n], b"video");
-    }
 }

crates/punktfunk-core/vendor/fec-rs/src/galois.rs

@@ -187,58 +187,34 @@ pub fn detect_mul_slice() -> (MulSliceFn, MulSliceFn) {
 // Safe wrappers for SIMD functions (used as function pointer targets)
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_gfni_avx2(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_gfni_avx2(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_xor_gfni_avx2(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_xor_gfni_avx2(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_avx2(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_avx2(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_xor_avx2(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_xor_avx2(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_gfni_sse(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_gfni_sse(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_xor_gfni_sse(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_xor_gfni_sse(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_ssse3(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_ssse3(c, input, out) }
 }
 #[cfg(target_arch = "x86_64")]
 fn wrap_mul_slice_xor_ssse3(c: u8, input: &[u8], out: &mut [u8]) {
-    // The unsafe callee bounds every load AND store on input.len(); unequal
-    // lengths would write past `out`. Same invariant mul_slice/mul_slice_xor enforce.
-    assert_eq!(input.len(), out.len());
     unsafe { mul_slice_xor_ssse3(c, input, out) }
 }
 

crates/punktfunk-core/vendor/fec-rs/src/reed_solomon.rs

@@ -624,15 +624,8 @@ impl ReedSolomon {
             for (i_input, &valid_idx) in valid_indices.iter().enumerate() {
                 // SAFETY: valid_idx and missing indices are disjoint sets,
                 // so we can safely read from valid_idx while writing to missing indices.
-                // Pointer AND length from the same `get()` — an impl whose `len()`
-                // disagrees with its slice then panics in `mul_slice` instead of this
-                // fabricating an out-of-bounds slice from the trait-reported length.
-                let (input_ptr, input_len) = {
-                    let input = shards[valid_idx].get().unwrap();
-                    debug_assert_eq!(input.len(), shard_len);
-                    (input.as_ptr(), input.len())
-                };
-                let input_slice = unsafe { std::slice::from_raw_parts(input_ptr, input_len) };
+                let input_ptr = shards[valid_idx].get().unwrap().as_ptr();
+                let input_slice = unsafe { std::slice::from_raw_parts(input_ptr, shard_len) };
 
                 for (i_out, &missing_idx) in missing_data_indices.iter().enumerate() {
                     let c = matrix_rows[i_out][i_input];
@@ -666,13 +659,8 @@ impl ReedSolomon {
 
             for i_input in 0..self.data_shard_count {
                 // SAFETY: data shards (0..data_shard_count) are disjoint from parity shards.
-                // Same discipline as the data-shard loop above: length from the slice.
-                let (input_ptr, input_len) = {
-                    let input = shards[i_input].get().unwrap();
-                    debug_assert_eq!(input.len(), shard_len);
-                    (input.as_ptr(), input.len())
-                };
-                let input_slice = unsafe { std::slice::from_raw_parts(input_ptr, input_len) };
+                let input_ptr = shards[i_input].get().unwrap().as_ptr();
+                let input_slice = unsafe { std::slice::from_raw_parts(input_ptr, shard_len) };
 
                 for (i_out, &missing_idx) in missing_parity_indices.iter().enumerate() {
                     let c = matrix_rows[i_out][i_input];
@@ -714,10 +702,6 @@ impl ReedSolomon {
 /// yield non-overlapping memory regions from `get()`/`get_mut()`. Specifically:
 /// - `get()` on element `i` must not alias `get_mut()` on element `j` when `i != j`.
 /// - The returned slices must remain valid and not be moved/reallocated while borrows are active.
-/// - `len()` must return `Some(n)` exactly when `get()`/`get_mut()` return `Some(s)`, and then
-///   `s.len() == n`; after `initialize(n)`, `get_mut()` must return a slice of length `n`.
-///   `reconstruct_internal` sizes its raw-pointer reads from `len()`, so a disagreement would
-///   otherwise read past the allocation.
 ///
 /// This is required because `reconstruct_internal` uses raw pointers to read from
 /// some shard indices while writing to others simultaneously.

crates/punktfunk-host/Cargo.toml

@@ -110,13 +110,6 @@ serde_json = "1"
 # utoipa into axum 0.8 extractors; utoipa-axum collects `#[utoipa::path]` routes into the
 # spec; utoipa-scalar serves the interactive docs. Codegen-friendly: the spec is emitted
 # verbatim by the `openapi` subcommand. Control plane only — never the per-frame path.
-# Plugin-store index signatures: ed25519 verification of a catalog document before any field of
-# it is read (store/index.rs). Already in the tree via rustls — the workspace is ring-only, so this
-# is the one signature primitive available without pulling aws-lc-sys (which fails on Windows CI).
-ring = "0.17"
-# Semver comparisons for the plugin store: `minHost` gating and the revocation list's version
-# ranges (`<0.3.2`). Already in the lockfile transitively.
-semver = "1"
 utoipa = { version = "5", features = ["axum_extras"] }
 utoipa-axum = "0.2"
 utoipa-scalar = { version = "0.3", features = ["axum"] }

crates/punktfunk-host/src/events.rs

@@ -170,12 +170,6 @@ pub enum EventKind {
         /// lease-expired). A consumer re-reads `GET /api/v1/plugins` for the new set.
         id: String,
     },
-    #[serde(rename = "store.changed")]
-    /// The set of installed plugins, or what the store knows about them, changed — an install or
-    /// uninstall finished, or a catalog refresh brought in new rows. A consumer re-reads
-    /// `GET /api/v1/store/catalog` / `…/installed`. Deliberately payload-free: the store's answer
-    /// is a join over several sources of truth, so "go look again" is the only honest signal.
-    StoreChanged,
     #[serde(rename = "host.started")]
     HostStarted {
         version: String,
@@ -203,7 +197,6 @@ impl EventKind {
             EventKind::DisplayReleased { .. } => "display.released",
             EventKind::LibraryChanged { .. } => "library.changed",
             EventKind::PluginsChanged { .. } => "plugins.changed",
-            EventKind::StoreChanged => "store.changed",
             EventKind::HostStarted { .. } => "host.started",
             EventKind::HostStopping => "host.stopping",
         }

crates/punktfunk-host/src/gamestream/stream.rs

@@ -658,9 +658,6 @@ fn stream_body(
         // GameStream/Moonlight stays 4:2:0 — stock Moonlight clients can't decode 4:4:4, and the
         // Windows IDD-push capturer can't yet deliver full-chroma frames. 4:4:4 is punktfunk/1-native only.
         encode::ChromaFormat::Yuv420,
-        // Desktop monitor capture negotiates cursor-as-metadata where available — the encoder
-        // may be handed cursor bitmaps to composite.
-        true,
     )
     .context("open video encoder for stream")?;
     // FEC overhead percent (Sunshine default 20). Override with PUNKTFUNK_FEC_PCT (0 = data-only).
@@ -814,7 +811,6 @@ fn stream_body(
                     frame.is_cuda(),
                     gs_bit_depth(frame.format),
                     encode::ChromaFormat::Yuv420, // GameStream stays 4:2:0
-                    true,                         // metadata-cursor capture — see the first open
                 )
                 .context("reopen encoder after rebuild")?;
                 supports_rfi = enc.caps().supports_rfi;

crates/punktfunk-host/src/main.rs

@@ -74,9 +74,6 @@ mod session_plan;
 mod session_status;
 mod spike;
 mod stats_recorder;
-// The plugin store: signed catalogs, tiered trust, and install/uninstall jobs that run through the
-// same runner CLI the `plugins` subcommand uses (design/plugin-store.md).
-mod store;
 mod stream_marker;
 // `monitor_devnode::startup_recover()` (below) re-enables PnP monitor devnodes disabled by a prior
 // run; it lives in the `pf-win-display` leaf crate (plan §W6).
@@ -171,29 +168,6 @@ fn main() {
     }
 }
 
-/// A lightweight management/CLI subcommand — package/service/driver ops, spec/library dumps — as
-/// opposed to a streaming/capture command. These never touch DXGI or run the host, so they skip the
-/// startup banner and (on Windows) the GPU-preference hook, whose DPI-awareness probe otherwise
-/// prints an alarming `SetProcessDpiAwarenessContext … "access denied"` WARN on a plain
-/// `plugins add`. `service run` is the SCM-launched host itself, so it is explicitly NOT lightweight
-/// (it must keep the hook — the hybrid-GPU ACCESS_LOST fix depends on it).
-fn is_management_cli(args: &[String]) -> bool {
-    match args.first().map(String::as_str) {
-        Some("plugins")
-        | Some("driver")
-        | Some("web")
-        | Some("openapi")
-        | Some("library")
-        | Some("detect-conflicts")
-        | Some("-h")
-        | Some("--help")
-        | Some("help")
-        | None => true,
-        Some("service") => args.get(1).map(String::as_str) != Some("run"),
-        _ => false,
-    }
-}
-
 fn real_main() -> Result<()> {
     let args: Vec<String> = std::env::args().skip(1).collect();
 
@@ -206,16 +180,11 @@ fn real_main() -> Result<()> {
         return Ok(());
     }
 
-    // Lightweight CLI commands (e.g. `plugins add`) get none of the host-startup noise below.
-    let management_cli = is_management_cli(&args);
-
-    if !management_cli {
-        tracing::info!(
-            "punktfunk-host {} (punktfunk_core ABI v{})",
-            env!("PUNKTFUNK_VERSION"),
-            punktfunk_core::ABI_VERSION
-        );
-    }
+    tracing::info!(
+        "punktfunk-host {} (punktfunk_core ABI v{})",
+        env!("PUNKTFUNK_VERSION"),
+        punktfunk_core::ABI_VERSION
+    );
 
     // Wire pf-vdisplay's display-lifecycle events into the SSE event bus (the subsystem crate emits a
     // neutral DisplayEvent; the orchestrator owns the bus type — plan §W6). Set once, ignore re-set.
@@ -239,12 +208,8 @@ fn real_main() -> Result<()> {
     // render-adapter selection creates a DXGI factory during virtual-display setup, well before
     // capture). On a hybrid-GPU box this stops DXGI from reparenting the virtual output off the
     // capture GPU — the ACCESS_LOST churn fix. Idempotent (Once); harmless on non-hybrid boxes.
-    // Skipped for lightweight CLI commands (`plugins`, `openapi`, …): they never touch DXGI, and the
-    // hook's DPI-awareness probe prints a misleading "access denied" WARN that looks like a failure.
     #[cfg(target_os = "windows")]
-    if !management_cli {
-        crate::capture::dxgi::install_gpu_pref_hook();
-    }
+    crate::capture::dxgi::install_gpu_pref_hook();
 
     // NVIDIA clock hygiene (Linux, host subcommands only): install the P2-cap driver profile and,
     // under PUNKTFUNK_PIN_CLOCKS, hold the NVML core-clock floor for the host lifetime (reset on
@@ -533,10 +498,6 @@ fn parse_serve(args: &[String]) -> Result<(mgmt::Options, native::NativeServe, b
     if opts.token.is_none() {
         opts.token = Some(crate::mgmt_token::load_or_generate()?);
     }
-    // The scripting runner's scoped credential: minted + persisted (plugin-token) alongside the
-    // admin token so a plugin's zero-config `connect()` picks it up — it authorizes the plugin
-    // surface but not hook registration or pairing administration (mgmt::auth::plugin_may_access).
-    opts.plugin_token = Some(crate::mgmt_token::load_or_generate_plugin()?);
     // Default the mgmt listener to ALL interfaces (not just loopback) so a paired native client can
     // fetch the game library over mTLS with no operator step — the whole point of "browse works by
     // default". This only LAN-exposes the read-only cert allowlist; the bearer-token admin surface

crates/punktfunk-host/src/mgmt.rs

@@ -42,7 +42,6 @@ mod plugins;
 mod session;
 mod shared;
 mod stats;
-mod store;
 #[cfg(test)]
 mod tests;
 
@@ -57,10 +56,6 @@ pub struct Options {
     /// Bearer token required on `/api/v1` (except `/health`). `None` ⇒ unauthenticated,
     /// which [`run`] only permits on loopback binds.
     pub token: Option<String>,
-    /// The scripting runner's capability-limited bearer token (`plugin-token`): authorizes the
-    /// plugin surface only, never hook registration or pairing administration
-    /// (`auth::plugin_may_access`). Optional — `None` simply disables the lane.
-    pub plugin_token: Option<String>,
 }
 
 impl Default for Options {
@@ -68,7 +63,6 @@ impl Default for Options {
         Options {
             bind: SocketAddr::from(([127, 0, 0, 1], DEFAULT_PORT)),
             token: None,
-            plugin_token: None,
         }
     }
 }
@@ -87,9 +81,6 @@ pub(crate) struct MgmtState {
     /// (native-only) host, where a Moonlight PIN can never arrive.
     gamestream_enabled: bool,
     token: Option<String>,
-    /// The plugin lane's token (see [`Options::plugin_token`]). Checked only after the admin token
-    /// mismatches, and gated by `auth::plugin_may_access` per route.
-    plugin_token: Option<String>,
     /// The port we serve on, echoed in [`PortMap`] so a client can persist a full endpoint map.
     port: u16,
 }
@@ -128,7 +119,6 @@ pub async fn run(
     let app = app(
         state,
         Some(token),
-        opts.plugin_token.filter(|t| !t.trim().is_empty()),
         opts.bind.port(),
         native,
         stats,
@@ -141,7 +131,6 @@ pub async fn run(
 fn app(
     state: Arc<AppState>,
     token: Option<String>,
-    plugin_token: Option<String>,
     port: u16,
     native: Option<Arc<crate::native_pairing::NativePairing>>,
     stats: Arc<crate::stats_recorder::StatsRecorder>,
@@ -153,7 +142,6 @@ fn app(
         stats,
         gamestream_enabled,
         token,
-        plugin_token,
         port,
     });
     let (api_routes, api) = api_router_parts();
@@ -241,17 +229,7 @@ fn api_router_parts() -> (Router<Arc<MgmtState>>, utoipa::openapi::OpenApi) {
                 .routes(routes!(hooks::get_hooks, hooks::set_hooks))
                 .routes(routes!(plugins::list_plugins))
                 .routes(routes!(plugins::register_plugin, plugins::delete_plugin))
-                .routes(routes!(plugins::get_ui_credential))
-                .routes(routes!(store::get_catalog))
-                .routes(routes!(store::refresh_catalog))
-                .routes(routes!(store::list_installed))
-                .routes(routes!(store::install_plugin))
-                .routes(routes!(store::uninstall_plugin))
-                .routes(routes!(store::list_jobs))
-                .routes(routes!(store::get_job))
-                .routes(routes!(store::list_sources))
-                .routes(routes!(store::put_source, store::delete_source))
-                .routes(routes!(store::get_runtime, store::set_runtime)),
+                .routes(routes!(plugins::get_ui_credential)),
         )
         .split_for_parts()
 }
@@ -290,7 +268,6 @@ pub fn openapi_json() -> String {
         (name = "events", description = "Host lifecycle events: an SSE stream (client/session/stream lifecycle, pairing, displays, library, host) with Last-Event-ID resume and server-side kind filters"),
         (name = "hooks", description = "Operator hooks: commands and webhooks fired on lifecycle events (fire-and-forget — hooks observe, never veto)"),
         (name = "plugins", description = "Plugin directory: running `punktfunk-plugin-*` processes register a lease and, optionally, a loopback UI the web console proxies and adds to its nav"),
-        (name = "store", description = "Plugin store: browse signed catalogs (verified first-party entries, attributed third-party sources), install/uninstall as tracked jobs, and switch the plugin runner on"),
     )
 )]
 struct ApiDoc;

crates/punktfunk-host/src/mgmt/auth.rs

@@ -1,12 +1,5 @@
 //! Auth gate for the management API `/api/v1` routes: paired client cert (mTLS, from anywhere)
-//! or a bearer token (loopback peers only). Split out of the `mgmt` facade (plan §W5).
-//!
-//! Three lanes, three authorities:
-//! - **paired streaming cert** (mTLS, LAN) — the read-only [`cert_may_access`] allowlist.
-//! - **plugin token** (bearer, loopback) — the scripting runner's capability-limited credential:
-//!   the admin surface MINUS hook registration and pairing administration
-//!   ([`plugin_may_access`]).
-//! - **admin token** (bearer, loopback) — everything.
+//! or the bearer token (loopback peers only). Split out of the `mgmt` facade (plan §W5).
 
 use super::shared::*;
 use crate::gamestream::tls::PeerAddr;
@@ -93,27 +86,6 @@ pub(crate) async fn require_auth(
         .and_then(|v| v.strip_prefix("Bearer "));
     match presented {
         Some(token) if token_eq(token, expected) => next.run(req).await,
-        // The scripting runner's scoped lane: same loopback confinement as the admin token, but
-        // routes that would let a plugin escalate — registering hooks (arbitrary command
-        // execution as the host user) or administering pairing (admitting/ejecting devices,
-        // reading the PIN) — need the operator's admin token. Checked AFTER the admin token so
-        // equal tokens (operator misconfiguration) degrade to full access, never to a lockout.
-        Some(token)
-            if st
-                .plugin_token
-                .as_deref()
-                .is_some_and(|pt| token_eq(token, pt)) =>
-        {
-            if plugin_may_access(req.method(), req.uri().path()) {
-                next.run(req).await
-            } else {
-                api_error(
-                    StatusCode::FORBIDDEN,
-                    "this route is not authorized for the plugin token — it requires the \
-                     operator's admin token",
-                )
-            }
-        }
         _ => api_error(
             StatusCode::UNAUTHORIZED,
             "missing or invalid credentials (a paired client cert, or a bearer token)",
@@ -121,38 +93,6 @@ pub(crate) async fn require_auth(
     }
 }
 
-/// Which routes the scripting runner's **plugin token** may reach: the admin surface minus the
-/// escalation routes. Exclusion-based (a plugin legitimately reads status/library/events, drives
-/// sessions, and registers its UI lease), with these carve-outs:
-/// - **hooks** — `hooks.json` runs operator commands on lifecycle events; writing it is arbitrary
-///   command execution as the host user, and reading it can expose webhook credentials.
-/// - **pairing administration** — arming/approving/denying/unpairing (and PIN visibility) decide
-///   *which devices may stream*; a plugin defect must not be able to admit an attacker's device
-///   or eject the operator's.
-/// - **UI proxy credentials** — a plugin has no business reading another plugin's per-boot UI
-///   secret; only the console proxy (admin token) needs it.
-/// - **the plugin store** — installing a plugin is running new code with operator privileges, and a
-///   plugin that can do that is a persistence/escalation primitive: it could install a helper that
-///   isn't constrained the way it is, or switch the runner's own service state. Denied wholesale
-///   (reads included — the catalog is not sensitive, but there is no reason a plugin needs it, and
-///   a whole-prefix deny can't be defeated by a route added later).
-pub(crate) fn plugin_may_access(method: &Method, path: &str) -> bool {
-    let denied = path == "/api/v1/hooks"
-        || path == "/api/v1/store"
-        || path.starts_with("/api/v1/store/")
-        || path == "/api/v1/pair"
-        || path.starts_with("/api/v1/pair/")
-        || path == "/api/v1/native/pair"
-        || path.starts_with("/api/v1/native/pair/")
-        || path == "/api/v1/native/pending"
-        || path.starts_with("/api/v1/native/pending/")
-        || (method == Method::DELETE
-            && (path.starts_with("/api/v1/clients/")
-                || path.starts_with("/api/v1/native/clients/")))
-        || (path.starts_with("/api/v1/plugins/") && path.ends_with("/ui-credential"));
-    !denied
-}
-
 /// Which routes a paired *streaming* cert (mTLS, no bearer token) may reach: a small allowlist of
 /// safe, read-only status routes only. Deny-by-default — every state-changing route and every route
 /// that exposes a pairing PIN or the pending-approval queue requires the operator's bearer token, so

crates/punktfunk-host/src/mgmt/plugins.rs

@@ -202,15 +202,6 @@ impl PluginRegistry {
         })
     }
 
-    /// The ids of live registrations, without pruning or announcing anything.
-    fn live_ids(&self) -> Vec<String> {
-        let map = self.inner.read().unwrap_or_else(|e| e.into_inner());
-        map.iter()
-            .filter(|(_, s)| s.is_live())
-            .map(|(id, _)| id.clone())
-            .collect()
-    }
-
     /// Remove `id`. Returns `true` if a **live** entry existed (a clean deregister); removing an
     /// already-expired or unknown id returns `false` (nothing to announce).
     fn remove(&self, id: &str) -> bool {
@@ -231,16 +222,6 @@ pub(crate) fn registry() -> &'static PluginRegistry {
     REG.get_or_init(PluginRegistry::new)
 }
 
-/// Which plugin ids are registered right now — the plugin store's "running" column
-/// ([`super::store::list_installed`]).
-///
-/// Deliberately **not** [`list_plugins`]: that one prunes expired leases and emits
-/// `plugins.changed` for each, which is right for the nav's poll but would turn the store's own
-/// polling into an event fire-hose. This is a pure read.
-pub(crate) fn live_plugin_ids() -> Vec<String> {
-    registry().live_ids()
-}
-
 // ---------------------------------------------------------------- validation
 
 /// A plugin id: `definePlugin`'s kebab-case name (`^[a-z][a-z0-9-]*$`, ≤64) — the same regex the SDK

crates/punktfunk-host/src/mgmt/store.rs

@@ -1,779 +0,0 @@
-//! Plugin **store** API: browse catalogs, install/uninstall, manage sources and the runner
-//! (design `plugin-store.md` §4.2). The domain logic lives in [`crate::store`]; this is its HTTP
-//! surface.
-//!
-//! Auth: **admin bearer + loopback**, like every mutation — and explicitly *denied to the plugin
-//! token* ([`super::auth::plugin_may_access`]). A plugin that can install plugins is a persistence
-//! and escalation primitive: it could install a helper that isn't constrained the way it is. That
-//! deny is a carve-out in the exclusion-based allowlist, so it is spelled out there and pinned by a
-//! test.
-//!
-//! (A console *session* can already reach arbitrary command execution via `PUT /hooks`, so the
-//! store adds convenience for a session holder rather than a new privilege class. It is still worth
-//! keeping the plugin lane away from it — the lanes exist precisely so a plugin defect isn't an
-//! operator compromise.)
-//!
-//! Everything here does blocking work — filesystem scans, network fetches, process spawns — so
-//! handlers hop to `spawn_blocking` rather than stalling the runtime.
-
-use super::shared::*;
-use crate::store::{self, index, jobs, manifest, sources};
-
-/// Run blocking store work off the async runtime, mapping a joined-thread panic to a 500.
-async fn blocking<T, F>(f: F) -> Result<T, Response>
-where
-    F: FnOnce() -> T + Send + 'static,
-    T: Send + 'static,
-{
-    tokio::task::spawn_blocking(f).await.map_err(|e| {
-        tracing::error!("plugin-store worker panicked: {e}");
-        api_error(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "the plugin store worker failed",
-        )
-    })
-}
-
-// ---------------------------------------------------------------- wire shapes
-
-/// Facts about this host, so the console can grey out rows it can't install.
-#[derive(Serialize, ToSchema)]
-pub(crate) struct HostFacts {
-    pub version: String,
-    /// `linux` / `windows` / `macos`.
-    pub platform: String,
-}
-
-/// A configured catalog source and how its last refresh went.
-#[derive(Serialize, ToSchema)]
-pub(crate) struct SourceView {
-    pub name: String,
-    pub url: String,
-    /// The built-in `unom` source: not editable, not removable, and the only source whose entries
-    /// may carry the "verified" tier.
-    pub builtin: bool,
-    /// Whether we check a signature on this source's index. An unsigned source still works; the
-    /// console marks it.
-    pub signed: bool,
-    /// The catalog we're serving is older than the last refresh attempt (offline, or the last
-    /// fetch failed) — entries still install, because the pin travelled with the entry.
-    pub stale: bool,
-    /// Unix seconds of the data we hold, when we hold any.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fetched_at: Option<u64>,
-    /// Why the last refresh failed, if it did.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    pub entry_count: u32,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub public_key: Option<String>,
-}
-
-/// One row on the shelf.
-#[derive(Serialize, ToSchema)]
-pub(crate) struct CatalogEntry {
-    pub id: String,
-    pub pkg: String,
-    pub title: String,
-    pub description: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icon: Option<String>,
-    pub author: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub homepage: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub license: Option<String>,
-    /// The one installable version this entry pins.
-    pub version: String,
-    /// Which source listed it.
-    pub source: String,
-    /// `verified` (built-in source) or `external` (an operator-added source). Never `unverified`:
-    /// unverified installs come from a raw spec and are never listed (D7).
-    pub tier: String,
-    /// When unom reviewed this exact tarball (built-in source only).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reviewed_at: Option<String>,
-    pub platforms: Vec<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_host: Option<String>,
-    /// Can this host install it?
-    pub compatible: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub incompatible_reason: Option<String>,
-    /// The version installed right now, if any.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub installed_version: Option<String>,
-    /// Installed, but at a different version than the catalog pins.
-    pub update_available: bool,
-    /// A revocation covering the catalogued version — do not offer this without shouting.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub blocked: Option<String>,
-}
-
-#[derive(Serialize, ToSchema)]
-pub(crate) struct CatalogResponse {
-    pub host: HostFacts,
-    pub sources: Vec<SourceView>,
-    pub plugins: Vec<CatalogEntry>,
-    /// True while a package operation is in flight — the console disables install buttons.
-    pub busy: bool,
-}
-
-/// An installed plugin package, joined with its provenance and whether it's actually running.
-#[derive(Serialize, ToSchema)]
-pub(crate) struct InstalledView {
-    pub pkg: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
-    /// `verified` / `external` / `unverified` / `cli` — remembered from install time, so an
-    /// unverified plugin stays visibly unverified long after the dialog is forgotten.
-    pub tier: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<String>,
-    /// The catalog entry this maps to, when it is on a shelf we know.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry_id: Option<String>,
-    /// The plugin id it registers under — the key into `GET /plugins`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plugin_id: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub installed_at: Option<String>,
-    /// Is it registered in the live lease registry right now?
-    pub running: bool,
-    /// The catalog's version, when it's newer than what's installed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub update_available: Option<String>,
-    /// A revocation covering the *installed* version. Reported, never auto-removed: silently
-    /// deleting running code is its own hazard, so the operator decides.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub blocked: Option<String>,
-}
-
-/// `POST /store/install` — either a catalogued entry, or a raw spec the operator owns.
-#[derive(Deserialize, ToSchema)]
-pub(crate) struct InstallRequest {
-    /// Catalog source name (with [`Self::id`]).
-    #[serde(default)]
-    pub source: Option<String>,
-    /// Catalog entry id (with [`Self::source`]).
-    #[serde(default)]
-    pub id: Option<String>,
-    /// A raw package spec (`@scope/name`, `@scope/name@1.2.3`, an https tarball or git+https URL).
-    /// Nothing reviewed it and nothing pins it.
-    #[serde(default)]
-    pub spec: Option<String>,
-    /// Required with [`Self::spec`]: the operator's explicit acknowledgement that this installs
-    /// unreviewed code with operator privileges. The console collects it behind a typed
-    /// confirmation; the API refuses without it so no other caller can skip the decision.
-    #[serde(default)]
-    pub accept_unverified: bool,
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(crate) struct UninstallRequest {
-    pub pkg: String,
-}
-
-/// 202 body: where to watch the work.
-#[derive(Serialize, ToSchema)]
-pub(crate) struct JobRef {
-    pub job: String,
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(crate) struct SourceInput {
-    pub url: String,
-    /// `ed25519:<base64>`. Omitted ⇒ an unsigned source (accepted, flagged everywhere).
-    #[serde(default)]
-    pub public_key: Option<String>,
-}
-
-#[derive(Serialize, ToSchema)]
-pub(crate) struct RuntimeView {
-    /// Is the runner payload/unit present at all?
-    pub installed: bool,
-    pub enabled: bool,
-    pub running: bool,
-    /// systemd unit or scheduled-task name.
-    pub unit: String,
-    /// Windows: the account the task runs as.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub principal: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub detail: Option<String>,
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(crate) struct RuntimeRequest {
-    pub enabled: bool,
-}
-
-// ---------------------------------------------------------------- assembly
-
-fn runtime_view() -> RuntimeView {
-    let st = crate::plugins::runtime_status();
-    RuntimeView {
-        installed: st.installed,
-        enabled: st.enabled,
-        running: st.running,
-        unit: st.unit.to_string(),
-        principal: st.principal,
-        detail: (!st.detail.is_empty()).then_some(st.detail),
-    }
-}
-
-/// Build the merged catalog view: every source's shelf, annotated with what this host has and can
-/// run. `force` refreshes past the TTL.
-fn build_catalog(force: bool) -> CatalogResponse {
-    let states = store::catalogs(force);
-    let installed = store::installed_packages(&store::plugins_dir());
-    let mut plugins = Vec::new();
-    let mut source_views = Vec::new();
-
-    for st in &states {
-        let count = st.index.as_ref().map(|i| i.plugins.len()).unwrap_or(0);
-        source_views.push(SourceView {
-            name: st.source.name.clone(),
-            url: st.source.url.clone(),
-            builtin: st.source.is_official(),
-            signed: st.source.is_signed(),
-            stale: st.stale,
-            fetched_at: st.fetched_at,
-            error: st.error.clone(),
-            entry_count: count as u32,
-            public_key: st.source.public_key.clone(),
-        });
-        let Some(idx) = &st.index else { continue };
-        let verified = st.source.is_official();
-        for e in &idx.plugins {
-            let installed_version = installed
-                .iter()
-                .find(|p| p.pkg == e.pkg)
-                .and_then(|p| p.version.clone());
-            let reason = e.incompatible_reason();
-            plugins.push(CatalogEntry {
-                id: e.id.clone(),
-                pkg: e.pkg.clone(),
-                title: e.title.clone(),
-                description: e.description.clone(),
-                icon: e.icon.clone(),
-                author: e.author.clone(),
-                homepage: e.homepage.clone(),
-                license: e.license.clone(),
-                version: e.version.clone(),
-                source: st.source.name.clone(),
-                // The badge is the built-in source's alone: a third-party curator can pin and
-                // publish, but cannot confer unom's review (D6).
-                tier: if verified { "verified" } else { "external" }.to_string(),
-                reviewed_at: verified
-                    .then(|| e.verification.as_ref().map(|v| v.reviewed_at.clone()))
-                    .flatten(),
-                platforms: e.platforms.clone(),
-                min_host: e.min_host.clone(),
-                compatible: reason.is_none(),
-                incompatible_reason: reason,
-                update_available: installed_version.as_deref().is_some_and(|v| v != e.version),
-                installed_version,
-                blocked: store::advisory_for(&e.pkg, Some(&e.version)).map(|a| a.reason),
-            });
-        }
-    }
-    // Stable, useful order: alphabetical by title, then by source so duplicates across shelves
-    // don't jitter between polls.
-    plugins.sort_by(|a, b| {
-        a.title
-            .to_lowercase()
-            .cmp(&b.title.to_lowercase())
-            .then_with(|| a.source.cmp(&b.source))
-    });
-    CatalogResponse {
-        host: HostFacts {
-            version: index::host_version().to_string(),
-            platform: index::HOST_PLATFORM.to_string(),
-        },
-        sources: source_views,
-        plugins,
-        busy: jobs::busy(),
-    }
-}
-
-fn build_installed(live: &[String]) -> Vec<InstalledView> {
-    let dir = store::plugins_dir();
-    let records = manifest::load(&dir);
-    let catalogs = store::cached_catalogs();
-    let mut out: Vec<InstalledView> = store::installed_packages(&dir)
-        .into_iter()
-        .map(|p| {
-            let rec = records.get(&p.pkg);
-            // The catalog row for this package, if any shelf carries it — the source of "an update
-            // is available" and of a friendly title for CLI-installed packages.
-            let entry = catalogs.iter().find_map(|s| {
-                s.index
-                    .as_ref()?
-                    .plugins
-                    .iter()
-                    .find(|e| e.pkg == p.pkg)
-                    .map(|e| (e, s.source.name.clone()))
-            });
-            let plugin_id = entry
-                .as_ref()
-                .map(|(e, _)| e.id.clone())
-                .or_else(|| store::plugin_id_for_pkg(&p.pkg));
-            InstalledView {
-                // Absence of a manifest record is meaningful: the CLI put it there (§4.5).
-                tier: rec
-                    .map(|r| r.tier)
-                    .unwrap_or(manifest::Tier::Cli)
-                    .as_str()
-                    .to_string(),
-                source: rec
-                    .and_then(|r| r.source.clone())
-                    .or_else(|| entry.as_ref().map(|(_, s)| s.clone())),
-                entry_id: rec
-                    .and_then(|r| r.entry_id.clone())
-                    .or_else(|| entry.as_ref().map(|(e, _)| e.id.clone())),
-                title: entry.as_ref().map(|(e, _)| e.title.clone()),
-                installed_at: rec.and_then(|r| r.installed_at.clone()),
-                running: plugin_id
-                    .as_deref()
-                    .is_some_and(|id| live.iter().any(|l| l == id)),
-                update_available: entry.as_ref().and_then(|(e, _)| {
-                    (p.version.as_deref() != Some(e.version.as_str())).then(|| e.version.clone())
-                }),
-                blocked: store::advisory_for(&p.pkg, p.version.as_deref()).map(|a| a.reason),
-                plugin_id,
-                version: p.version,
-                pkg: p.pkg,
-            }
-        })
-        .collect();
-    out.sort_by(|a, b| a.pkg.cmp(&b.pkg));
-    out
-}
-
-// ---------------------------------------------------------------- handlers
-
-/// Browse the plugin catalog
-///
-/// The merged shelf across every configured source, annotated with what this host already has and
-/// what it can run. Sources past their freshness window are refreshed first; a source that can't be
-/// reached keeps serving its last good copy, marked `stale` (a LAN-only host still has a working
-/// store — an entry's pin travelled with the entry).
-#[utoipa::path(
-    get,
-    path = "/store/catalog",
-    tag = "store",
-    operation_id = "getPluginCatalog",
-    responses(
-        (status = OK, description = "The merged catalog", body = CatalogResponse),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn get_catalog() -> Response {
-    match blocking(|| build_catalog(false)).await {
-        Ok(c) => Json(c).into_response(),
-        Err(e) => e,
-    }
-}
-
-/// Refresh every catalog now
-///
-/// Bypasses the freshness window and re-fetches all sources, then returns the merged catalog.
-#[utoipa::path(
-    post,
-    path = "/store/refresh",
-    tag = "store",
-    operation_id = "refreshPluginCatalog",
-    responses(
-        (status = OK, description = "The freshly-fetched catalog", body = CatalogResponse),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn refresh_catalog() -> Response {
-    match blocking(|| build_catalog(true)).await {
-        Ok(c) => {
-            crate::events::emit(crate::events::EventKind::StoreChanged);
-            Json(c).into_response()
-        }
-        Err(e) => e,
-    }
-}
-
-/// List installed plugins
-///
-/// What's actually in the plugins directory, joined with how it got there (the provenance manifest)
-/// and whether it is registered right now. A package with no provenance record was installed with
-/// the CLI and reports `tier: "cli"` — absence is the answer, not a gap.
-#[utoipa::path(
-    get,
-    path = "/store/installed",
-    tag = "store",
-    operation_id = "listInstalledPlugins",
-    responses(
-        (status = OK, description = "Installed plugin packages", body = [InstalledView]),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn list_installed() -> Response {
-    // The live set comes from the in-memory lease registry — cheap, and it must be read on this
-    // thread rather than inside the blocking closure to keep the borrow simple.
-    let live: Vec<String> = super::plugins::live_plugin_ids();
-    match blocking(move || build_installed(&live)).await {
-        Ok(v) => Json(v).into_response(),
-        Err(e) => e,
-    }
-}
-
-/// Install a plugin
-///
-/// Either `{source, id}` — a catalogued entry, installed at its pinned version after its integrity
-/// is re-checked against the registry — or `{spec, accept_unverified: true}`, which installs an
-/// unreviewed package the operator takes responsibility for. Returns `202` with a job id; watch it
-/// at `GET /store/jobs/{id}`.
-///
-/// One package operation runs at a time (`409` otherwise): `bun` operations share a lockfile and a
-/// `node_modules` tree.
-#[utoipa::path(
-    post,
-    path = "/store/install",
-    tag = "store",
-    operation_id = "installPlugin",
-    request_body = InstallRequest,
-    responses(
-        (status = ACCEPTED, description = "Install job started", body = JobRef),
-        (status = BAD_REQUEST, description = "Unknown entry, bad spec, or missing acknowledgement", body = ApiError),
-        (status = CONFLICT, description = "Another package operation is in flight", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn install_plugin(ApiJson(req): ApiJson<InstallRequest>) -> Response {
-    let plan =
-        match (
-            req.source.as_deref(),
-            req.id.as_deref(),
-            req.spec.as_deref(),
-        ) {
-            (Some(source), Some(id), None) => {
-                let found = match blocking({
-                    let (source, id) = (source.to_string(), id.to_string());
-                    move || store::find_entry(&source, &id)
-                })
-                .await
-                {
-                    Ok(f) => f,
-                    Err(e) => return e,
-                };
-                let Some((entry, verified)) = found else {
-                    return api_error(
-                        StatusCode::BAD_REQUEST,
-                        "no such plugin in that source's catalog",
-                    );
-                };
-                if let Some(reason) = entry.incompatible_reason() {
-                    return api_error(
-                        StatusCode::BAD_REQUEST,
-                        &format!("this plugin cannot run on this host: {reason}"),
-                    );
-                }
-                match jobs::Plan::from_entry(&entry, source, verified) {
-                    Ok(p) => p,
-                    Err(e) => return api_error(StatusCode::BAD_REQUEST, &format!("{e:#}")),
-                }
-            }
-            (None, None, Some(spec)) => {
-                if !req.accept_unverified {
-                    return api_error(
-                        StatusCode::BAD_REQUEST,
-                        "installing from a raw package spec runs unreviewed code with operator \
-                     privileges — set `accept_unverified` to confirm",
-                    );
-                }
-                match jobs::Plan::from_spec(spec) {
-                    Ok(p) => p,
-                    Err(e) => return api_error(StatusCode::BAD_REQUEST, &format!("{e:#}")),
-                }
-            }
-            _ => return api_error(
-                StatusCode::BAD_REQUEST,
-                "provide either {source, id} for a catalogued plugin or {spec} for a raw package",
-            ),
-        };
-
-    match jobs::spawn_install(plan) {
-        Ok(job) => (StatusCode::ACCEPTED, Json(JobRef { job })).into_response(),
-        Err(e) => api_error(StatusCode::CONFLICT, &format!("{e:#}")),
-    }
-}
-
-/// Uninstall a plugin
-///
-/// Removes the package and forgets its provenance, then restarts the runner. Only names the runner
-/// would actually supervise are accepted, so this can't be used to rip a shared dependency out of
-/// the tree.
-#[utoipa::path(
-    post,
-    path = "/store/uninstall",
-    tag = "store",
-    operation_id = "uninstallPlugin",
-    request_body = UninstallRequest,
-    responses(
-        (status = ACCEPTED, description = "Uninstall job started", body = JobRef),
-        (status = BAD_REQUEST, description = "Not a plugin package name", body = ApiError),
-        (status = CONFLICT, description = "Another package operation is in flight", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn uninstall_plugin(ApiJson(req): ApiJson<UninstallRequest>) -> Response {
-    if let Err(e) = store::valid_installed_pkg(&req.pkg) {
-        return api_error(StatusCode::BAD_REQUEST, &format!("{e:#}"));
-    }
-    // The name shape is not enough. `@punktfunk/plugin-kit` — the framework every kit-built plugin
-    // *depends on* — matches `@scope/plugin-*` exactly, so a syntactic guard waves it through and
-    // the store offers to uninstall a library out from under the plugins using it (accepted on
-    // Windows on-glass before this check existed). Only a package the operator actually installed
-    // may be removed, which is precisely what `installed_packages` reports: the plugins dir's
-    // top-level dependencies, transitive ones excluded.
-    let pkg = req.pkg.clone();
-    let known = match blocking(move || {
-        store::installed_packages(&store::plugins_dir())
-            .iter()
-            .any(|p| p.pkg == pkg)
-    })
-    .await
-    {
-        Ok(k) => k,
-        Err(e) => return e,
-    };
-    if !known {
-        return api_error(
-            StatusCode::BAD_REQUEST,
-            "that package is not an installed plugin — it may be a dependency of one, or already \
-             removed",
-        );
-    }
-    match jobs::spawn_uninstall(req.pkg) {
-        Ok(job) => (StatusCode::ACCEPTED, Json(JobRef { job })).into_response(),
-        Err(e) => api_error(StatusCode::CONFLICT, &format!("{e:#}")),
-    }
-}
-
-/// List recent package jobs
-#[utoipa::path(
-    get,
-    path = "/store/jobs",
-    tag = "store",
-    operation_id = "listPluginJobs",
-    responses(
-        (status = OK, description = "Recent install/uninstall jobs, oldest first", body = [Job]),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn list_jobs() -> Json<Vec<jobs::Job>> {
-    Json(jobs::list())
-}
-
-/// Follow one package job
-///
-/// Poll this while `state` is `running`; `log` carries the tail of the package manager's output.
-#[utoipa::path(
-    get,
-    path = "/store/jobs/{id}",
-    tag = "store",
-    operation_id = "getPluginJob",
-    params(("id" = String, Path, description = "The job id returned by install/uninstall")),
-    responses(
-        (status = OK, description = "The job", body = Job),
-        (status = NOT_FOUND, description = "No such job (they are kept for a bounded history)", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn get_job(Path(id): Path<String>) -> Response {
-    match jobs::get(&id) {
-        Some(j) => Json(j).into_response(),
-        None => api_error(StatusCode::NOT_FOUND, "no such job"),
-    }
-}
-
-/// List catalog sources
-#[utoipa::path(
-    get,
-    path = "/store/sources",
-    tag = "store",
-    operation_id = "listPluginSources",
-    responses(
-        (status = OK, description = "Configured sources, built-in first", body = [SourceView]),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn list_sources() -> Response {
-    match blocking(|| {
-        store::cached_catalogs()
-            .into_iter()
-            .map(|st| SourceView {
-                name: st.source.name.clone(),
-                url: st.source.url.clone(),
-                builtin: st.source.is_official(),
-                signed: st.source.is_signed(),
-                stale: st.stale,
-                fetched_at: st.fetched_at,
-                error: st.error,
-                entry_count: st.index.map(|i| i.plugins.len()).unwrap_or(0) as u32,
-                public_key: st.source.public_key,
-            })
-            .collect::<Vec<_>>()
-    })
-    .await
-    {
-        Ok(v) => Json(v).into_response(),
-        Err(e) => e,
-    }
-}
-
-/// Add or update a catalog source
-///
-/// Adding a source is a trust decision: its entries become installable on this host. They are
-/// attributed to it in the console and never carry the "verified" badge, which belongs to the
-/// built-in source alone.
-#[utoipa::path(
-    put,
-    path = "/store/sources/{name}",
-    tag = "store",
-    operation_id = "putPluginSource",
-    params(("name" = String, Path, description = "Source slug (`[a-z][a-z0-9-]*`)")),
-    request_body = SourceInput,
-    responses(
-        (status = NO_CONTENT, description = "Source saved"),
-        (status = BAD_REQUEST, description = "Invalid name, url or key — or the reserved built-in name", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn put_source(
-    Path(name): Path<String>,
-    ApiJson(input): ApiJson<SourceInput>,
-) -> Response {
-    let source = sources::Source {
-        name: name.clone(),
-        url: input.url,
-        public_key: input.public_key.filter(|k| !k.trim().is_empty()),
-    };
-    let saved = blocking(move || {
-        let r = sources::put(source);
-        if r.is_ok() {
-            // A redefined source must not keep serving what the old definition cached.
-            store::drop_source_cache(&name);
-        }
-        r
-    })
-    .await;
-    match saved {
-        Err(e) => e,
-        Ok(Err(e)) => api_error(StatusCode::BAD_REQUEST, &format!("{e:#}")),
-        Ok(Ok(())) => {
-            crate::events::emit(crate::events::EventKind::StoreChanged);
-            StatusCode::NO_CONTENT.into_response()
-        }
-    }
-}
-
-/// Remove a catalog source
-#[utoipa::path(
-    delete,
-    path = "/store/sources/{name}",
-    tag = "store",
-    operation_id = "deletePluginSource",
-    params(("name" = String, Path, description = "Source slug")),
-    responses(
-        (status = NO_CONTENT, description = "Removed (or already absent)"),
-        (status = FORBIDDEN, description = "The built-in source cannot be removed, or the plugin token is not authorized", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-    )
-)]
-pub(crate) async fn delete_source(Path(name): Path<String>) -> Response {
-    if name == sources::OFFICIAL_NAME {
-        return api_error(
-            StatusCode::FORBIDDEN,
-            "the built-in source cannot be removed",
-        );
-    }
-    let removed = blocking(move || {
-        let r = sources::remove(&name);
-        if matches!(r, Ok(true)) {
-            store::drop_source_cache(&name);
-        }
-        r
-    })
-    .await;
-    match removed {
-        Err(e) => e,
-        Ok(Err(e)) => api_error(StatusCode::BAD_REQUEST, &format!("{e:#}")),
-        Ok(Ok(_)) => {
-            crate::events::emit(crate::events::EventKind::StoreChanged);
-            StatusCode::NO_CONTENT.into_response()
-        }
-    }
-}
-
-/// Plugin runner state
-///
-/// Installed plugins only run while the runner is on, and the runner discovers units at startup —
-/// so this is both the "is anything running" answer and the explanation for a freshly installed
-/// plugin that hasn't appeared yet.
-#[utoipa::path(
-    get,
-    path = "/store/runtime",
-    tag = "store",
-    operation_id = "getPluginRuntime",
-    responses(
-        (status = OK, description = "Runner state", body = RuntimeView),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn get_runtime() -> Response {
-    match blocking(runtime_view).await {
-        Ok(v) => Json(v).into_response(),
-        Err(e) => e,
-    }
-}
-
-/// Turn the plugin runner on or off
-#[utoipa::path(
-    post,
-    path = "/store/runtime",
-    tag = "store",
-    operation_id = "setPluginRuntime",
-    request_body = RuntimeRequest,
-    responses(
-        (status = OK, description = "The resulting runner state", body = RuntimeView),
-        (status = BAD_REQUEST, description = "The runner could not be switched", body = ApiError),
-        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
-        (status = FORBIDDEN, description = "Not authorized for the plugin token", body = ApiError),
-    )
-)]
-pub(crate) async fn set_runtime(ApiJson(req): ApiJson<RuntimeRequest>) -> Response {
-    let switched =
-        blocking(move || crate::plugins::set_runtime_enabled(req.enabled).map(|()| runtime_view()))
-            .await;
-    match switched {
-        Err(e) => e,
-        Ok(Err(e)) => api_error(StatusCode::BAD_REQUEST, &format!("{e:#}")),
-        Ok(Ok(v)) => {
-            crate::events::emit(crate::events::EventKind::StoreChanged);
-            Json(v).into_response()
-        }
-    }
-}
-
-// Re-exported so `routes!` can name the response body types.
-pub(crate) use crate::store::jobs::Job;

crates/punktfunk-host/src/mgmt/tests.rs

@@ -42,8 +42,6 @@ fn test_app(state: Arc<AppState>, token: Option<&str>) -> Router {
     app(
         state,
         Some(token.unwrap_or("test-secret").to_string()),
-        // The scoped plugin lane, exercised by the `plugin_token_*` tests below.
-        Some("plugin-secret".to_string()),
         DEFAULT_PORT,
         None,
         stats,
@@ -59,7 +57,6 @@ fn test_app_native(state: Arc<AppState>, np: Arc<crate::native_pairing::NativePa
     app(
         state,
         Some("test-secret".to_string()),
-        Some("plugin-secret".to_string()),
         DEFAULT_PORT,
         Some(np),
         stats,
@@ -377,179 +374,6 @@ async fn bearer_token_is_enforced() {
     );
 }
 
-/// The pure route gate for the plugin lane: exclusion-based, so spot-check both sides — the
-/// surface a plugin legitimately uses, and every escalation carve-out.
-#[test]
-fn plugin_allowlist_excludes_escalation_routes() {
-    use axum::http::Method;
-
-    // The legitimate plugin surface stays open (including mutations — sessions, library, leases).
-    assert!(auth::plugin_may_access(&Method::GET, "/api/v1/status"));
-    assert!(auth::plugin_may_access(&Method::GET, "/api/v1/library"));
-    assert!(auth::plugin_may_access(&Method::GET, "/api/v1/clients"));
-    assert!(auth::plugin_may_access(&Method::GET, "/api/v1/plugins"));
-    assert!(auth::plugin_may_access(
-        &Method::PUT,
-        "/api/v1/plugins/rom-manager"
-    ));
-    assert!(auth::plugin_may_access(
-        &Method::DELETE,
-        "/api/v1/plugins/rom-manager"
-    ));
-
-    // Hooks: registration is command execution; even the read can expose webhook credentials.
-    assert!(!auth::plugin_may_access(&Method::GET, "/api/v1/hooks"));
-    assert!(!auth::plugin_may_access(&Method::PUT, "/api/v1/hooks"));
-
-    // Pairing administration + PIN visibility.
-    assert!(!auth::plugin_may_access(&Method::GET, "/api/v1/pair"));
-    assert!(!auth::plugin_may_access(&Method::POST, "/api/v1/pair/pin"));
-    assert!(!auth::plugin_may_access(
-        &Method::GET,
-        "/api/v1/native/pair"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::POST,
-        "/api/v1/native/pair/arm"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::GET,
-        "/api/v1/native/pending"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::POST,
-        "/api/v1/native/pending/1/approve"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::DELETE,
-        "/api/v1/clients/aabbcc"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::DELETE,
-        "/api/v1/native/clients/aabbcc"
-    ));
-
-    // Another plugin's UI proxy secret.
-    assert!(!auth::plugin_may_access(
-        &Method::GET,
-        "/api/v1/plugins/x/ui-credential"
-    ));
-
-    // The plugin STORE, wholesale. Installing a plugin runs new code with operator privileges, so a
-    // plugin able to do it could install a helper that isn't constrained the way it is — and
-    // `POST /store/runtime` would let it switch its own supervisor. Denied by whole-prefix so a
-    // route added here later is denied by default rather than by remembering to list it.
-    for path in [
-        "/api/v1/store/catalog",
-        "/api/v1/store/installed",
-        "/api/v1/store/sources",
-        "/api/v1/store/jobs",
-        "/api/v1/store/jobs/job-1",
-        "/api/v1/store/runtime",
-        "/api/v1/store/some-route-that-does-not-exist-yet",
-    ] {
-        assert!(
-            !auth::plugin_may_access(&Method::GET, path),
-            "plugin token must not reach {path}"
-        );
-    }
-    for path in [
-        "/api/v1/store/install",
-        "/api/v1/store/uninstall",
-        "/api/v1/store/refresh",
-        "/api/v1/store/runtime",
-    ] {
-        assert!(
-            !auth::plugin_may_access(&Method::POST, path),
-            "plugin token must not reach {path}"
-        );
-    }
-    assert!(!auth::plugin_may_access(
-        &Method::PUT,
-        "/api/v1/store/sources/evil"
-    ));
-    assert!(!auth::plugin_may_access(
-        &Method::DELETE,
-        "/api/v1/store/sources/unom"
-    ));
-    // …but a route that merely starts with the same letters is unaffected.
-    assert!(auth::plugin_may_access(&Method::GET, "/api/v1/status"));
-}
-
-/// The plugin bearer lane end-to-end: scoped 403s on the carve-outs, 200s on the plugin surface,
-/// and the same loopback confinement as the admin token.
-#[tokio::test]
-async fn plugin_token_lane_is_scoped_and_loopback_only() {
-    use axum::http::Method;
-    let app = test_app(test_state(), None); // admin "test-secret", plugin "plugin-secret"
-
-    let plugin_req = |method: Method, path: &str| {
-        axum::http::Request::builder()
-            .method(method)
-            .uri(path)
-            .header("authorization", "Bearer plugin-secret")
-            .body(Body::empty())
-            .unwrap()
-    };
-
-    // The plugin surface authenticates: status + the plugin directory (list and lease removal).
-    assert_eq!(
-        send(&app, plugin_req(Method::GET, "/api/v1/status"))
-            .await
-            .0,
-        StatusCode::OK
-    );
-    assert_eq!(
-        send(&app, plugin_req(Method::GET, "/api/v1/plugins"))
-            .await
-            .0,
-        StatusCode::OK
-    );
-    assert_eq!(
-        send(
-            &app,
-            plugin_req(Method::DELETE, "/api/v1/plugins/no-such-plugin")
-        )
-        .await
-        .0,
-        StatusCode::NO_CONTENT
-    );
-
-    // The carve-outs answer 403 (authenticated but not authorized), not 401.
-    for (method, path) in [
-        (Method::GET, "/api/v1/hooks"),
-        (Method::PUT, "/api/v1/hooks"),
-        (Method::GET, "/api/v1/pair"),
-        (Method::POST, "/api/v1/native/pair/arm"),
-        (Method::GET, "/api/v1/native/pending"),
-        (Method::DELETE, "/api/v1/clients/aabbcc"),
-        (Method::GET, "/api/v1/plugins/x/ui-credential"),
-        // The plugin store: a plugin must not be able to install plugins or switch its own runner.
-        (Method::GET, "/api/v1/store/catalog"),
-        (Method::POST, "/api/v1/store/install"),
-        (Method::POST, "/api/v1/store/uninstall"),
-        (Method::POST, "/api/v1/store/runtime"),
-        (Method::PUT, "/api/v1/store/sources/evil"),
-    ] {
-        let (status, body) = send(&app, plugin_req(method.clone(), path)).await;
-        assert_eq!(status, StatusCode::FORBIDDEN, "{method} {path}");
-        assert!(body["error"].as_str().unwrap().contains("plugin token"));
-    }
-
-    // A wrong token never reaches the lane.
-    let wrong = axum::http::Request::get("/api/v1/status")
-        .header("authorization", "Bearer plugin-wrong")
-        .body(Body::empty())
-        .unwrap();
-    assert_eq!(send(&app, wrong).await.0, StatusCode::UNAUTHORIZED);
-
-    // Loopback-only, exactly like the admin token: a LAN peer is refused before token compare.
-    let mut lan = plugin_req(Method::GET, "/api/v1/status");
-    lan.extensions_mut()
-        .insert(PeerAddr("192.168.1.50:40000".parse().unwrap()));
-    assert_eq!(send(&app, lan).await.0, StatusCode::UNAUTHORIZED);
-}
-
 #[tokio::test]
 async fn host_info_reports_identity_and_ports() {
     let app = test_app(test_state(), None);
@@ -720,7 +544,6 @@ async fn blank_token_rejected() {
     let opts = Options {
         bind: "127.0.0.1:0".parse().unwrap(),
         token: Some("   ".into()),
-        plugin_token: None,
     };
     let err = run(test_state(), opts, None, test_stats(), false)
         .await

crates/punktfunk-host/src/mgmt_token.rs

@@ -1,19 +1,12 @@
 //! Management-API bearer token resolution.
 //!
 //! The mgmt API always serves HTTPS (the host's identity cert) and now always requires auth — even
-//! on a loopback bind. This module guarantees the tokens always exist: an explicit env var wins
-//! (operator override, not persisted); otherwise the persisted file under the config dir is used;
-//! otherwise a fresh 32-byte hex token is generated and persisted. Files are written in
-//! `KEY=<hex>` form (0600) so the bundled web console can source them directly as a systemd
-//! `EnvironmentFile` — a single source of truth shared between the host and its consumers.
-//!
-//! Two tokens, two authorities:
-//! - **`mgmt-token`** (`PUNKTFUNK_MGMT_TOKEN`) — the operator/console token; authorizes the full
-//!   admin surface.
-//! - **`plugin-token`** (`PUNKTFUNK_PLUGIN_TOKEN`) — the scripting runner's capability-limited
-//!   credential (`mgmt::auth::plugin_may_access`): everything a plugin legitimately needs, but not
-//!   hook registration or pairing administration. The SDK's `connect()` prefers this file, so a
-//!   defect in an operator plugin can't rewrite `hooks.json` or admit new devices.
+//! on a loopback bind. This module guarantees a token always exists: an explicit
+//! `PUNKTFUNK_MGMT_TOKEN` env wins (operator override, not persisted); otherwise the persisted
+//! `~/.config/punktfunk/mgmt-token` is used; otherwise a fresh 32-byte hex token is generated and
+//! persisted. The file is written in `PUNKTFUNK_MGMT_TOKEN=<hex>` form (0600) so the bundled web
+//! console can source it directly as a systemd `EnvironmentFile` — a single source of truth shared
+//! between the host and the console with no copying.
 
 use anyhow::{Context, Result};
 use rand::RngCore;
@@ -22,32 +15,19 @@ use std::path::Path;
 
 const ENV_VAR: &str = "PUNKTFUNK_MGMT_TOKEN";
 const FILE: &str = "mgmt-token";
-const PLUGIN_ENV_VAR: &str = "PUNKTFUNK_PLUGIN_TOKEN";
-const PLUGIN_FILE: &str = "plugin-token";
 
-/// Resolve the mgmt (full-admin) token (env > persisted file > generate+persist). Hex (not base64)
-/// so the persisted `KEY=VALUE` line is safe to source from a shell / systemd `EnvironmentFile`.
+/// Resolve the mgmt token (env > persisted file > generate+persist). Hex (not base64) so the
+/// persisted `KEY=VALUE` line is safe to source from a shell / systemd `EnvironmentFile`.
 pub fn load_or_generate() -> Result<String> {
-    load_or_generate_impl(ENV_VAR, FILE)
-}
-
-/// Resolve the scripting runner's scoped plugin token, same precedence as [`load_or_generate`].
-/// Persisted to `plugin-token` next to `mgmt-token`; on Windows `plugins enable` grants the
-/// runner's LocalService principal read on exactly this file (and `cert.pem`) — never `mgmt-token`.
-pub fn load_or_generate_plugin() -> Result<String> {
-    load_or_generate_impl(PLUGIN_ENV_VAR, PLUGIN_FILE)
-}
-
-fn load_or_generate_impl(env_var: &str, file: &str) -> Result<String> {
-    if let Ok(v) = std::env::var(env_var) {
+    if let Ok(v) = std::env::var(ENV_VAR) {
         let v = v.trim();
         if !v.is_empty() {
             return Ok(v.to_string());
         }
     }
-    let path = pf_paths::config_dir().join(file);
+    let path = pf_paths::config_dir().join(FILE);
     if let Ok(contents) = fs::read_to_string(&path) {
-        if let Some(tok) = parse_token(&contents, env_var) {
+        if let Some(tok) = parse_token(&contents) {
             return Ok(tok);
         }
     }
@@ -57,29 +37,29 @@ fn load_or_generate_impl(env_var: &str, file: &str) -> Result<String> {
     let dir = pf_paths::config_dir();
     // Owner-private dir (0700 Unix / DACL-locked Windows) so the token can't leak via the config path.
     pf_paths::create_private_dir(&dir).with_context(|| format!("create {}", dir.display()))?;
-    write_token(&path, env_var, &token)?;
-    tracing::info!(path = %path.display(), "generated and persisted API token (owner-only)");
+    write_token(&path, &token)?;
+    tracing::info!(path = %path.display(), "generated and persisted management API token (owner-only)");
     Ok(token)
 }
 
 /// Parse the token from the persisted file: accept either a bare token line or a
-/// `<KEY>=<token>` line (the form we write, also valid as an EnvironmentFile).
-fn parse_token(contents: &str, env_var: &str) -> Option<String> {
+/// `PUNKTFUNK_MGMT_TOKEN=<token>` line (the form we write, also valid as an EnvironmentFile).
+fn parse_token(contents: &str) -> Option<String> {
     let line = contents.lines().find(|l| !l.trim().is_empty())?.trim();
     let tok = line
-        .strip_prefix(env_var)
-        .and_then(|rest| rest.strip_prefix('='))
+        .strip_prefix("PUNKTFUNK_MGMT_TOKEN=")
         .unwrap_or(line)
         .trim();
     (!tok.is_empty()).then(|| tok.to_string())
 }
 
-/// Write `<KEY>=<token>` to `path` as an owner-only secret — 0600 on Unix AND DACL-locked to
-/// SYSTEM/Administrators on Windows. Routes through the shared `write_secret_file` so both bearer
-/// tokens get the SAME Windows lockdown as the host key; the bespoke `cfg(unix)`-only writer used
-/// to leave the mgmt token readable by any local user (security-review 2026-06-28 #2).
-fn write_token(path: &Path, env_var: &str, token: &str) -> Result<()> {
-    let line = format!("{env_var}={token}\n");
+/// Write `PUNKTFUNK_MGMT_TOKEN=<token>` to `path` as an owner-only secret — 0600 on Unix AND
+/// DACL-locked to SYSTEM/Administrators on Windows. Routes through the shared `write_secret_file` so
+/// the mgmt bearer token (full admin authority) gets the SAME Windows lockdown as the host key; the
+/// bespoke `cfg(unix)`-only writer used to leave it readable by any local user (security-review
+/// 2026-06-28 #2).
+fn write_token(path: &Path, token: &str) -> Result<()> {
+    let line = format!("PUNKTFUNK_MGMT_TOKEN={token}\n");
     pf_paths::write_secret_file(path, line.as_bytes())
         .with_context(|| format!("write {}", path.display()))
 }
@@ -90,17 +70,13 @@ mod tests {
 
     #[test]
     fn parses_bare_and_keyvalue_forms() {
-        assert_eq!(parse_token("abc123\n", ENV_VAR).as_deref(), Some("abc123"));
+        assert_eq!(parse_token("abc123\n").as_deref(), Some("abc123"));
         assert_eq!(
-            parse_token("PUNKTFUNK_MGMT_TOKEN=deadbeef\n", ENV_VAR).as_deref(),
+            parse_token("PUNKTFUNK_MGMT_TOKEN=deadbeef\n").as_deref(),
             Some("deadbeef")
         );
-        assert_eq!(
-            parse_token("PUNKTFUNK_PLUGIN_TOKEN=deadbeef\n", PLUGIN_ENV_VAR).as_deref(),
-            Some("deadbeef")
-        );
-        assert_eq!(parse_token("\n  \n", ENV_VAR), None);
-        assert_eq!(parse_token("PUNKTFUNK_MGMT_TOKEN=\n", ENV_VAR), None);
+        assert_eq!(parse_token("\n  \n"), None);
+        assert_eq!(parse_token("PUNKTFUNK_MGMT_TOKEN=\n"), None);
     }
 
     #[test]
@@ -108,9 +84,9 @@ mod tests {
         let dir = std::env::temp_dir().join(format!("pf-mgmt-token-test-{}", std::process::id()));
         let _ = fs::create_dir_all(&dir);
         let path = dir.join(FILE);
-        write_token(&path, ENV_VAR, "cafef00d").unwrap();
+        write_token(&path, "cafef00d").unwrap();
         let read = fs::read_to_string(&path).unwrap();
-        assert_eq!(parse_token(&read, ENV_VAR).as_deref(), Some("cafef00d"));
+        assert_eq!(parse_token(&read).as_deref(), Some("cafef00d"));
         #[cfg(unix)]
         {
             use std::os::unix::fs::PermissionsExt;

crates/punktfunk-host/src/native.rs

@@ -1238,9 +1238,6 @@ async fn serve_session(
     // so mid-session bursts don't consume video frame indexes. An older client (bit clear) gets
     // mid-session probes declined instead — see `run_probe_burst`.
     let probe_seq = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_PROBE_SEQ != 0;
-    // Streamed-AU capability: the client's reassembler accepts sentinel-headed streamed blocks,
-    // so a chunked encoder session may ship an AU's early FEC blocks while its tail encodes.
-    let streamed_au = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_STREAMED_AU != 0;
     let stats_dp = stats; // data-plane handle to the shared stats recorder
                           // Short label for web-console stats captures: the client's cert-fingerprint prefix, else its
                           // peer IP (no fingerprint = anonymous TOFU/--open client).
@@ -1268,10 +1265,6 @@ async fn serve_session(
                 UdpTransport::from_socket_punch(
                     data_sock,
                     &client_udp.to_string(),
-                    // Only honour a punch from the peer QUIC already authenticated: the punch is
-                    // there to discover the NAT-remapped *port*, and `client_udp`'s IP is the
-                    // host-observed QUIC remote (only its port is client-reported).
-                    client_udp.ip(),
                     std::time::Duration::from_millis(2500),
                 )
             };
@@ -1333,7 +1326,6 @@ async fn serve_session(
                         conn: conn_stream,
                         timing_conn,
                         probe_seq,
-                        streamed_au,
                         stats: stats_dp,
                         client_label,
                         launch: launch_for_dp,

crates/punktfunk-host/src/native/control.rs

@@ -16,7 +16,7 @@ use punktfunk_core::quic::{ClipControl, ClipOffer, ClipState};
 #[allow(clippy::too_many_arguments)]
 pub(super) async fn run(
     mut ctrl_send: quinn::SendStream,
-    ctrl_recv: quinn::RecvStream,
+    mut ctrl_recv: quinn::RecvStream,
     initial_mode: punktfunk_core::Mode,
     codec: crate::encode::Codec,
     live_reconfig_ok: bool,
@@ -47,13 +47,9 @@ pub(super) async fn run(
     // coalesces a well-behaved resize drag; compliant clients self-limit to ≥ 1 s).
     const MIN_SWITCH_INTERVAL: std::time::Duration = std::time::Duration::from_millis(500);
     let mut last_accepted_switch: Option<std::time::Instant> = None;
-    // Resumable framing: this read is one arm of a `select!` whose siblings fire on every probe
-    // result / reconfigure / clip offer, so the read future is dropped routinely. `io::read_msg`
-    // would lose the partial frame and misalign the stream for the rest of the session.
-    let mut ctrl_reader = io::MsgReader::new(ctrl_recv);
     loop {
         tokio::select! {
-            msg = ctrl_reader.read_msg() => {
+            msg = io::read_msg(&mut ctrl_recv) => {
                 let Ok(msg) = msg else { break }; // stream closed
                 if let Ok(req) = Reconfigure::decode(&msg) {
                     let now = std::time::Instant::now();

crates/punktfunk-host/src/native/stream.rs

@@ -252,19 +252,6 @@ fn paced_submit(
     let wires = session
         .seal_frame_at(data, pts_ns, flags, frame_index)
         .map_err(|e| anyhow!("seal_frame: {e:?}"))?;
-    pace_sealed(session, wires, deadline, burst_cap, pace_rate_bps)
-}
-
-/// The pace-and-send half of [`paced_submit`], for wires that are ALREADY sealed — shared with
-/// the streamed-AU path, whose seal happens per encoder chunk ([`handle_chunk`]) under the same
-/// microburst policy and frame deadline.
-fn pace_sealed(
-    session: &mut Session,
-    wires: Vec<Vec<u8>>,
-    deadline: std::time::Instant,
-    burst_cap: Option<usize>,
-    pace_rate_bps: u64,
-) -> Result<PaceStat> {
     let mut refs: Vec<&[u8]> = wires.iter().map(|w| w.as_slice()).collect();
     // FEC/recovery test knob (PUNKTFUNK_VIDEO_DROP) — same knob the GameStream plane honors.
     crate::send_pacing::inject_video_drop(&mut refs);
@@ -348,116 +335,6 @@ struct FrameMsg {
     was_measured: bool,
 }
 
-/// What the encode thread hands the send thread: a whole AU (the legacy path — every session
-/// shape except a chunked encoder toward a streamed-capable client), or one slice-boundary
-/// chunk of a streamed AU (§7 LN1 Phase 2 — the send thread seals/paces each chunk's completed
-/// FEC blocks while the encoder still produces the AU's tail).
-enum SendMsg {
-    Frame(FrameMsg),
-    Chunk(ChunkMsg),
-}
-
-/// One encoder chunk of a streamed AU. AU-level fields (`capture_ns`/`flags`/`frame_index`/
-/// `deadline`) are identical on every chunk of one AU (the send thread opens the streamed seal
-/// at `first`); the perf split fields are meaningful on `last` (whole-AU figures, exactly like
-/// [`FrameMsg`]'s).
-struct ChunkMsg {
-    data: Vec<u8>,
-    first: bool,
-    last: bool,
-    capture_ns: u64,
-    flags: u32,
-    frame_index: u32,
-    deadline: std::time::Instant,
-    encode_us: u32,
-    queue_us: u32,
-    cap_us: u32,
-    submit_us: u32,
-    wait_us: u32,
-    repeat: bool,
-    was_measured: bool,
-}
-
-/// A streamed AU the send thread has open: the core's incremental sealer plus the pace
-/// aggregation across its per-chunk flushes (the accounting the whole-AU path reads off one
-/// [`paced_submit`] call).
-struct StreamedOpen {
-    au: punktfunk_core::packet::StreamedAu,
-    spread_us: u32,
-    paced: bool,
-}
-
-/// Feed one [`ChunkMsg`] through the streamed sealer: open at `first`, seal + pace every FEC
-/// block the chunk completes, close (+ final block, real totals) at `last`. Returns
-/// `Some((accounting, aggregated PaceStat))` when the AU finished — the caller runs the same
-/// per-AU accounting as the whole-frame path — and `None` mid-AU.
-fn handle_chunk(
-    session: &mut Session,
-    open: &mut Option<StreamedOpen>,
-    c: ChunkMsg,
-    burst_cap: Option<usize>,
-    pace_rate_bps: u64,
-) -> Result<Option<(FrameMsg, PaceStat)>> {
-    if c.first {
-        if open.take().is_some() {
-            // The encode loop abandoned a mid-flight AU (an encoder stall/rebuild forfeits the
-            // in-flight frame). Its sentinel packets are already on the wire — the client ages
-            // that frame out and the rebuild's IDR re-anchors; just don't leak the open state.
-            tracing::warn!(
-                "streamed AU abandoned mid-flight (encoder rebuild) — client ages it out"
-            );
-        }
-        *open = Some(StreamedOpen {
-            au: session
-                .begin_streamed_frame_at(c.capture_ns, c.flags, c.frame_index)
-                .map_err(|e| anyhow!("begin_streamed_frame: {e:?}"))?,
-            spread_us: 0,
-            paced: false,
-        });
-    }
-    let Some(s) = open.as_mut() else {
-        return Err(anyhow!(
-            "streamed chunk without an open AU (encode-loop bug)"
-        ));
-    };
-    let wires = session
-        .seal_streamed_chunk(&mut s.au, &c.data)
-        .map_err(|e| anyhow!("seal_streamed_chunk: {e:?}"))?;
-    if !wires.is_empty() {
-        let stat = pace_sealed(session, wires, c.deadline, burst_cap, pace_rate_bps)?;
-        s.spread_us = s.spread_us.saturating_add(stat.spread_us);
-        s.paced |= stat.paced;
-    }
-    if !c.last {
-        return Ok(None);
-    }
-    let s = open.take().expect("checked above");
-    let tail = session
-        .seal_streamed_finish(s.au)
-        .map_err(|e| anyhow!("seal_streamed_finish: {e:?}"))?;
-    let stat = pace_sealed(session, tail, c.deadline, burst_cap, pace_rate_bps)?;
-    Ok(Some((
-        FrameMsg {
-            data: Vec::new(), // already on the wire — accounting only
-            capture_ns: c.capture_ns,
-            flags: c.flags,
-            frame_index: c.frame_index,
-            deadline: c.deadline,
-            encode_us: c.encode_us,
-            queue_us: c.queue_us,
-            cap_us: c.cap_us,
-            submit_us: c.submit_us,
-            wait_us: c.wait_us,
-            repeat: c.repeat,
-            was_measured: c.was_measured,
-        },
-        PaceStat {
-            spread_us: s.spread_us.saturating_add(stat.spread_us),
-            paced: s.paced || stat.paced,
-        },
-    )))
-}
-
 /// The dedicated send thread: it owns the whole [`Session`] (so no socket clone or shared stats are
 /// needed) and does FEC+seal + microburst-paced send OFF the capture/encode thread, plus the
 /// speed-test probe bursts (which also need the Session). Decoupling the paced send from encoding
@@ -503,7 +380,7 @@ pub(super) fn reconfig_allowed(
 #[allow(clippy::too_many_arguments)]
 fn send_loop(
     mut session: Session,
-    frame_rx: std::sync::mpsc::Receiver<SendMsg>,
+    frame_rx: std::sync::mpsc::Receiver<FrameMsg>,
     probe_rx: std::sync::mpsc::Receiver<ProbeRequest>,
     probe_result_tx: tokio::sync::mpsc::UnboundedSender<ProbeResult>,
     stop: Arc<AtomicBool>,
@@ -548,119 +425,96 @@ fn send_loop(
     let mut last_frames_dropped = 0u64;
     let mut last_packets_dropped = 0u64;
     let mut last_fec_recovered = 0u64;
-    // The streamed AU currently open (VIDEO_CAP_STREAMED_AU chunked sends) — `Some` strictly
-    // between a `ChunkMsg::first` and its `last`.
-    let mut streamed: Option<StreamedOpen> = None;
     loop {
         if stop.load(Ordering::SeqCst) {
             break;
         }
         // Probes run here (they need the Session); a burst pauses video — the encode thread blocks
-        // on the full frame channel meanwhile, which is exactly the intended pause. Never mid-AU:
-        // a streamed frame's chunks are already leaving the socket, so a burst spliced between
-        // them would push the AU's tail past its deadline (the exact latency the mode removes).
-        if streamed.is_none() {
-            service_probes(&mut session, &stop, &probe_rx, &probe_result_tx, probe_seq);
-        }
+        // on the full frame channel meanwhile, which is exactly the intended pause.
+        service_probes(&mut session, &stop, &probe_rx, &probe_result_tx, probe_seq);
         // Adaptive FEC: pick up any new recovery target the control task set from client LossReports.
         apply_fec_target(&mut session, &fec_target);
         // Short timeout so we keep re-checking `stop` + probes when no frames are flowing.
         match frame_rx.recv_timeout(std::time::Duration::from_millis(50)) {
-            Ok(send_msg) => {
+            Ok(msg) => match paced_submit(
+                &mut session,
+                &msg.data,
+                msg.capture_ns,
+                msg.flags,
+                msg.frame_index,
+                msg.deadline,
+                burst_cap,
                 // Live ABR-tracked encoder bitrate → pace rate; 0 (not yet known) = uncapped.
-                let pace_rate = (stats.bitrate_kbps.load(Ordering::Relaxed) as f64
-                    * 1000.0
-                    * pace_factor) as u64;
-                // `Ok(Some(..))` = an AU fully left the socket (a whole frame, or a streamed
-                // AU's last chunk) — run the per-AU accounting; `Ok(None)` = mid-AU chunk.
-                let outcome = match send_msg {
-                    SendMsg::Frame(msg) => paced_submit(
-                        &mut session,
-                        &msg.data,
-                        msg.capture_ns,
-                        msg.flags,
-                        msg.frame_index,
-                        msg.deadline,
-                        burst_cap,
-                        pace_rate,
-                    )
-                    .map(|stat| Some((msg, stat))),
-                    SendMsg::Chunk(c) => {
-                        handle_chunk(&mut session, &mut streamed, c, burst_cap, pace_rate)
+                (stats.bitrate_kbps.load(Ordering::Relaxed) as f64 * 1000.0 * pace_factor) as u64,
+            ) {
+                Ok(stat) => {
+                    // First VIDEO packets are on the wire — complete the bring-up trace (P0.1;
+                    // once-only, no-op on every later frame). Speed-test filler isn't video.
+                    if msg.flags & FLAG_PROBE as u32 == 0 {
+                        stats.bringup.finish("first_packet");
                     }
-                };
-                match outcome {
-                    // Mid-AU chunk: sealed + on the wire; the per-AU accounting runs at `last`.
-                    Ok(None) => {}
-                    Ok(Some((msg, stat))) => {
-                        // First VIDEO packets are on the wire — complete the bring-up trace (P0.1;
-                        // once-only, no-op on every later frame). Speed-test filler isn't video.
+                    // Host timing (0xCF): stamped now — the AU's packets have fully left the
+                    // socket — against the same capture anchor the wire pts carries, so the
+                    // client's per-frame math tiles exactly (network = its host+network − this).
+                    // Best-effort like every side-plane datagram; skipped for speed-test filler
+                    // (FLAG_PROBE isn't video and its pts is the burst clock).
+                    if let Some(tc) = &timing_conn {
                         if msg.flags & FLAG_PROBE as u32 == 0 {
-                            stats.bringup.finish("first_packet");
-                        }
-                        // Host timing (0xCF): stamped now — the AU's packets have fully left the
-                        // socket — against the same capture anchor the wire pts carries, so the
-                        // client's per-frame math tiles exactly (network = its host+network − this).
-                        // Best-effort like every side-plane datagram; skipped for speed-test filler
-                        // (FLAG_PROBE isn't video and its pts is the burst clock).
-                        if let Some(tc) = &timing_conn {
-                            if msg.flags & FLAG_PROBE as u32 == 0 {
-                                let host_us = (now_ns().saturating_sub(msg.capture_ns) / 1000)
-                                    .min(u32::MAX as u64)
-                                    as u32;
-                                let t = punktfunk_core::quic::HostTiming {
-                                    pts_ns: msg.capture_ns,
-                                    host_us,
-                                    // T0.1 stage split: queue + encode ride the FrameMsg (always
-                                    // measured), pace is this send's spread. The client derives
-                                    // seal/FEC + channel-wait as the residual against host_us.
-                                    stages: Some(punktfunk_core::quic::HostStages {
-                                        queue_us: msg.queue_us,
-                                        encode_us: msg.encode_us,
-                                        pace_us: stat.spread_us,
-                                    }),
-                                };
-                                let _ = tc.send_datagram(
-                                    punktfunk_core::quic::encode_host_timing_datagram(&t).into(),
-                                );
-                            }
-                        }
-                        if perf || stats.rec.is_armed() {
-                            // `encode_us`/`pace_us`/fps are valid for every frame (always measured),
-                            // including the Windows relay + tail-drain frames. The cap/submit/wait splits
-                            // are only real when the frame was measured at capture time — a frame captured
-                            // before this capture armed carries zeroed splits, so skip those (an empty
-                            // window → `percentile()` returns 0) rather than pull the percentiles down.
-                            encode_us.push(msg.encode_us);
-                            pace_us.push(stat.spread_us);
-                            if msg.was_measured {
-                                cap_v.push(msg.cap_us);
-                                submit_v.push(msg.submit_us);
-                                wait_v.push(msg.wait_us);
-                                // Queue age is only meaningful for fresh frames (repeats/tail carry 0
-                                // by construction — including those would drag the percentiles down).
-                                if !msg.repeat {
-                                    queue_v.push(msg.queue_us);
-                                }
-                            }
-                            if msg.repeat {
-                                repeat_frames += 1;
-                            } else {
-                                new_frames += 1;
-                            }
-                            if stat.paced {
-                                paced_frames += 1;
-                            } else {
-                                immediate_frames += 1;
-                            }
+                            let host_us = (now_ns().saturating_sub(msg.capture_ns) / 1000)
+                                .min(u32::MAX as u64)
+                                as u32;
+                            let t = punktfunk_core::quic::HostTiming {
+                                pts_ns: msg.capture_ns,
+                                host_us,
+                                // T0.1 stage split: queue + encode ride the FrameMsg (always
+                                // measured), pace is this send's spread. The client derives
+                                // seal/FEC + channel-wait as the residual against host_us.
+                                stages: Some(punktfunk_core::quic::HostStages {
+                                    queue_us: msg.queue_us,
+                                    encode_us: msg.encode_us,
+                                    pace_us: stat.spread_us,
+                                }),
+                            };
+                            let _ = tc.send_datagram(
+                                punktfunk_core::quic::encode_host_timing_datagram(&t).into(),
+                            );
                         }
                     }
-                    Err(e) => {
-                        tracing::error!(error = %format!("{e:#}"), "send failed — stopping stream");
-                        break;
+                    if perf || stats.rec.is_armed() {
+                        // `encode_us`/`pace_us`/fps are valid for every frame (always measured),
+                        // including the Windows relay + tail-drain frames. The cap/submit/wait splits
+                        // are only real when the frame was measured at capture time — a frame captured
+                        // before this capture armed carries zeroed splits, so skip those (an empty
+                        // window → `percentile()` returns 0) rather than pull the percentiles down.
+                        encode_us.push(msg.encode_us);
+                        pace_us.push(stat.spread_us);
+                        if msg.was_measured {
+                            cap_v.push(msg.cap_us);
+                            submit_v.push(msg.submit_us);
+                            wait_v.push(msg.wait_us);
+                            // Queue age is only meaningful for fresh frames (repeats/tail carry 0
+                            // by construction — including those would drag the percentiles down).
+                            if !msg.repeat {
+                                queue_v.push(msg.queue_us);
+                            }
+                        }
+                        if msg.repeat {
+                            repeat_frames += 1;
+                        } else {
+                            new_frames += 1;
+                        }
+                        if stat.paced {
+                            paced_frames += 1;
+                        } else {
+                            immediate_frames += 1;
+                        }
                     }
                 }
-            }
+                Err(e) => {
+                    tracing::error!(error = %format!("{e:#}"), "send failed — stopping stream");
+                    break;
+                }
+            },
             Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {}
             Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => break, // encode thread done
         }
@@ -944,11 +798,6 @@ pub(super) struct SessionContext {
     /// stale — mid-session probes are DECLINED for it (a zeroed [`ProbeResult`]) rather than
     /// consuming video frame indexes its gap detectors can't see (the phantom-gap freeze).
     pub(super) probe_seq: bool,
-    /// The client advertised [`punktfunk_core::quic::VIDEO_CAP_STREAMED_AU`]: when the session's
-    /// encoder runs chunked poll (multi-slice sub-frame readback, §7 LN1), the host streams each
-    /// AU's FEC blocks under sentinel headers as the slices complete instead of waiting for the
-    /// whole AU. `false` = older client — chunks (if any) are drained whole-AU, zero wire change.
-    pub(super) streamed_au: bool,
     /// Shared streaming-stats recorder. The capture loop reads `is_armed()` per frame to decide
     /// whether to measure the per-stage split; the send thread builds + pushes the aggregated
     /// `StatsSample` at its 2 s boundary.
@@ -983,12 +832,7 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
     // path now reads this typed `SessionPlan` instead of re-deriving from config at each dispatch site
     // (the latent "capture and encode disagree on the backend" hazard, plan §2.4). `bit_depth` is the
     // only per-session input — capture/topology/encoder are otherwise pure functions of `HostConfig`.
-    let mut plan = crate::session_plan::SessionPlan::resolve(
-        ctx.bit_depth,
-        ctx.chroma,
-        ctx.codec,
-        ctx.compositor != pf_vdisplay::Compositor::Gamescope,
-    );
+    let mut plan = crate::session_plan::SessionPlan::resolve(ctx.bit_depth, ctx.chroma, ctx.codec);
     // PyroWave rides the datagram-aligned wire mode (§4.4): every encoder this session opens
     // packetizes at the negotiated shard payload, so a lost datagram costs blocks, not frames.
     if ctx.codec == crate::encode::Codec::PyroWave {
@@ -1022,7 +866,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
         conn,
         timing_conn,
         probe_seq,
-        streamed_au,
         stats,
         client_label,
         launch,
@@ -1030,16 +873,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
         bringup,
         resize_ms,
     } = ctx;
-    // Streamed-AU wire mode: the client's cap AND the host escape hatch (`PUNKTFUNK_STREAMED_AU=0`
-    // reverts to whole-AU sends without touching the encoder's slicing knobs). The third gate —
-    // whether the ENCODER actually chunks — is dynamic (`supports_chunked_poll`, per AU).
-    let streamed_wire = streamed_au && std::env::var("PUNKTFUNK_STREAMED_AU").as_deref() != Ok("0");
-    if streamed_wire {
-        tracing::info!(
-            "client accepts streamed AUs (VIDEO_CAP_STREAMED_AU) — chunked encoder output \
-             will stream per-slice"
-        );
-    }
     tracing::info!(
         compositor = compositor.id(),
         ?mode,
@@ -1199,7 +1032,7 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
     // encode of frame N+1 overlaps the paced transmit of frame N instead of waiting behind its tail.
     // The bounded channel applies backpressure (the encode thread blocks if the send falls behind,
     // so frames slow down rather than a dropped frame freezing the infinite-GOP stream).
-    let (frame_tx, frame_rx) = std::sync::mpsc::sync_channel::<SendMsg>(3);
+    let (frame_tx, frame_rx) = std::sync::mpsc::sync_channel::<FrameMsg>(3);
     // Live encoder bitrate, shared with the send thread's stats sample: a mid-stream adaptive
     // bitrate change (bitrate_rx below) updates it so the console shows the actual target.
     let live_bitrate = Arc::new(AtomicU32::new(bitrate_kbps));
@@ -1374,9 +1207,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
     let mut cur_depth: usize = 1;
     let mut behind_score: u32 = 0;
     let mut depth_frames: u64 = 0;
-    // Second escalation stage (§7 LN3): once depth is maxed (or was never available — Linux),
-    // ask the encoder for pipelined retrieve exactly once. Latched whether it accepts or not.
-    let mut pipeline_asked = false;
     // ~20 net behind-frames (≈0.3 s sustained) escalates; a lone hitch decays away. Warmup skips
     // the first ~1 s so bring-up (display acquire, encoder open) never triggers it.
     const DEPTH_ESCALATE: u32 = 20;
@@ -1637,7 +1467,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
                     frame.is_cuda(),
                     bit_depth,
                     plan.chroma,
-                    plan.cursor_blend,
                 ) {
                     Ok(mut new_enc) => {
                         tracing::info!(
@@ -1648,9 +1477,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
                         if let Some(c) = plan.wire_chunk {
                             new_enc.set_wire_chunking(c);
                         }
-                        // (`max_depth` is computed later in the iteration — read the capturer
-                        // directly so an ABR rebuild re-establishes the bound immediately.)
-                        new_enc.set_input_ring_depth(capturer.pipeline_depth().max(1));
                         enc = new_enc;
                         bitrate_kbps = new_kbps;
                         live_bitrate.store(new_kbps, Ordering::Relaxed);
@@ -2100,116 +1926,6 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
         // carry it to the shared stall recovery below instead of killing the session outright.
         let mut poll_err: Option<anyhow::Error> = None;
         while inflight.len() >= depth {
-            // Streamed chunked drain (§7 LN1 Phase 2): toward a STREAMED_AU client with the
-            // encoder's chunked poll live, forward each slice chunk to the send thread the
-            // moment it's readable, so packetize/FEC/pacing overlap the encode tail. Re-queried
-            // per AU (never cached): a pipelined-retrieve escalation or a session rebuild turns
-            // the mode off and the next AU falls back to the whole-AU path below.
-            if streamed_wire && enc.supports_chunked_poll() {
-                let t_wait = std::time::Instant::now();
-                let mut first_chunk_us = 0u32;
-                let mut au_flags = 0u32;
-                let mut au_done = false;
-                loop {
-                    let c = match enc.poll_chunk() {
-                        Ok(Some(c)) => c,
-                        Ok(None) => break, // defensive: nothing in flight
-                        Err(e) => {
-                            poll_err = Some(e);
-                            break;
-                        }
-                    };
-                    // Every chunk proves the encoder is alive.
-                    last_au_at = std::time::Instant::now();
-                    encoder_resets = 0;
-                    if c.first {
-                        first_chunk_us = t_wait.elapsed().as_micros() as u32;
-                        au_flags = if c.keyframe {
-                            (FLAG_PIC | FLAG_SOF) as u32
-                        } else {
-                            FLAG_PIC as u32
-                        };
-                        let caps = enc.caps();
-                        if caps.intra_refresh_recovery
-                            && caps.intra_refresh_period > 0
-                            && mark_recovery_boundary(
-                                &mut ir_wave_pos,
-                                c.keyframe,
-                                caps.intra_refresh_period,
-                            )
-                        {
-                            au_flags |= punktfunk_core::packet::USER_FLAG_RECOVERY_POINT;
-                        }
-                        if c.recovery_anchor {
-                            au_flags |= punktfunk_core::packet::USER_FLAG_RECOVERY_ANCHOR;
-                        }
-                        if c.chunk_aligned {
-                            au_flags |= punktfunk_core::packet::USER_FLAG_CHUNK_ALIGNED;
-                        }
-                        if let Some(m) = last_hdr_meta {
-                            if c.keyframe || resend_meta {
-                                let _ = conn.send_datagram(
-                                    punktfunk_core::quic::encode_hdr_meta_datagram(&m).into(),
-                                );
-                                resend_meta = false;
-                            }
-                        }
-                        bringup.mark("first_au");
-                    }
-                    let last = c.last;
-                    let (cap_ns, sub_ns, deadline) = *inflight.front().expect("inflight non-empty");
-                    let wait_total_us = t_wait.elapsed().as_micros() as u32;
-                    let encode_us = (now_ns().saturating_sub(sub_ns) / 1000) as u32;
-                    let msg = ChunkMsg {
-                        data: c.data,
-                        first: c.first,
-                        last,
-                        capture_ns: cap_ns,
-                        flags: au_flags,
-                        frame_index: au_seq,
-                        deadline,
-                        encode_us,
-                        queue_us,
-                        cap_us,
-                        submit_us,
-                        wait_us: if measure { wait_total_us } else { 0 },
-                        repeat,
-                        was_measured: measure,
-                    };
-                    if frame_tx.send(SendMsg::Chunk(msg)).is_err() {
-                        send_gone = true;
-                        break;
-                    }
-                    if last {
-                        inflight.pop_front();
-                        au_seq = au_seq.wrapping_add(1);
-                        sent += 1;
-                        au_done = true;
-                        if perf {
-                            st_wait.push(wait_total_us);
-                            // The overlap measurement the Phase-3 gate needs (sampled): how
-                            // early the first slice reached the send thread vs. the whole
-                            // encode — the win is roughly their difference per AU.
-                            if sent % 120 == 0 {
-                                tracing::info!(
-                                    first_slice_us = first_chunk_us,
-                                    encode_us,
-                                    "streamed AU (sampled): first slice handed to send at \
-                                     first_slice_us; encode finished at encode_us"
-                                );
-                            }
-                        }
-                        break;
-                    }
-                }
-                if send_gone || poll_err.is_some() {
-                    break;
-                }
-                if au_done {
-                    continue; // drain the next in-flight frame, if depth allows
-                }
-                break; // defensive Ok(None): leave the frame in flight, re-poll next tick
-            }
             let t_wait = std::time::Instant::now();
             let polled = enc.poll();
             let wait_us = if measure {
@@ -2290,7 +2006,7 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
             // Hand to the send thread; this blocks (backpressure) if it's behind. An Err means it
             // exited (send failure / stop) — end the encode loop too.
             bringup.mark("first_au"); // P0.1 (first-crossing only; free afterwards)
-            if frame_tx.send(SendMsg::Frame(msg)).is_err() {
+            if frame_tx.send(msg).is_err() {
                 send_gone = true;
                 break;
             }
@@ -2337,15 +2053,10 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
         // Adaptive-depth escalate signal (measured BEFORE the trailing sleep): "behind" = the
         // frame's work overran its cadence deadline `next`, so the trailing sleep would be
         // zero/negative. At depth-1 that means the synchronous poll (encode + WDDM wait) can't
-        // fit a frame interval — the contention case pipelining is for — so escalate, and hold
-        // there. Leaky bucket + warmup skip reject one-off hitches and bring-up; no
-        // de-escalation in v1. Two stages: first the CAPTURER's max depth (Windows IDD depth-2
-        // overlap); where depth can't grow (Linux portal is permanently depth-1, §7 LN3), the
-        // ENCODER's pipelined retrieve is the same trade on the other side of submit — the
-        // two-thread lock moves the encode wait off this loop so capture/submit keep cadence,
-        // at ~one tick of AU latency. `enc.set_pipelined` may decline (unsupported backend or
-        // an explicit PUNKTFUNK_NVENC_ASYNC=0); either way it is asked exactly once.
-        if idd_adaptive_enabled() && (cur_depth < max_depth || !pipeline_asked) {
+        // fit a frame interval — the contention case pipelining is for — so escalate to the
+        // capturer's max and hold there. Leaky bucket + warmup skip reject one-off hitches and
+        // bring-up. Once escalated, `cur_depth` stays (no de-escalation in v1).
+        if idd_adaptive_enabled() && cur_depth < max_depth {
             depth_frames += 1;
             if depth_frames > DEPTH_WARMUP_FRAMES {
                 let behind = std::time::Instant::now() >= next;
@@ -2355,27 +2066,13 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
                     behind_score.saturating_sub(1)
                 };
                 if behind_score >= DEPTH_ESCALATE {
-                    if cur_depth < max_depth {
-                        cur_depth = max_depth;
-                        tracing::info!(
-                            depth = cur_depth,
-                            "IDD pipeline depth escalated — encode can't hold cadence at depth-1 \
-                             (GPU contention); pipelining for the rest of the session (latency \
-                             trade for throughput)"
-                        );
-                    } else {
-                        pipeline_asked = true;
-                        if enc.set_pipelined(true) {
-                            tracing::info!(
-                                "encoder pipelined retrieve escalated — encode can't hold \
-                                 cadence and the capturer has no depth to give; the encode wait \
-                                 moves off the loop for the rest of the session (latency trade \
-                                 for throughput)"
-                            );
-                        }
-                    }
-                    // Give the action time to take effect before judging again.
-                    behind_score = 0;
+                    cur_depth = max_depth;
+                    tracing::info!(
+                        depth = cur_depth,
+                        "IDD pipeline depth escalated — encode can't hold cadence at depth-1 \
+                         (GPU contention); pipelining for the rest of the session (latency \
+                         trade for throughput)"
+                    );
                 }
             }
         }
@@ -2435,7 +2132,7 @@ pub(super) fn virtual_stream(ctx: SessionContext, prepared: Option<PreparedDispl
             repeat: false,
             was_measured: false,
         };
-        if frame_tx.send(SendMsg::Frame(msg)).is_err() {
+        if frame_tx.send(msg).is_err() {
             break;
         }
         au_seq = au_seq.wrapping_add(1);
@@ -2557,7 +2254,6 @@ fn try_inplace_resize(
         new_frame.is_cuda(),
         bit_depth,
         plan.chroma,
-        plan.cursor_blend,
     ) {
         Ok(e) => e,
         Err(e) => {
@@ -2569,9 +2265,6 @@ fn try_inplace_resize(
     if let Some(c) = plan.wire_chunk {
         new_enc.set_wire_chunking(c);
     }
-    // Re-report the capturer's ring depth: in-place backends bound async pipelining by it, and a
-    // rebuilt encoder starts with it unset.
-    new_enc.set_input_ring_depth(capturer.pipeline_depth().max(1));
     *enc = new_enc;
     *frame = new_frame;
     *interval = std::time::Duration::from_secs_f64(1.0 / effective_hz.max(1) as f64);
@@ -2626,12 +2319,7 @@ pub(super) fn prepare_display(
     // Same plan resolution as `virtual_stream` (pure in these inputs + host config), including
     // PyroWave's datagram-aligned wire mode — `Session::shard_payload()` echoes the negotiated
     // Welcome value passed here.
-    let mut plan = crate::session_plan::SessionPlan::resolve(
-        bit_depth,
-        chroma,
-        codec,
-        compositor != pf_vdisplay::Compositor::Gamescope,
-    );
+    let mut plan = crate::session_plan::SessionPlan::resolve(bit_depth, chroma, codec);
     if codec == crate::encode::Codec::PyroWave {
         plan.wire_chunk = Some(shard_payload as usize);
     }
@@ -2883,7 +2571,6 @@ fn build_pipeline(
         frame.is_cuda(),
         bit_depth,
         plan.chroma,
-        plan.cursor_blend,
     )
     .context("open video encoder")?;
     if let Some(t) = trace {
@@ -2892,10 +2579,6 @@ fn build_pipeline(
     if let Some(c) = plan.wire_chunk {
         enc.set_wire_chunking(c);
     }
-    // Tell in-place backends (Windows direct-NVENC) how deep they may pipeline against the
-    // capturer's texture ring — without it they use only the env/pool cap and can encode a texture
-    // the capturer has already rotated and overwritten.
-    enc.set_input_ring_depth(capturer.pipeline_depth().max(1));
     // Post-open cross-check: the Welcome already committed `chroma_format` from the pre-open probe, so
     // warn loudly if the encoder actually opened a different chroma than negotiated (the in-band SPS is
     // authoritative for the decoder, but a mismatch means the probe and the live open disagreed).

crates/punktfunk-host/src/plugins.rs

@@ -14,16 +14,9 @@
 //!   package present.
 //!
 //! Windows needs elevation for both halves: the plugins dir lives under the ACL'd
-//! `%ProgramData%\punktfunk` (see `pf_paths::create_private_dir`) and the task is admin-owned. We
+//! `%ProgramData%\punktfunk` (see `pf_paths::create_private_dir`) and the task runs as SYSTEM. We
 //! check up front and print one actionable line instead of letting `bun add` fail with a bare
 //! EACCES.
-//!
-//! The task itself runs as **`NT AUTHORITY\LocalService`**, not SYSTEM: plugins are
-//! operator-installed code, and a plugin defect must cost a throwaway service account, not the
-//! most privileged principal on the box. `enable` converges the principal (migrating tasks an
-//! older installer registered as SYSTEM) and grants LocalService read on exactly the two files
-//! the runner's `connect()` needs — the scoped `plugin-token` and the TLS pin `cert.pem` — never
-//! the full-admin `mgmt-token`.
 
 use anyhow::{bail, Context, Result};
 use std::process::Command;
@@ -78,15 +71,13 @@ USAGE:
 
 NAMES:
     A bare first-party name resolves into the @punktfunk scope: `playnite` installs
-    @punktfunk/plugin-playnite, `rom-manager` installs @punktfunk/plugin-rom-manager —
-    always from Punktfunk's own package registry. Any other name (`punktfunk-plugin-*`,
-    a foreign @scope) installs from the PUBLIC npm registry and is refused unless you
-    pass --allow-public-registry.
+    @punktfunk/plugin-playnite, `rom-manager` installs @punktfunk/plugin-rom-manager.
+    A scoped (@scope/pkg) or `punktfunk-plugin-*` name is used verbatim.
 
 NOTES:
     Plugins run under the runner, which is OPT-IN — `plugins add` installs, `plugins enable`
-    turns the runner on. Plugins are operator-installed code that runs with operator
-    privileges; install only plugins you trust.
+    turns the runner on. Plugins are operator-installed code that runs as the host user;
+    install only plugins you trust.
 "
     );
     #[cfg(target_os = "windows")]
@@ -116,11 +107,7 @@ fn forward_to_runner(args: &[String]) -> Result<()> {
 
 /// Resolve how to invoke the runner CLI: the program plus any leading args (the bundled bun needs
 /// the runner script path passed to it).
-///
-/// Also the plugin store's executor seam ([`crate::store::jobs`]): a console-triggered install runs
-/// the *same* package ops through the *same* runner as the CLI, so there is exactly one
-/// implementation of "install a plugin" on the box (design D4).
-pub(crate) fn runner_command() -> Result<(std::path::PathBuf, Vec<String>)> {
+fn runner_command() -> Result<(std::path::PathBuf, Vec<String>)> {
     #[cfg(target_os = "windows")]
     {
         // The installer lays the payload out as {app}\punktfunk-host.exe, {app}\bun\bun.exe and
@@ -181,163 +168,17 @@ fn disable() -> Result<()> {
     Ok(())
 }
 
+#[cfg(target_os = "linux")]
 fn status() -> Result<()> {
-    let st = runtime_status();
-    println!(
-        "runner:  {}\nstate:   {}\nenabled: {}",
-        st.unit,
-        if !st.installed {
-            "not installed"
-        } else if st.running {
-            "running"
-        } else {
-            "stopped"
-        },
-        st.enabled
-    );
-    if let Some(principal) = &st.principal {
-        println!("runs as: {principal}");
-    }
-    if st.installed && !st.running {
+    let active = systemctl_output(&["is-active", UNIT]).unwrap_or_else(|| "unknown".into());
+    let enabled = systemctl_output(&["is-enabled", UNIT]).unwrap_or_else(|| "unknown".into());
+    println!("runner:  {UNIT}\nenabled: {enabled}\nactive:  {active}");
+    if active != "active" {
         println!("\nStart it with: punktfunk-host plugins enable");
-    } else if !st.installed {
-        println!("\n{}", st.detail);
     }
     Ok(())
 }
 
-// ---- runtime state, shared by the CLI and the plugin store's mgmt API --------------------------
-
-/// Whether the plugin runner is present, switched on, and up.
-///
-/// The store's console surface needs this as data (to offer "enable the runner" before the first
-/// install, and to explain why a freshly installed plugin isn't running yet), so it lives here
-/// rather than being formatted straight to stdout like the CLI once did.
-#[derive(Debug, Clone)]
-pub(crate) struct RuntimeStatus {
-    /// Is the runner payload / service unit on this box at all?
-    pub installed: bool,
-    /// Is it configured to start (systemd `enabled`, or a non-`Disabled` scheduled task)?
-    pub enabled: bool,
-    /// Is it up right now?
-    pub running: bool,
-    /// The unit / task name, so operator-facing copy can name the thing to look at.
-    pub unit: &'static str,
-    /// Windows: the account the task runs as (the SYSTEM→LocalService migration is visible here).
-    pub principal: Option<String>,
-    /// One line of human-readable context, mostly for the "not installed" case.
-    pub detail: String,
-}
-
-#[cfg(target_os = "linux")]
-pub(crate) fn runtime_status() -> RuntimeStatus {
-    let enabled_raw = systemctl_output(&["is-enabled", UNIT]);
-    let active = systemctl_output(&["is-active", UNIT]).unwrap_or_default();
-    // `is-enabled` answers `not-found` when the unit file isn't installed at all; the runner
-    // payload being present is the other half of "can we install plugins".
-    let unit_known = enabled_raw.as_deref().is_some_and(|s| s != "not-found");
-    let installed = unit_known || runner_command().is_ok();
-    RuntimeStatus {
-        installed,
-        enabled: enabled_raw.as_deref() == Some("enabled"),
-        running: active == "active",
-        unit: UNIT,
-        principal: None,
-        detail: if installed {
-            String::new()
-        } else {
-            "the plugin runner package isn't installed (Debian/Ubuntu: `sudo apt install \
-             punktfunk-scripting`)"
-                .into()
-        },
-    }
-}
-
-#[cfg(target_os = "windows")]
-pub(crate) fn runtime_status() -> RuntimeStatus {
-    let out = powershell_output(&format!(
-        "$t = Get-ScheduledTask -TaskName {TASK} -ErrorAction SilentlyContinue; \
-         if ($null -eq $t) {{ 'missing' }} else {{ \"$($t.State)|$($t.Principal.UserId)\" }}"
-    ));
-    match out.as_deref().map(str::trim) {
-        Some("missing") | None => RuntimeStatus {
-            installed: false,
-            enabled: false,
-            running: false,
-            unit: TASK,
-            principal: None,
-            detail: "reinstall punktfunk with the scripting component to get the plugin runner"
-                .into(),
-        },
-        Some(raw) => {
-            let (state, principal) = raw.split_once('|').unwrap_or((raw, ""));
-            RuntimeStatus {
-                installed: true,
-                enabled: !state.eq_ignore_ascii_case("Disabled"),
-                running: state.eq_ignore_ascii_case("Running"),
-                unit: TASK,
-                principal: (!principal.is_empty()).then(|| principal.to_string()),
-                detail: String::new(),
-            }
-        }
-    }
-}
-
-#[cfg(not(any(target_os = "linux", target_os = "windows")))]
-pub(crate) fn runtime_status() -> RuntimeStatus {
-    RuntimeStatus {
-        installed: false,
-        enabled: false,
-        running: false,
-        unit: "punktfunk-scripting",
-        principal: None,
-        detail: "the plugin runner is only available on Linux and Windows hosts".into(),
-    }
-}
-
-/// Switch the runner on or off — the [`enable`]/[`disable`] the CLI runs, exposed for the store's
-/// `POST /store/runtime`. On Windows this is reached from the SYSTEM service, which already clears
-/// the elevation bar the CLI has to check for.
-pub(crate) fn set_runtime_enabled(enabled: bool) -> Result<()> {
-    if enabled {
-        enable()
-    } else {
-        disable()
-    }
-}
-
-/// Restart the runner so it rediscovers installed units. Returns `false` (not an error) when it
-/// isn't running — there is nothing to restart, and the store reports that as "installed, but the
-/// runner is off" rather than as a failure.
-///
-/// Unit discovery happens once at runner startup ([`sdk/src/runner.ts`]), so this restart *is* the
-/// activation step for a newly installed plugin.
-pub(crate) fn restart_runtime() -> Result<bool> {
-    let st = runtime_status();
-    if !st.installed || !st.running {
-        return Ok(false);
-    }
-    #[cfg(target_os = "linux")]
-    {
-        run_systemctl(&["restart", UNIT])?;
-        Ok(true)
-    }
-    #[cfg(target_os = "windows")]
-    {
-        // Stop then start: `Restart-ScheduledTask` does not exist, and a Start on an already-
-        // running task is a no-op rather than a restart.
-        powershell(&format!(
-            "Stop-ScheduledTask -TaskName {TASK} -ErrorAction SilentlyContinue; \
-             Start-ScheduledTask -TaskName {TASK} -ErrorAction Stop"
-        ))?;
-        Ok(true)
-    }
-    #[cfg(not(any(target_os = "linux", target_os = "windows")))]
-    {
-        Ok(false)
-    }
-}
-
 #[cfg(target_os = "linux")]
 fn run_systemctl(args: &[&str]) -> Result<()> {
     let status = Command::new("systemctl")
@@ -371,66 +212,13 @@ fn systemctl_output(args: &[&str]) -> Option<String> {
     }
 }
 
-/// `NT AUTHORITY\LocalService` — the runner task's principal — in icacls SID form.
-#[cfg(target_os = "windows")]
-const LOCAL_SERVICE_SID: &str = "*S-1-5-19";
-
-/// The two (and only two) secrets the runner needs to read to reach the mgmt API: the scoped
-/// plugin token and the host identity cert it pins TLS against. `mgmt-token` (full admin) is
-/// deliberately NOT here.
-#[cfg(target_os = "windows")]
-const RUNNER_SECRET_FILES: [&str; 2] = ["plugin-token", "cert.pem"];
-
-/// The unit directories the runner imports code from. LocalService gets an inheritable
-/// read+execute+write-attributes grant on these: bun's module loader opens unit files
-/// requesting FILE_WRITE_ATTRIBUTES on top of read (plain `(RX)` makes every import die with
-/// EPERM — found on-glass), and WA can only touch timestamps/readonly bits, never content —
-/// the runner's own integrity check (`windowsSddlUnsafeReason`) treats it as harmless.
-#[cfg(target_os = "windows")]
-const RUNNER_UNIT_DIRS: [&str; 2] = ["plugins", "scripts"];
-
-/// The runner's writable state root: `<config_dir>\plugin-state`. A plugin persists its config +
-/// cache under `plugin-state\<name>` (`@punktfunk/host`'s `pluginStateDir`), so LocalService needs
-/// real **Modify** here — unlike the code dirs (RX,WA) and the secrets (R). This keeps the
-/// three-way split crisp: code is read-only (a plugin can't rewrite itself), secrets are
-/// read-only, only this one dir is writable. Inheritable so per-plugin subdirs the runner creates
-/// carry the grant. Users stay read-only (config-dir default), so another non-admin still can't
-/// tamper with a plugin's launch templates.
-#[cfg(target_os = "windows")]
-const RUNNER_STATE_DIRS: [&str; 1] = ["plugin-state"];
-
-/// The plugin **ingest** inbox: `<config_dir>\ingest`. The INVERSE grant of `plugin-state` —
-/// `BUILTIN\Users` gets **Modify**, so an app running as the interactive user (e.g. the Playnite
-/// exporter, a Playnite extension) can drop data (`ingest\<plugin>\…`) that the de-privileged
-/// LocalService runner then READS (LocalService is a member of Users, so it inherits read here).
-/// This is the one place a plugin can receive data produced by *another* account — the runner can
-/// no longer traverse the interactive user's profile the way the old SYSTEM runner could. Scoped
-/// to this one inbox: the rest of the config tree stays Users-read-only, so the widening is a
-/// well-defined drop box, not a general write hole. (Accepted tradeoff: any local user can drop a
-/// file here — trusted-single-user model, and the runner it feeds is only LocalService.)
-#[cfg(target_os = "windows")]
-const RUNNER_INGEST_DIRS: [&str; 1] = ["ingest"];
-
-/// `BUILTIN\Users` (S-1-5-32-545) in icacls SID form — the ingest inbox's writer.
-#[cfg(target_os = "windows")]
-const USERS_SID: &str = "*S-1-5-32-545";
-
 #[cfg(target_os = "windows")]
 fn enable() -> Result<()> {
-    // Converge the task principal BEFORE starting it: the installer registers it as LocalService,
-    // but a task from an older install (or a hand-registered dev box) still runs as SYSTEM, and
-    // enabling that unmigrated would hand operator plugins the highest privilege on the box.
-    // Idempotent; -LogonType ServiceAccount needs no stored password.
-    powershell(&format!(
-        "$p = New-ScheduledTaskPrincipal -UserId 'LocalService' -LogonType ServiceAccount; \
-         Set-ScheduledTask -TaskName {TASK} -Principal $p -ErrorAction Stop | Out-Null"
-    ))?;
-    grant_runner_secret_reads();
     powershell(&format!(
         "Enable-ScheduledTask -TaskName {TASK} -ErrorAction Stop | Out-Null; \
          Start-ScheduledTask -TaskName {TASK} -ErrorAction Stop"
     ))?;
-    println!("Plugin runner enabled and started ({TASK}, runs as LocalService).");
+    println!("Plugin runner enabled and started ({TASK}).");
     Ok(())
 }
 
@@ -440,165 +228,33 @@ fn disable() -> Result<()> {
         "Stop-ScheduledTask -TaskName {TASK} -ErrorAction SilentlyContinue; \
          Disable-ScheduledTask -TaskName {TASK} -ErrorAction Stop | Out-Null"
     ))?;
-    revoke_runner_secret_reads();
     println!("Plugin runner stopped and disabled ({TASK}).");
     Ok(())
 }
 
-/// Grant LocalService **read** on the runner's two secret files. Both are written by the host's
-/// `serve` with a SYSTEM/Administrators-only DACL (`pf_paths::write_secret_file`), which the
-/// de-privileged runner cannot read — this is the one, narrow widening it needs. `/grant:r`
-/// replaces only LocalService's ACE, leaving the lockdown otherwise intact. Files the host hasn't
-/// minted yet get an actionable note instead of a failed icacls: the grant re-runs on the next
-/// `plugins enable`. NOTE: the host re-locks a secret's DACL whenever it rewrites the file (e.g.
-/// a regenerated identity cert) — re-running `plugins enable` restores the grant.
 #[cfg(target_os = "windows")]
-fn grant_runner_secret_reads() {
-    let cfg = pf_paths::config_dir();
-    for name in RUNNER_SECRET_FILES {
-        let path = cfg.join(name);
-        if !path.exists() {
+fn status() -> Result<()> {
+    let out = powershell_output(&format!(
+        "$t = Get-ScheduledTask -TaskName {TASK} -ErrorAction SilentlyContinue; \
+         if ($null -eq $t) {{ 'missing' }} else {{ \
+           $i = Get-ScheduledTaskInfo -TaskName {TASK} -ErrorAction SilentlyContinue; \
+           \"$($t.State)\" }}"
+    ));
+    match out.as_deref().map(str::trim) {
+        Some("missing") | None => {
             println!(
-                "note: {} does not exist yet (the host writes it on first serve). Start the \
-                 host once, then run `punktfunk-host plugins enable` again so the runner can \
-                 authenticate.",
-                path.display()
-            );
-            continue;
-        }
-        let ok = Command::new(icacls_path())
-            .arg(&path)
-            .args(["/grant:r", &format!("{LOCAL_SERVICE_SID}:(R)")])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .is_ok_and(|s| s.success());
-        if !ok {
-            eprintln!(
-                "warning: could not grant LocalService read on {} - the plugin runner may fail \
-                 to authenticate to the management API",
-                path.display()
+                "runner:  {TASK}\nstate:   not installed\n\nReinstall punktfunk with the \
+                 scripting component to get the plugin runner."
             );
         }
-    }
-    // The unit dirs: inheritable (RX,WA) so the runner can import what lives there (see
-    // RUNNER_UNIT_DIRS). Created here if absent — an elevated create inherits the config dir's
-    // protected DACL, and granting now means files the operator adds later are covered by
-    // inheritance rather than needing another `plugins enable`.
-    for name in RUNNER_UNIT_DIRS {
-        let dir = cfg.join(name);
-        if let Err(e) = std::fs::create_dir_all(&dir) {
-            eprintln!("warning: could not create {}: {e}", dir.display());
-            continue;
-        }
-        let ok = Command::new(icacls_path())
-            .arg(&dir)
-            .args(["/grant:r", &format!("{LOCAL_SERVICE_SID}:(OI)(CI)(RX,WA)")])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .is_ok_and(|s| s.success());
-        if !ok {
-            eprintln!(
-                "warning: could not grant LocalService read on {} - the runner may fail to \
-                 import plugins/scripts from it",
-                dir.display()
-            );
+        Some(state) => {
+            println!("runner:  {TASK}\nstate:   {state}");
+            if state.eq_ignore_ascii_case("Disabled") {
+                println!("\nEnable it with: punktfunk-host plugins enable");
+            }
         }
     }
-    // The state root: inheritable Modify so plugins can persist config/cache under
-    // `plugin-state\<name>` (see RUNNER_STATE_DIRS). This is the ONLY writable grant.
-    for name in RUNNER_STATE_DIRS {
-        let dir = cfg.join(name);
-        if let Err(e) = std::fs::create_dir_all(&dir) {
-            eprintln!("warning: could not create {}: {e}", dir.display());
-            continue;
-        }
-        let ok = Command::new(icacls_path())
-            .arg(&dir)
-            .args(["/grant:r", &format!("{LOCAL_SERVICE_SID}:(OI)(CI)(M)")])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .is_ok_and(|s| s.success());
-        if !ok {
-            eprintln!(
-                "warning: could not grant LocalService write on {} - state-writing plugins \
-                 (config/cache) may fail to persist",
-                dir.display()
-            );
-        }
-    }
-    // The ingest inbox: inheritable Modify for BUILTIN\Users, so an interactive-user app (the
-    // Playnite exporter) can drop `ingest\<plugin>\…` for the LocalService runner to read (see
-    // RUNNER_INGEST_DIRS). The one Users-writable carve-out in the otherwise Users-read-only tree.
-    for name in RUNNER_INGEST_DIRS {
-        let dir = cfg.join(name);
-        if let Err(e) = std::fs::create_dir_all(&dir) {
-            eprintln!("warning: could not create {}: {e}", dir.display());
-            continue;
-        }
-        let ok = Command::new(icacls_path())
-            .arg(&dir)
-            .args(["/grant:r", &format!("{USERS_SID}:(OI)(CI)(M)")])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .is_ok_and(|s| s.success());
-        if !ok {
-            eprintln!(
-                "warning: could not open the ingest inbox {} for writes - a plugin fed by an \
-                 interactive-user app (e.g. playnite) may see no data",
-                dir.display()
-            );
-        }
-    }
-}
-
-/// Best-effort removal of the LocalService read grants when the runner is switched off — the
-/// mirror of [`grant_runner_secret_reads`]; `enable` re-grants.
-#[cfg(target_os = "windows")]
-fn revoke_runner_secret_reads() {
-    let cfg = pf_paths::config_dir();
-    for name in RUNNER_SECRET_FILES
-        .iter()
-        .chain(RUNNER_UNIT_DIRS.iter())
-        .chain(RUNNER_STATE_DIRS.iter())
-    {
-        let path = cfg.join(name);
-        if !path.exists() {
-            continue;
-        }
-        let _ = Command::new(icacls_path())
-            .arg(&path)
-            .args(["/remove:g", LOCAL_SERVICE_SID])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status();
-    }
-    // The ingest inbox was opened to Users, not LocalService — remove that explicit grant (the
-    // inherited Users:RX from the config dir remains, so it reverts to read-only, not orphaned).
-    for name in RUNNER_INGEST_DIRS {
-        let path = cfg.join(name);
-        if !path.exists() {
-            continue;
-        }
-        let _ = Command::new(icacls_path())
-            .arg(&path)
-            .args(["/remove:g", USERS_SID])
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status();
-    }
-}
-
-/// Resolve icacls by full System32 path rather than PATH — same planted-binary reasoning as
-/// [`powershell_path`]; matches `pf_paths`.
-#[cfg(target_os = "windows")]
-fn icacls_path() -> String {
-    std::env::var("SystemRoot")
-        .map(|r| format!(r"{r}\System32\icacls.exe"))
-        .unwrap_or_else(|_| "icacls".to_string())
+    Ok(())
 }
 
 /// Resolve powershell by full System32 path rather than PATH — CreateProcess searches the launching
@@ -726,3 +382,8 @@ fn enable() -> Result<()> {
 fn disable() -> Result<()> {
     bail!("the plugin runner is only available on Linux and Windows hosts")
 }
+
+#[cfg(not(any(target_os = "linux", target_os = "windows")))]
+fn status() -> Result<()> {
+    bail!("the plugin runner is only available on Linux and Windows hosts")
+}

crates/punktfunk-host/src/session_plan.rs

@@ -103,11 +103,6 @@ pub struct SessionPlan {
     /// PyroWave session — applied to EVERY encoder this plan opens (initial + all rebuilds) so
     /// AUs stay shard-aligned across mode/bitrate/stall rebuilds. `None` for the H.26x codecs.
     pub wire_chunk: Option<usize>,
-    /// The session may hand the encoder cursor bitmaps to composite (cursor-as-metadata
-    /// captures — every non-gamescope compositor; gamescope embeds the pointer itself).
-    /// Encoders whose fast path cannot blend (the Vulkan EFC RGB-direct source) stay on their
-    /// blending path when this is set, so the pointer never silently vanishes from the stream.
-    pub cursor_blend: bool,
 }
 
 impl SessionPlan {
@@ -117,7 +112,6 @@ impl SessionPlan {
         bit_depth: u8,
         chroma: crate::encode::ChromaFormat,
         codec: crate::encode::Codec,
-        cursor_blend: bool,
     ) -> Self {
         SessionPlan {
             capture: CaptureBackend::resolve(),
@@ -128,7 +122,6 @@ impl SessionPlan {
             chroma,
             codec,
             wire_chunk: None,
-            cursor_blend,
         }
     }
 

crates/punktfunk-host/src/spike.rs

@@ -147,7 +147,6 @@ pub fn run(opts: Options) -> Result<()> {
         first.is_cuda(),
         8,                            // spike synthetic harness: 8-bit
         encode::ChromaFormat::Yuv420, // ...and 4:2:0
-        false,                        // synthetic frames carry no cursor
     )
     .context("open encoder")?;