fix(client-linux): Deck raw-pad capture — clear Steam's SDL device filter, honest degradation warning

The Deck's built-in controller can never leave Steam Input ("Steam Controller"
is always-required in the shortcut's matrix; Disable Steam Input only affects
other controller brands), so the raw 28DE:1205 device is the only path to the
trackpads/paddles/gyro. Steam hides it from SDL by launching shortcuts with
SDL_GAMECONTROLLER_IGNORE_DEVICES naming every physical pad it virtualized —
clear it (and _EXCEPT) at startup while single-threaded, logging what Steam set
as field evidence. The post-attach warning now states the real condition (raw
pad never enumerated; sticks + buttons still work) instead of advising a
Steam Input toggle that doesn't exist for the built-in controller.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cargo.lock

@@ -2119,7 +2119,7 @@ dependencies = [
 
 [[package]]
 name = "latency-probe"
-version = "0.7.1"
+version = "0.7.2"
 
 [[package]]
 name = "lazy_static"
@@ -2251,7 +2251,7 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "loss-harness"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "punktfunk-core",
 ]
@@ -2875,7 +2875,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-android"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "android_logger",
  "jni",
@@ -2889,7 +2889,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-linux"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -2911,7 +2911,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-windows"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -2934,7 +2934,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-core"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "aes-gcm",
  "bytes",
@@ -2964,7 +2964,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-host"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -3034,7 +3034,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-probe"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "anyhow",
  "mdns-sd",
@@ -3048,7 +3048,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-tray"
-version = "0.7.1"
+version = "0.7.2"
 dependencies = [
  "anyhow",
  "ksni",

Cargo.toml

@@ -17,7 +17,7 @@ members = [
 exclude = ["packaging/linux/steam-deck-gadget/usbip-poc"]
 
 [workspace.package]
-version = "0.7.1"
+version = "0.7.2"
 edition = "2021"
 rust-version = "1.82"
 license = "MIT OR Apache-2.0"

clients/linux/src/app.rs

@@ -116,6 +116,23 @@ pub fn run() -> glib::ExitCode {
             tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
         )
         .init();
+    // Steam launches its shortcuts with SDL_GAMECONTROLLER_IGNORE_DEVICES naming every
+    // physical pad Steam Input has virtualized — SDL then hides the real device so games
+    // only see the virtual X360 pad. Right for games, wrong for us: capturing the Deck's
+    // built-in controller (trackpads/paddles/gyro, 28DE:1205) needs SDL's HIDAPI driver
+    // to enumerate the REAL device, and the built-in pad can never leave Steam Input
+    // ("Steam Controller" is always-required), so this filter is the only off switch we
+    // get. Clear it while still single-threaded (the gamepad worker starts with the UI);
+    // we dedupe the virtual pad ourselves (`gamepad.rs` `active_id` skips steam_virtual).
+    for var in [
+        "SDL_GAMECONTROLLER_IGNORE_DEVICES",
+        "SDL_GAMECONTROLLER_IGNORE_DEVICES_EXCEPT",
+    ] {
+        if let Ok(v) = std::env::var(var) {
+            tracing::info!(var, value = %v, "clearing Steam's SDL device filter");
+            std::env::remove_var(var);
+        }
+    }
     // Headless pairing path (no GTK window): `--pair <PIN> --connect host[:port] [--name N]`.
     // Used by the Decky plugin (a GTK dialog can't pop under gamescope) and for scripting.
     if let Some(pin) = crate::cli::arg_value("--pair") {

clients/linux/src/launch.rs

@@ -280,6 +280,39 @@ impl SessionUi {
         if self.app.fullscreen || self.app.settings.borrow().fullscreen_on_stream {
             self.app.window.fullscreen();
         }
+        // A Deck streaming without its raw built-in controller is invisible degradation:
+        // SDL sees only Steam's virtual X360 pad, so the right trackpad arrives at the
+        // host as whatever Steam's template synthesizes (a right stick by default) and
+        // the left trackpad, paddles and gyro not at all. The built-in pad can never
+        // leave Steam Input ("Steam Controller" is always-required in the shortcut's
+        // matrix — Disable Steam Input only affects other brands), so raw capture rides
+        // the session-scoped Valve HIDAPI drivers + the cleared SDL device filter (see
+        // `app::run`). The real 28DE:1205 identity enumerates shortly after attach —
+        // check once that settles and say so, instead of streaming silently degraded.
+        if crate::gamepad::is_steam_deck() {
+            let app = self.app.clone();
+            let stop = self.stop.clone();
+            glib::timeout_add_seconds_local_once(4, move || {
+                if stop.load(std::sync::atomic::Ordering::Relaxed) {
+                    return; // session already over
+                }
+                if app.gamepad.active().is_none_or(|pad| pad.steam_virtual) {
+                    tracing::warn!(
+                        "the Deck's raw built-in controller (28DE:1205) never enumerated \
+                         — only Steam's virtual pad is visible, so trackpads, paddles and \
+                         gyro can't be captured (sticks + buttons still work). Check the \
+                         startup log for SDL_GAMECONTROLLER_IGNORE_DEVICES and the \
+                         Settings controller list."
+                    );
+                    let toast = adw::Toast::new(
+                        "Steam is only exposing its virtual gamepad — trackpads, paddles \
+                         and gyro won't reach the game (sticks and buttons still work).",
+                    );
+                    toast.set_timeout(12);
+                    app.toasts.add_toast(toast);
+                }
+            });
+        }
         self.page = Some(p);
     }
 

clients/linux/src/video.rs

@@ -187,6 +187,25 @@ impl Decoder {
             .ok()
             .filter(|v| !v.is_empty())
             .unwrap_or_else(|| pref.to_string());
+        // The Steam Deck's VAAPI zero-copy path renders corrupt/gray/washed-out — validated live;
+        // software decode is clean, correct-colour, and the Deck's APU handles 1280×800 HEVC
+        // easily. Likely cause: since Mesa 25.1 radeonsi exports VCN decode surfaces TILED (with
+        // AMD modifiers) instead of linear, and inside the Flatpak both the VAAPI driver and GTK's
+        // GL come from the runtime's Mesa 26.x — GTK's tiled-NV12 dmabuf import mishandles the new
+        // layout (desktop AMD/Intel boxes validated Tier-1 ran distro Mesa with linear export).
+        // So `auto` resolves to software on a Deck; an explicit `vaapi` (Settings or
+        // PUNKTFUNK_DECODER=vaapi) still forces the hw path for testing — the first-frame
+        // descriptor dump logs the modifier (LINEAR = 0x0), and GSK_RENDERER=ngl|vulkan bisects
+        // the import side.
+        let choice = if (choice == "auto" || choice.is_empty()) && crate::gamepad::is_steam_deck() {
+            tracing::info!(
+                "Steam Deck — defaulting to software decode (AMD VAAPI dmabuf is broken on this \
+                 SteamOS+Mesa combo); set the decoder to `vaapi` to override"
+            );
+            "software".to_string()
+        } else {
+            choice
+        };
         if choice != "software" {
             match VaapiDecoder::new(codec_id) {
                 Ok(v) => {
@@ -456,6 +475,14 @@ impl VaapiDecoder {
             (*ctx).get_format = Some(pick_vaapi);
             (*ctx).flags |= ffi::AV_CODEC_FLAG_LOW_DELAY as i32;
             (*ctx).thread_count = 1; // hwaccel: threads only add latency
+
+            // The presenter holds mapped surfaces PAST receive_frame (the paintable's
+            // current texture + the newest frame in flight each pin one until GDK's
+            // release func) — surfaces libavcodec doesn't know are missing from its
+            // fixed-size VAAPI pool. Without headroom the decoder can recycle a surface
+            // the renderer is still sampling (intermittent block corruption) or fail
+            // allocation under scheduling jitter.
+            (*ctx).extra_hw_frames = 4;
             let r = ffi::avcodec_open2(ctx, codec, ptr::null_mut());
             if r < 0 {
                 let mut ctx = ctx;

crates/punktfunk-host/src/inject/linux/steam_controller.rs

@@ -276,12 +276,43 @@ impl DeckTransport {
     }
 }
 
+/// One-shot diagnostic: InputPlumber (shipped and enabled by default on Bazzite) hidraw-grabs
+/// controllers it decides to manage and re-emits them under a different identity — historically
+/// the Deck config re-emitted an Xbox Elite pad with the trackpads routed to a mouse target. If
+/// it grabs our virtual Deck, everything downstream of hid-steam looks wrong (trackpads surface
+/// as a stick/mouse, gyro vanishes) while punktfunk's own logs stay clean — so name the suspect
+/// up front. Best-effort process-name scan; no dependency on its D-Bus API.
+fn warn_if_inputplumber() {
+    use std::sync::atomic::{AtomicBool, Ordering};
+    static ONCE: AtomicBool = AtomicBool::new(true);
+    if !ONCE.swap(false, Ordering::Relaxed) {
+        return;
+    }
+    let running = std::fs::read_dir("/proc")
+        .ok()
+        .into_iter()
+        .flatten()
+        .flatten()
+        .any(|e| {
+            std::fs::read_to_string(e.path().join("comm")).is_ok_and(|c| c.trim() == "inputplumber")
+        });
+    if running {
+        tracing::warn!(
+            "InputPlumber is running on this host — if it manages the virtual Steam Deck pad, \
+             games see InputPlumber's re-emitted device instead (trackpads may arrive as a \
+             stick/mouse, gyro may vanish). Check `inputplumber devices` and exclude the \
+             virtual pad from management if inputs look remapped."
+        );
+    }
+}
+
 /// Open the best Steam-Input-promotable Deck transport available, in preference order:
 /// **`raw_gadget` (SteamOS validated fast-path) → `usbip`/`vhci_hcd` (universal, Secure-Boot-clean)
 /// → UHID (universal, but `Interface: -1` so Steam Input won't promote it).** Each rung degrades to
 /// the next on failure, so a host lacking the gadget modules still gets a *promotable* Deck via
 /// usbip, and one lacking both still gets a working (if non-promoted) UHID pad.
 fn open_transport(idx: u8) -> Result<DeckTransport> {
+    warn_if_inputplumber();
     use crate::inject::{steam_gadget, steam_usbip};
     // 1. raw_gadget — the validated SteamOS fast-path (default on there).
     if steam_gadget::gadget_preferred() {

packaging/bazzite/README.md

@@ -62,6 +62,38 @@ systemctl reboot
 > The **reboot is mandatory** — `rpm-ostree install` stages a new deployment that only takes
 > effect on the next boot. This is normal atomic-distro behavior, not a punktfunk quirk.
 
+#### Updating a Path-A host — `rpm-ostree upgrade` is NOT enough
+
+> ⚠️ **`rpm-ostree upgrade` will not update punktfunk on its own.** `upgrade` bumps the **base
+> image** and only re-resolves *layered* packages **when the base changes**. A Bazzite base can
+> sit frozen for months (a pinned `:stable` tag, a paused rebase), so `rpm-ostree upgrade` keeps
+> reporting *"No updates available"* and your layered `punktfunk` stays put even after new RPMs
+> land in the repo. (Diagnose: `rpm-ostree status` shows the base `Version:` unchanged, while
+> `dnf -q repoquery --upgrades punktfunk` lists newer builds.)
+
+To actually pull a newer host on a static base, force rpm-ostree to re-resolve just the punktfunk
+layer — remove + re-add the same names in one transaction:
+
+```sh
+sudo rpm-ostree refresh-md --force
+sudo rpm-ostree update \
+  --uninstall punktfunk --uninstall punktfunk-web \
+  --install   punktfunk --install   punktfunk-web
+systemctl reboot
+```
+
+Or just run the helper, which detects what's layered and does the above:
+
+```sh
+sudo bash packaging/bazzite/update-punktfunk.sh          # stage; reboot when ready
+sudo bash packaging/bazzite/update-punktfunk.sh --reboot # stage + reboot now
+```
+
+> **Channel gotcha:** the re-resolve picks the highest version across **every enabled**
+> `/etc/yum.repos.d/punktfunk*.repo`. If `punktfunk-canary.repo` is enabled alongside the stable
+> `punktfunk.repo`, canary's `<next-minor>.0-0.ciN` **outranks** the stable `X.Y.Z-1` and the box
+> silently tracks canary. Enable exactly one channel — set `enabled=0` in the other repo file.
+
 ### Path B — bootc image (`FROM bazzite-nvidia`)
 
 The image is built **off-host** (on any machine with `podman`) from

packaging/bazzite/update-punktfunk.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Update the layered punktfunk packages on a Bazzite / Fedora-Atomic host.
+#
+# Why this exists: `rpm-ostree upgrade` upgrades the *base image* and only re-resolves
+# layered packages WHEN THE BASE CHANGES. Bazzite bases can sit frozen for months (a pinned
+# `:stable` tag, a paused rebase), so `rpm-ostree upgrade` keeps reporting "No updates
+# available" and your layered punktfunk never moves even though newer RPMs are in the repo.
+# The fix is to force rpm-ostree to re-resolve just the punktfunk layer against the latest
+# repo metadata — an `--uninstall … --install …` of the same package names in one
+# transaction. This script does that for whichever of punktfunk / punktfunk-web are layered.
+#
+# Usage:  sudo bash update-punktfunk.sh          # stage the newest; you reboot when ready
+#         sudo bash update-punktfunk.sh --reboot # stage, then reboot immediately
+#
+# Channel note: it re-resolves against every ENABLED punktfunk repo. If both
+# `punktfunk.repo` (stable) and `punktfunk-canary.repo` are enabled, canary's version sorts
+# higher and WINS — the box silently tracks canary. Enable exactly the channel you want
+# (set `enabled=0` in the other `/etc/yum.repos.d/punktfunk*.repo`).
+set -euo pipefail
+
+if [[ $EUID -ne 0 ]]; then
+  echo "run as root: sudo bash $0 ${*:-}" >&2
+  exit 1
+fi
+
+# Which punktfunk packages are actually layered right now (host, web, or both).
+mapfile -t layered < <(rpm-ostree status --json 2>/dev/null \
+  | grep -oE '"punktfunk(-web)?"' | tr -d '"' | sort -u)
+if [[ ${#layered[@]} -eq 0 ]]; then
+  # Fall back to the rpm db if the JSON shape ever changes.
+  mapfile -t layered < <(rpm -qa --qf '%{NAME}\n' 'punktfunk' 'punktfunk-web' 2>/dev/null | sort -u)
+fi
+if [[ ${#layered[@]} -eq 0 ]]; then
+  echo "no punktfunk packages are layered — install first (see packaging/bazzite/README.md)" >&2
+  exit 1
+fi
+echo "layered punktfunk packages: ${layered[*]}"
+
+# Fresh repo metadata, else the re-resolve can pick a stale 'newest'.
+rpm-ostree refresh-md --force >/dev/null
+
+# Force the re-resolve: remove + re-add the same names in ONE transaction so the box is never
+# left without the host, and rpm-ostree picks the newest available version.
+args=()
+for p in "${layered[@]}"; do args+=(--uninstall "$p"); done
+for p in "${layered[@]}"; do args+=(--install "$p"); done
+echo "+ rpm-ostree update ${args[*]}"
+rpm-ostree update "${args[@]}"
+
+echo
+echo "Staged. The new version activates on the next boot."
+if [[ "${1:-}" == "--reboot" ]]; then
+  echo "rebooting now…"
+  systemctl reboot
+else
+  echo "Reboot when ready:  systemctl reboot"
+fi

packaging/flatpak/io.unom.Punktfunk.yml

@@ -64,10 +64,16 @@ finish-args:
   # does not apply.
   - --device=all
   - --filesystem=/run/udev:ro        # SDL/HIDAPI enumerates devices via udev
-  # --- audio: PipeWire via its PulseAudio shim — covers playback AND mic uplink. SteamOS
-  #     exposes PipeWire-pulse here; --socket=pulseaudio is the portable arg Moonlight/chiaki
-  #     also use on the Deck (a bare --socket=pipewire would also need the camera/portal dance
-  #     for capture; the pulse shim gives mic + speaker in one grant). ---
+  # --- audio: the client speaks the NATIVE PipeWire protocol (audio.rs `pw connect`), NOT the
+  #     PulseAudio shim — so it needs the real `pipewire-0` socket in the sandbox. With only
+  #     --socket=pulseaudio the sandbox has just `pulse/native`, no `pipewire-0`, and playback +
+  #     mic both die with "pw connect (is PipeWire running in this session?)" (observed live on the
+  #     Deck in Gaming Mode). We bind the native socket via --filesystem=xdg-run/pipewire-0 (NOT
+  #     --socket=pipewire: this flatpak-builder toolchain rejects it as an "Unknown socket type",
+  #     and the Deck's flatpak 1.16 override CLI does too — the filesystem bind is the portable
+  #     form, validated on-Deck to make pipewire-0 appear + the client register its audio node).
+  #     --socket=pulseaudio stays as a fallback for any pulse-only path. ---
+  - --filesystem=xdg-run/pipewire-0
   - --socket=pulseaudio
   # --- network: QUIC control + UDP data plane + mDNS discovery (_punktfunk._udp) ---
   - --share=network