fix(client/apple): two DualSenses stop fighting over one device, and a failed stop stops lying

Five faults in the Apple client's feedback path.

With two DualSenses attached, each pad's renderer opened "the first connected
DualSense" — taken from an unordered Set, so the choice could differ between
two calls in one process. Both renderers could land on the same device, one
pad's rumble coming out of the other while their per-instance write dedupes
fought over it, or they could split by luck. Each renderer now asks for the
device its own controller is, correlating GameController's stable ordering with
IOKit's location ids; the selection rule is a pure function so it can be tested
without an IOHIDDevice, which cannot be constructed. Without a preference the
lowest location id wins — still arbitrary, but stable, which Set.first was not.

A failed HID write was logged and swallowed, so a write that never reached the
device still counted as a successful render. That matters most for a stop,
which has nothing behind it: the renderer stamped its write clock even on
failure, the keepalive only re-writes non-zero levels, the ticker is cancelled
once the target is zero, and on USB there is no firmware timeout. A swallowed
stop therefore left the motors running with nothing scheduled to try again.
The write result now reaches the caller, which drops the handle and falls back
to CoreHaptics rather than claiming success.

A half-failed split-handle setup reported HEALTHY. Only the all-nil case
counted as failure, so one surviving handle passed silently while rendering
something wrong in a direction that depended on which handle died: lose the
right one and render falls to the combined branch, playing max(low, high) on
the LEFT handle; lose the left and the split branch discards the heavy motor
outright. A half-open split now tears the survivor down and takes the combined
path, which at least renders both motors somewhere.

Session end never put the lightbar out. This class is what turned it on, and
every DS write is valid-flag-selective, so a game's last colour stayed lit in
firmware after the stream ended — a DS4 was cleared incidentally because its
player indicator IS the lightbar, a DualSense was not.

And the renderer's stop() ran on the main actor. It is a queue.sync whose body
is a per-motor CHHapticEngine.stop() — an XPC round trip the renderer's own
notes record as able to hang — plus a blocking HID write to a device that has
just departed, and it queues behind any in-flight setup(). It runs on every
unplug and every pin change, and the main thread drives the presenter's
CADisplayLink, so it hitched the picture mid-stream. It is detached now; the
renderer is already off routing by then, so nothing observes it.

Verified: swift build clean, 188 tests pass (185 before), and the three new
device-selection tests fail if the deterministic fallback is reverted.

Note for anyone rebuilding here: the checked-in xcframework was stale (it
predates punktfunk_connection_report_phase) and build-xcframework.sh still dies
on this Mac at its macOS-floor guard. A macos-arm64 slice assembled by hand
from `cargo build --target aarch64-apple-darwin` is enough to typecheck.

From the 2026-08-03 force-feedback sweep (B14, B15, B18, B19, B20).

clients/apple/Sources/PunktfunkKit/Gamepad/DualSenseHID.swift

@@ -21,8 +21,12 @@ import os
 
 private let log = Logger(subsystem: "io.unom.punktfunk", category: "gamepad")
 
-/// Opens the first connected Sony DualSense and forwards motor rumble to it over raw HID.
-/// Single-pad model (we forward exactly one controller), so the first match is the right one.
+/// Opens one connected Sony DualSense and forwards motor rumble to it over raw HID.
+///
+/// A caller that owns a particular pad passes the location id it wants (see
+/// `open(preferringLocationID:)`); the renderer takes that from the `GCController` it is bound to,
+/// so with two DualSenses attached each renderer drives its own device. Without a preference the
+/// lowest location id wins — an arbitrary but *stable* choice, where `Set.first` was neither.
 final class DualSenseHID {
     private let manager: IOHIDManager
     private var device: IOHIDDevice?
@@ -43,9 +47,57 @@ final class DualSenseHID {
 
     deinit { close() }
 
-    /// Find and open the first connected DualSense. Returns false if none is present or it can't
-    /// be opened (caller then falls back to CoreHaptics).
-    func open() -> Bool {
+    /// The IOKit location id of the device this instance opened — the handle a caller correlates
+    /// with its `GCController`. `nil` until a successful `open`.
+    private(set) var locationID: UInt32?
+
+    /// A device's location id, or `nil` if IOKit does not report one.
+    static func locationID(of dev: IOHIDDevice) -> UInt32? {
+        IOHIDDeviceGetProperty(dev, kIOHIDLocationIDKey as CFString) as? UInt32
+    }
+
+    /// Every connected DualSense/Edge, by location id — what a caller pairs against its controllers.
+    static func attachedLocationIDs() -> [UInt32] {
+        let mgr = IOHIDManagerCreate(kCFAllocatorDefault, IOOptionBits(kIOHIDOptionsTypeNone))
+        let matches = productIDs.map { pid in
+            [kIOHIDVendorIDKey: vendorSony, kIOHIDProductIDKey: pid] as CFDictionary
+        }
+        IOHIDManagerSetDeviceMatchingMultiple(mgr, matches as CFArray)
+        guard IOHIDManagerOpen(mgr, IOOptionBits(kIOHIDOptionsTypeNone)) == kIOReturnSuccess else {
+            return []
+        }
+        defer { IOHIDManagerClose(mgr, IOOptionBits(kIOHIDOptionsTypeNone)) }
+        let devices = IOHIDManagerCopyDevices(mgr) as? Set<IOHIDDevice> ?? []
+        return devices.compactMap(locationID(of:)).sorted()
+    }
+
+    /// Which attached device to drive, as an index into `ids` — the whole selection rule, pure so
+    /// it can be tested without an `IOHIDDevice` (which cannot be constructed).
+    ///
+    /// `IOHIDManagerCopyDevices` returns an unordered `Set`, so the previous `Set.first` was not
+    /// merely arbitrary — it can differ between two calls in one process. With two DualSenses that
+    /// made each renderer's pad→device binding a coin flip: both could land on the same device
+    /// (one pad's rumble coming out of the other, and the two per-instance write dedupes fighting
+    /// over it) or split by luck. An explicit location id makes the binding deterministic; the
+    /// lowest-id fallback at least makes it stable. `nil` ids sort last so a device IOKit cannot
+    /// place never displaces one it can.
+    static func preferredIndex(among ids: [UInt32?], preferring wanted: UInt32?) -> Int? {
+        if let wanted, let hit = ids.firstIndex(where: { $0 == wanted }) { return hit }
+        return ids.indices.min { (ids[$0] ?? .max) < (ids[$1] ?? .max) }
+    }
+
+    /// Pick the device to drive from everything attached (see [`preferredIndex`]).
+    static func pick(_ devices: Set<IOHIDDevice>, preferring wanted: UInt32?) -> IOHIDDevice? {
+        let ordered = Array(devices)
+        guard let i = preferredIndex(among: ordered.map(locationID(of:)), preferring: wanted) else {
+            return nil
+        }
+        return ordered[i]
+    }
+
+    /// Find and open a connected DualSense, preferring the one at `preferredLocationID`. Returns
+    /// false if none is present or it can't be opened (caller then falls back to CoreHaptics).
+    func open(preferringLocationID preferred: UInt32? = nil) -> Bool {
         let matches = Self.productIDs.map { pid in
             [kIOHIDVendorIDKey: Self.vendorSony, kIOHIDProductIDKey: pid] as CFDictionary
         }
@@ -55,13 +107,21 @@ final class DualSenseHID {
             return false
         }
         guard let devices = IOHIDManagerCopyDevices(manager) as? Set<IOHIDDevice>,
-              let dev = devices.first
+              let dev = Self.pick(devices, preferring: preferred)
         else {
             log.info("rumble: no DualSense HID device found — falling back to CoreHaptics")
             IOHIDManagerClose(manager, IOOptionBits(kIOHIDOptionsTypeNone))
             return false
         }
         device = dev
+        locationID = Self.locationID(of: dev)
+        if let preferred, locationID != preferred {
+            // Not fatal — one pad still gets rumble — but with two pads attached it means this
+            // renderer is driving the wrong one, and it is invisible without the log line.
+            log.error(
+                "rumble: wanted DualSense at location \(preferred, privacy: .public) but opened \(self.locationID.map(String.init) ?? "unknown", privacy: .public)"
+            )
+        }
         let transport = IOHIDDeviceGetProperty(dev, kIOHIDTransportKey as CFString) as? String
         bluetooth = transport?.lowercased().contains("bluetooth") ?? false
         log.info("rumble: DualSense raw-HID rumble active (transport=\(self.transport, privacy: .public))")
@@ -70,8 +130,16 @@ final class DualSenseHID {
 
     /// Drive the motors. `low` = left/heavy (low-frequency), `high` = right/light (high-frequency),
     /// each 0...255. (0, 0) stops.
-    func rumble(low: UInt8, high: UInt8) {
-        guard let dev = device else { return }
+    ///
+    /// Returns whether the write reached the device. The caller needs this: it used to be logged
+    /// and swallowed, so a failed write still counted as a successful render. That matters most
+    /// for a **stop**, which has nothing behind it — the renderer stamps its write clock even on
+    /// failure, the keepalive re-write only fires for non-zero levels, and the ticker is cancelled
+    /// once the target is `(0, 0)`. On USB there is no firmware timeout either, so a swallowed
+    /// stop left the motors running with nothing scheduled to try again.
+    @discardableResult
+    func rumble(low: UInt8, high: UInt8) -> Bool {
+        guard let dev = device else { return false }
         let report = bluetooth
             ? Self.bluetoothReport(low: low, high: high)
             : Self.usbReport(low: low, high: high)
@@ -81,7 +149,9 @@ final class DualSenseHID {
         }
         if rc != kIOReturnSuccess {
             log.error("rumble: IOHIDDeviceSetReport failed (0x\(String(format: "%08x", rc), privacy: .public))")
+            return false
         }
+        return true
     }
 
     func close() {

clients/apple/Sources/PunktfunkKit/Gamepad/GamepadFeedback.swift

@@ -117,7 +117,15 @@ public final class GamepadFeedback {
             reset(slot.controller)
             slots[pad] = nil
             let renderer = withRouting { rumbleByPad.removeValue(forKey: pad) }
-            renderer?.stop()
+            // OFF the main actor. `RumbleRenderer.stop()` is a `queue.sync`, and its body is a
+            // per-motor `CHHapticEngine.stop()` — an XPC round trip to gamecontrollerd, which the
+            // renderer's own notes record as able to hang — plus `DualSenseHID.close()`, whose
+            // blocking `IOHIDDeviceSetReport` goes to a device that has just departed. It also
+            // queues behind any in-flight `setup()`. This runs on every unplug and every pin
+            // change, and the main thread is what drives the presenter's CADisplayLink, so
+            // blocking here hitches the picture mid-stream. The renderer is already detached from
+            // routing above, so nothing observes it after this point.
+            if let renderer { Task.detached { renderer.stop() } }
         }
         for (pad, controller) in want {
             if let slot = slots[pad] {
@@ -282,6 +290,12 @@ public final class GamepadFeedback {
     private func reset(_ controller: GCController?) {
         guard let c = controller else { return }
         c.playerIndex = .indexUnset
+        // Put the lightbar out too. This class is what turned it on (see the `Led` and
+        // `PlayerLeds` arms), and every DS write is valid-flag-selective, so a colour the game
+        // set stays lit in firmware after the stream ends — back at the launcher, or for a pad
+        // that merely left the forwarded set. A DS4 is cleared incidentally because its player
+        // indicator IS the lightbar; a DualSense is not.
+        c.light?.color = GCColor(red: 0, green: 0, blue: 0)
         if let ds = c.extendedGamepad as? GCDualSenseGamepad {
             ds.leftTrigger.setModeOff()
             ds.rightTrigger.setModeOff()

clients/apple/Sources/PunktfunkKit/Gamepad/RumbleRenderer.swift

@@ -459,6 +459,18 @@ final class RumbleRenderer: @unchecked Sendable {
         if split {
             low = makeMotor(haptics, .leftHandle, sharpness: RumbleTuning.sharpnessLow)
             high = makeMotor(haptics, .rightHandle, sharpness: RumbleTuning.sharpnessHigh)
+            // HALF a split is worse than none, and it used to pass silently: only the all-nil case
+            // below counts as failure, so one surviving handle left `ok` true and `reportHealth(nil)`
+            // announced HEALTHY. What actually rendered was wrong in a direction that depends on
+            // which handle died — lose `high` and `render` falls to the combined branch (selected
+            // purely by `high != nil`), playing max(low, high) on the LEFT handle at the combined
+            // sharpness; lose `low` and the split branch's reconcile no-ops on the nil slot, so the
+            // heavy motor is discarded outright. Tear the survivor down and take the combined path,
+            // which at least renders both motors somewhere.
+            if low == nil || high == nil {
+                log.warning("rumble: only one split-handle engine came up — falling back to combined")
+                teardown() // disarms handlers, stops the survivor's players + engine, nils both
+            }
         } else {
             low = makeMotor(haptics, .default, sharpness: RumbleTuning.sharpnessCombined)
         }
@@ -587,7 +599,9 @@ final class RumbleRenderer: @unchecked Sendable {
         #if os(macOS)
         guard let c, c.extendedGamepad is GCDualSenseGamepad else { return false }
         let hid = DualSenseHID()
-        guard hid.open() else { return false }
+        // Ask for the device this renderer's controller actually is, so two attached DualSenses
+        // do not both get driven through whichever one an unordered Set happened to yield first.
+        guard hid.open(preferringLocationID: Self.hidLocationID(for: c)) else { return false }
         dualSenseHID = hid
         return true
         #else
@@ -595,6 +609,24 @@ final class RumbleRenderer: @unchecked Sendable {
         #endif
     }
 
+    #if os(macOS)
+    /// Correlate a `GCController` with an IOKit location id.
+    ///
+    /// GameController exposes no location id, so there is no direct mapping. What it does expose is
+    /// a stable per-controller ordering, and IOKit's location ids are stable per port: pairing the
+    /// two by rank makes each renderer pick a *distinct* device, which is the property that was
+    /// missing. With one pad attached this is the same device it always was.
+    static func hidLocationID(for c: GCController) -> UInt32? {
+        let ids = DualSenseHID.attachedLocationIDs()
+        guard ids.count > 1 else { return ids.first }
+        let peers = GCController.controllers().filter { $0.extendedGamepad is GCDualSenseGamepad }
+        guard let rank = peers.firstIndex(where: { $0 === c }), rank < ids.count else {
+            return ids.first
+        }
+        return ids[rank]
+    }
+    #endif
+
     /// Write the target to the DualSense over HID if that's the active backend; false → not a
     /// HID pad, so the caller renders via CoreHaptics. Deduped on the pad's 0...255 resolution,
     /// with a periodic keepalive re-write while nonzero (the ticker calls back in here).
@@ -605,8 +637,20 @@ final class RumbleRenderer: @unchecked Sendable {
         let keepalive = levels != (0, 0)
             && seconds(since: lastHidWrite.at) > RumbleTuning.hidKeepaliveSeconds
         if levels != lastHidWrite.levels || keepalive {
-            hid.rumble(low: levels.0, high: levels.1)
-            lastHidWrite = (levels, .now())
+            if hid.rumble(low: levels.0, high: levels.1) {
+                lastHidWrite = (levels, .now())
+            } else {
+                // The write did not reach the device. Do NOT stamp the clock — that would claim a
+                // render that never happened, and for a stop there is nothing behind it: the
+                // keepalive only re-writes non-zero levels and the ticker is cancelled once the
+                // target is (0, 0), so the motors would keep running with nothing scheduled.
+                // Drop the handle instead: the pad reverts to CoreHaptics, and a reconnect
+                // rebuilds it. Health is reported so the state is visible rather than silent.
+                log.error("rumble: HID write failed — dropping the handle, falling back")
+                closeHID()
+                reportHealth("Lost the direct connection to this DualSense; using the system path.")
+                return false
+            }
         }
         return true
         #else

clients/apple/Tests/PunktfunkKitTests/DualSenseHIDTests.swift

@@ -43,5 +43,33 @@ final class DualSenseHIDTests: XCTestCase {
         let crc = DualSenseHID.crc32(seed: UInt8(ascii: "1"), Array("23456789".utf8))
         XCTAssertEqual(crc, 0xCBF4_3926)
     }
+
+    // MARK: - Device selection (B14)
+
+    /// With two DualSenses attached, each renderer must drive its OWN device. The old code took
+    /// `Set.first` from an unordered set, so the pad→device binding was a coin flip that could
+    /// point both renderers at the same pad.
+    func testPreferredIndexHonoursAnExplicitLocation() {
+        let ids: [UInt32?] = [0x1D18_0000, 0x1420_0000, 0x1411_0000]
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: ids, preferring: 0x1420_0000), 1)
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: ids, preferring: 0x1D18_0000), 0)
+    }
+
+    /// No preference (or one the pad no longer has): fall back to the LOWEST id — arbitrary, but
+    /// stable across calls, which `Set.first` was not.
+    func testPreferredIndexFallsBackToTheLowestIdDeterministically() {
+        let ids: [UInt32?] = [0x1D18_0000, 0x1420_0000, 0x1411_0000]
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: ids, preferring: nil), 2)
+        // A wanted id that is gone (pad unplugged between enumeration and open) must not fail the
+        // open — it degrades to the same stable fallback.
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: ids, preferring: 0xDEAD_BEEF), 2)
+    }
+
+    /// A device IOKit reports no location for must never displace one it can place.
+    func testPreferredIndexSortsUnplaceableDevicesLast() {
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: [nil, 0x1420_0000], preferring: nil), 1)
+        XCTAssertEqual(DualSenseHID.preferredIndex(among: [nil, nil], preferring: nil), 0)
+        XCTAssertNil(DualSenseHID.preferredIndex(among: [], preferring: nil))
+    }
 }
 #endif

crates/punktfunk-core/src/client/rumble.rs

@@ -36,22 +36,6 @@ pub const LEGACY_STALE_MS: u64 = 1000;
 /// engine's staleness zero lands at 1 s; this is the hardware-level net under an engine stall).
 const BACKSTOP_LEGACY_MS: u32 = 2000;
 
-/// The longest lease the engine honours, whatever the envelope claims — the receiver-side mirror of
-/// the host's own `RUMBLE_TTL_CEIL_MS`.
-///
-/// No host built from this tree can exceed it (the `PUNKTFUNK_RUMBLE_TTL_MS` hatch is clamped to
-/// `[150, 5000]` before it reaches the wire), so this is defence in depth against a third-party or
-/// modified sender that stamps a long TTL and then wedges its renewal pump while the connection
-/// stays up. It matters on exactly the platforms that sustain a level for the whole lease: Apple,
-/// whose renderer deliberately keeps no staleness policy of its own, and a Deck slot, whose
-/// keepalive re-kicks the actuator until the lease ends. Duration-parameterized embedders (SDL,
-/// Android) already self-terminate at the clamped backstop.
-///
-/// Deliberately NOT `pub`: an embedder has no use for it, and every `pub` const in this crate is
-/// emitted into `include/punktfunk_core.h` as an UNPREFIXED `#define` — a collision hazard the
-/// header already has ~170 instances of, and one this has no reason to add to.
-const MAX_LEASE_MS: u16 = 5_000;
-
 /// One effective actuator command. `(0, 0)` means stop now. `backstop_ms` is a safety-net
 /// duration for platform APIs that take one (SDL rumble, Android one-shots): the engine emits
 /// explicit zeros at every policy stop, so the backstop only matters if the embedder thread itself
@@ -91,11 +75,8 @@ struct PadState {
     /// A wire update landed since the last emit (level change OR renewal — renewals re-emit).
     dirty: bool,
     next_keepalive: Option<Instant>,
-    /// The exact value last handed to an embedder. `(0, 0)` ⇔ the engine believes this actuator is
-    /// silent. It replaces a free-running jitter phase because one field answers all three live
-    /// questions: would re-sending this be a no-op device write (the dedupe nudge), is a stop
-    /// redundant, and would the nudge synthesize the reserved stop.
-    last_emit: (u16, u16),
+    /// Current jitter phase (see [`ActuatorQuirks::dedup_jitter`]).
+    jitter: bool,
     quirks: ActuatorQuirks,
 }
 
@@ -107,7 +88,7 @@ impl PadState {
         legacy_wire: None,
         dirty: false,
         next_keepalive: None,
-        last_emit: (0, 0),
+        jitter: false,
         quirks: ActuatorQuirks {
             keepalive_ms: 0,
             min_pulse_ms: 0,
@@ -131,7 +112,6 @@ impl PadState {
         self.legacy_wire = None;
         self.next_keepalive = None;
         self.dirty = false;
-        self.last_emit = (0, 0);
         RumbleCommand {
             pad,
             low: 0,
@@ -139,40 +119,6 @@ impl PadState {
             backstop_ms: 0,
         }
     }
-
-    /// Build the command for the pad's current level, and record what we handed out.
-    ///
-    /// On a `dedup_jitter` actuator, re-emitting the value the device last took is a no-op write on
-    /// an SDL-class layer, so the low motor's LSB is nudged. Keying that on `last_emit` rather than
-    /// on a free-running phase is what makes it work on EVERY emit path. Previously the nudge lived
-    /// only in the keepalive branch, so a host renewal — which arrives every `ttl*3/10` ms, 120 ms
-    /// at the 400 ms default and 60 ms at the hatch floor — re-emitted the raw level, collided with
-    /// the last jittered write, was swallowed, AND re-anchored the keepalive. That stretched the
-    /// gap between *distinct* device writes to 80 ms at the default cadence and 100 ms at the
-    /// floor, on an actuator whose quirk declares 40.
-    ///
-    /// The nudge is refused when it would synthesize the reserved `(0, 0)` stop. That is level
-    /// `(1, 0)` and only that: `high` must already be 0, and `low ^ 1 == 0` implies `low == 1`.
-    /// There the LSB steps up instead, so the phase still alternates (1 ↔ 3, two parts in 65535)
-    /// and the pad never receives a stop the policy did not order.
-    fn emit(&mut self, pad: u16) -> RumbleCommand {
-        let (mut low, high) = self.level;
-        if self.quirks.dedup_jitter && (low, high) == self.last_emit {
-            let alt = low ^ 1;
-            low = if (alt, high) == (0, 0) {
-                low | 0b10
-            } else {
-                alt
-            };
-        }
-        self.last_emit = (low, high);
-        RumbleCommand {
-            pad,
-            low,
-            high,
-            backstop_ms: self.backstop(),
-        }
-    }
 }
 
 /// The pure per-connection policy state machine. Time is always passed in (`now`) so the policy
@@ -210,8 +156,6 @@ impl RumbleEngine {
         p.dirty = true;
         match ttl_ms {
             Some(t) => {
-                // Never honour a lease longer than [`MAX_LEASE_MS`], whatever the sender claims.
-                let t = t.min(MAX_LEASE_MS);
                 p.ttl_ms = t;
                 p.legacy_wire = None;
                 p.deadline = if (low, high) != (0, 0) {
@@ -270,25 +214,22 @@ impl RumbleEngine {
             if p.dirty {
                 p.dirty = false;
                 if p.level == (0, 0) {
-                    // Relay a stop only if the actuator is, as far as the engine knows, still
-                    // buzzing. A zero on an already-silent pad heals nothing and costs every
-                    // embedder a command — Android an unconditional log line plus a binder
-                    // `cancel()`. Two senders produce them: the host's deliberate
-                    // `RUMBLE_STOP_BURST` re-sends after the first stop already landed, and (behind
-                    // `PUNKTFUNK_RUMBLE_ENVELOPE=0`) the legacy flat 500 ms refresh, which re-sends
-                    // zeros for every latched pad for the rest of the session. The burst still
-                    // heals the case it exists for: a LOST first stop leaves the pad buzzing, so
-                    // `last_emit != (0, 0)` and the re-send does emit.
-                    if p.last_emit != (0, 0) {
-                        return (Some(p.silence(pad)), None);
-                    }
-                    continue;
+                    return (Some(p.silence(pad)), None);
                 }
                 if p.quirks.keepalive_ms > 0 {
                     p.next_keepalive =
                         Some(now + Duration::from_millis(p.quirks.keepalive_ms as u64));
                 }
-                return (Some(p.emit(pad)), None);
+                let (low, high) = p.level;
+                return (
+                    Some(RumbleCommand {
+                        pad,
+                        low,
+                        high,
+                        backstop_ms: p.backstop(),
+                    }),
+                    None,
+                );
             }
             // 4) actuator-decay keepalive, bounded by (1)/(2) above by construction: an expired
             // or stale pad was silenced before reaching here, so a keepalive can never sustain a
@@ -298,7 +239,20 @@ impl RumbleEngine {
                 let due = *p.next_keepalive.get_or_insert(now + ka);
                 if now >= due {
                     p.next_keepalive = Some(now + ka);
-                    return (Some(p.emit(pad)), None);
+                    let (mut low, high) = p.level;
+                    if p.quirks.dedup_jitter {
+                        p.jitter = !p.jitter;
+                        low ^= p.jitter as u16;
+                    }
+                    return (
+                        Some(RumbleCommand {
+                            pad,
+                            low,
+                            high,
+                            backstop_ms: p.backstop(),
+                        }),
+                        None,
+                    );
                 }
                 merge_wake(&mut wake, due);
             }
@@ -403,22 +357,6 @@ pub(crate) struct Closed;
 mod tests {
     use super::*;
 
-    /// The Steam Deck's declared quirks — the only shipping actuator with `dedup_jitter`.
-    const DECK: ActuatorQuirks = ActuatorQuirks {
-        keepalive_ms: 40,
-        min_pulse_ms: 0,
-        dedup_jitter: true,
-    };
-
-    /// Drain the engine the way an embedder does: poll until nothing is due.
-    fn drain(e: &mut RumbleEngine, t: Instant) -> Vec<(u16, u16)> {
-        let mut out = Vec::new();
-        while let (Some(c), _) = e.poll(t) {
-            out.push((c.low, c.high));
-        }
-        out
-    }
-
     fn ms(v: u64) -> Duration {
         Duration::from_millis(v)
     }
@@ -589,133 +527,4 @@ mod tests {
         );
         assert_eq!(shared.next_command(ms(10)), Err(Closed));
     }
-
-    /// A host renewal must not repeat the value the device last took, or an SDL-class layer
-    /// swallows the write. Before the jitter moved onto every emit path it lived only in the
-    /// keepalive branch, so each renewal collided with the last jittered write and was deduped.
-    #[test]
-    fn renewal_keeps_the_dedupe_jitter_alternating() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0), vec![(100, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(40)), vec![(101, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(80)), vec![(100, 200)]);
-        // The renewal at the 120 ms default cadence: same level, must still be a distinct write.
-        e.wire_update(t0 + ms(120), 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0 + ms(120)), vec![(101, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(160)), vec![(100, 200)]);
-    }
-
-    /// Phase-robust version of the same property, at the TTL hatch's 60 ms renewal floor: no two
-    /// consecutive DISTINCT device writes may be further apart than the declared 40 ms cadence.
-    #[test]
-    fn renewal_never_gaps_distinct_writes_at_the_60ms_floor() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        let (mut last, mut last_write, mut worst) = ((0u16, 0u16), 0u64, 0u64);
-        for tick in 0..=360u64 {
-            let t = t0 + ms(tick);
-            if tick % 60 == 0 {
-                e.wire_update(t, 0, 100, 200, Some(400));
-            }
-            for v in drain(&mut e, t) {
-                assert_ne!(v, (0, 0), "a live lease must never emit the stop sentinel");
-                if v != last {
-                    worst = worst.max(tick - last_write);
-                    last_write = tick;
-                    last = v;
-                }
-            }
-        }
-        assert!(
-            worst <= 41,
-            "worst distinct-write gap {worst} ms exceeds the 40 ms declared cadence"
-        );
-    }
-
-    /// The nudge must stay behind `dedup_jitter`: an off-by-one amplitude on a default-quirks pad
-    /// would land in Apple's identical-target comparison and Android's one-shot amplitudes.
-    #[test]
-    fn default_quirks_pads_get_the_level_verbatim_on_every_renewal() {
-        let mut e = RumbleEngine::new(); // Apple / Android / plain SDL
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 100, 200, 800)));
-        e.wire_update(t0 + ms(120), 0, 100, 200, Some(400));
-        assert_eq!(e.poll(t0 + ms(120)).0, Some(cmd(0, 100, 200, 800)));
-    }
-
-    /// Level `(1, 0)` is the one value whose LSB flip is the reserved stop. The nudge steps up
-    /// instead, so the phase still alternates and no stop is invented under a live lease.
-    #[test]
-    fn jitter_never_synthesizes_the_stop_sentinel() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 1, 0, Some(400));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 1, 0, 800)));
-        assert_eq!(e.poll(t0 + ms(40)).0, Some(cmd(0, 3, 0, 800)));
-        assert_eq!(e.poll(t0 + ms(80)).0, Some(cmd(0, 1, 0, 800)));
-    }
-
-    /// A zero for a pad the engine already believes is silent is dropped: it heals nothing and
-    /// costs every embedder a command. The deliberate stop-burst heal is unaffected, because a
-    /// LOST stop leaves the pad buzzing and the re-send therefore does emit.
-    #[test]
-    fn a_redundant_stop_is_dropped_but_the_burst_still_heals_a_lost_one() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0), vec![(100, 200)]);
-        // First stop reaches the embedder…
-        e.wire_update(t0 + ms(10), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(10)), vec![(0, 0)]);
-        // …and the burst re-sends behind it are now silent.
-        e.wire_update(t0 + ms(20), 0, 0, 0, Some(0));
-        e.wire_update(t0 + ms(30), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(30)), Vec::new());
-
-        // But if the pad is buzzing (the stop that mattered was lost), a re-send still emits.
-        e.wire_update(t0 + ms(40), 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0 + ms(40)), vec![(100, 200)]);
-        e.wire_update(t0 + ms(50), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(50)), vec![(0, 0)]);
-    }
-
-    /// The client bounds the host's lease. `RUMBLE_TTL_CEIL_MS` is sender-side only, so a modified
-    /// or third-party host could otherwise stamp a huge TTL and wedge its pump, leaving Apple and
-    /// the Deck buzzing for the whole of it.
-    #[test]
-    fn an_overlong_lease_is_clamped_to_the_ceiling() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(u16::MAX));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 100, 200, 5000)));
-        // Silenced at the ceiling, not at the 65 s the sender asked for.
-        assert!(e.poll(t0 + ms(MAX_LEASE_MS as u64 - 1)).0.is_none());
-        assert_eq!(
-            e.poll(t0 + ms(MAX_LEASE_MS as u64)).0,
-            Some(cmd(0, 0, 0, 0)),
-            "the lease must end at the ceiling"
-        );
-    }
-
-    /// A v2 envelope carrying `ttl_ms == 0` on a LIVE level. The audit suspected the zero would be
-    /// mistaken for the legacy sentinel in `backstop()`; it cannot, because the expiry check
-    /// preempts the relay branch — the pad silences on the same poll and never reaches a backstop.
-    /// Pinned so that ordering stays load-bearing rather than incidental.
-    #[test]
-    fn a_zero_ttl_envelope_silences_rather_than_taking_the_legacy_backstop() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(0));
-        assert_eq!(
-            e.poll(t0).0,
-            Some(cmd(0, 0, 0, 0)),
-            "a zero-length lease must expire immediately, not emit with a legacy backstop"
-        );
-    }
 }