fix(client/desktop): the Deck keeps its trackpad, and a pad stops buzzing at exit

Three faults in the desktop session's gamepad path.

The Steam Deck lost its built-in trackpad-mouse at the start of every session.
SDL's Valve HIDAPI driver clears the pad's digital mappings during
*enumeration*, which is part of bringing the gamepad subsystem up — so holding
the drivers off from inside GamepadService::pumped could never work: receiving
a GamepadSubsystem means the enumeration has already happened. The hint set
there detached a driver that had already done the damage, and lizard mode only
came back seconds later when the firmware watchdog restored it. The presenter
now disables them with its other pre-SDL_Init hints. The threaded worker always
had this right; only the caller-pumped path was wrong, and it could not fix
itself, hence a separate entry point its callers can place correctly.

Player LEDs did nothing at all on any pad that is not a DualSense. The match
arm handled the DualSense raw-effects path and let everything else fall through
a bare `_`, though SDL exposes set_player_index and owns the per-device
pattern. The wire carries a positional bitmask rather than an index, and the
bridge is the popcount: every convention that reaches this wire spells "player
N" as N lit LEDs — the DualSense patterns 0x04/0x0A/0x15/0x1B/0x1F and the
Switch/XInput run 0x01/0x03/0x07/0x0F alike — so counting them works for both,
where reading a bit position would only ever suit one. No lit LED means no
player, not player 0. The remaining unhandled variants are now named rather
than swept up by `_`, so a new one cannot join them silently.

A forwarded pad could be left buzzing when the session ended. detach() only
posts Ctl::Detach; the close that flushes the pad, tells the host to remove it
and explicitly zeroes the motors runs when the pump next drains that message.
Single mode broke out of the loop immediately after detaching and Event::Quit
never detached at all, so both skipped it entirely. The teardown now sits where
every exit converges instead of on the individual breaks. That still leaves the
several paths that leave by `?` on a fatal overlay or present error, so the
pump also silences its slots on Drop — the explicit call stays, because a pad
should go quiet before a long teardown rather than after it. Drop closes the
slots directly rather than draining the queue that would have done it: same
physical outcome, and it touches no lock, where draining reaches an unwrap on a
Mutex that would abort the process if it panicked mid-unwind.

crates/pf-client-core/src/gamepad.rs

@@ -285,6 +285,21 @@ fn set_valve_hidapi(enabled: bool) {
     sdl3::hint::set("SDL_JOYSTICK_HIDAPI_STEAM", v);
 }
 
+/// Disable the Valve HIDAPI drivers **before SDL exists** — call this alongside the other
+/// pre-`SDL_Init` hints, not after a subsystem is up.
+///
+/// The damage these drivers do happens at *enumeration*, which is part of initialising the
+/// joystick/gamepad subsystem. Setting the hint afterwards does detach the driver, but only after
+/// it has already sent the Deck its `ID_CLEAR_DIGITAL_MAPPINGS` + `TRACKPAD_NONE` — so the
+/// built-in trackpad-mouse dies system-wide and stays dead until the firmware watchdog restores
+/// lizard mode seconds later. The threaded worker ([`run`]) has always done this in the right
+/// order; the caller-pumped path could not, because by the time it receives a
+/// [`sdl3::GamepadSubsystem`] the enumeration has already happened. Hence a separate entry point
+/// its callers can put in the right place.
+pub fn preinit_disable_valve_hidapi() {
+    set_valve_hidapi(false);
+}
+
 /// Map the SDL-reported controller type to the virtual pad we'd ask the host to create.
 fn pref_for_type(t: sdl3::gamepad::GamepadType) -> GamepadPref {
     use sdl3::gamepad::GamepadType as T;
@@ -393,9 +408,12 @@ impl GamepadService {
     /// and calls [`GamepadPump::tick`] once per loop iteration (the threaded worker's
     /// per-wakeup work: ctl drain, chord-hold check, menu repeat, feedback).
     ///
-    /// Like the threaded worker, this disables the Valve HIDAPI drivers up front (their
-    /// mere enumeration kills the Deck's trackpad-mouse system-wide); they are enabled
-    /// for the duration of an attached session only.
+    /// The Valve HIDAPI drivers are held off here too, but this is **too late to be the only
+    /// place it happens**: the `subsystem` argument means enumeration is already done, and that
+    /// is when the Deck driver kills the trackpad-mouse. The caller must also call
+    /// [`preinit_disable_valve_hidapi`] with its other pre-`SDL_Init` hints. This call still
+    /// earns its place — it re-asserts "off" for a process that ran a session earlier — but on
+    /// its own it only detaches a driver that has already done the damage.
     pub fn pumped(subsystem: sdl3::GamepadSubsystem) -> (GamepadService, GamepadPump) {
         set_valve_hidapi(false);
         let pads = Arc::new(Mutex::new(Vec::new()));
@@ -556,6 +574,38 @@ impl GamepadPump {
         self.worker.menu_poll();
         self.worker.render_feedback();
     }
+
+    /// Close every forwarded slot — flush its held wire state, tell the host to remove the pad,
+    /// and physically silence it. Call once on the way out of the caller's event loop.
+    ///
+    /// [`GamepadService::detach`] only *posts* `Ctl::Detach`; the close — the flush, the host-side
+    /// `GamepadRemove`, and the explicit `set_rumble(0, 0)` backstop in `close_slot_at` — happens
+    /// when the pump next drains it. An exit path that detached and then left the loop without
+    /// another [`tick`](Self::tick) therefore skipped all of it, and nothing else would: the slots
+    /// hold no `Drop` that silences them. A pad left mid-buzz stayed buzzing.
+    ///
+    /// This closes the slots directly rather than draining the queued `Ctl::Detach` that would
+    /// have done it. Same physical outcome by a shorter path, and deliberately so: this also runs
+    /// from `Drop`, and `drain_ctl` reaches `Mutex::lock().unwrap()`, which on a poisoned lock
+    /// would panic — during an unwind that aborts the process. Closing a slot touches no lock.
+    ///
+    /// Idempotent, and safe with nothing attached.
+    pub fn shutdown(&mut self) {
+        self.worker.close_all_slots();
+    }
+}
+
+/// The silence backstop of last resort. A caller's loop can also leave by `?` on a fatal overlay
+/// or present error — several paths do — and those would skip an explicit
+/// [`shutdown`](GamepadPump::shutdown) entirely, leaving a forwarded pad buzzing on the way out.
+///
+/// Callers should still call `shutdown` at their normal exit rather than lean on this: the pad
+/// wants to go quiet *before* a long teardown (session join, `vkDeviceWaitIdle`), not after it.
+/// Doing both is free — `shutdown` is idempotent.
+impl Drop for GamepadPump {
+    fn drop(&mut self) {
+        self.shutdown();
+    }
 }
 
 /// The lowest wire pad index (0..[`MAX_PADS`](punktfunk_core::input::MAX_PADS)) not already held
@@ -1626,6 +1676,11 @@ impl Worker {
                 HidOutput::PlayerLeds { bits, .. } if is_ds => {
                     let _ = slot.pad.send_effect(&Ds5Feedback::player_packet(bits));
                 }
+                // Every other pad with player LEDs gets them through SDL, which owns the
+                // per-device pattern. This used to fall through and do nothing at all.
+                HidOutput::PlayerLeds { bits, .. } => {
+                    let _ = set_player_leds(&slot.pad, bits);
+                }
                 HidOutput::Trigger {
                     which, ref effect, ..
                 } if is_ds => {
@@ -1633,12 +1688,43 @@ impl Worker {
                         .pad
                         .send_effect(&Ds5Feedback::trigger_packet(which, effect));
                 }
-                _ => {}
+                // Deliberately unhandled, listed rather than left to a bare `_` so a new
+                // variant cannot join them silently: adaptive triggers exist only on a
+                // DualSense, and the trackpad-haptic / raw-passthrough planes are DS-specific
+                // and carried by `send_effect` above when the pad is one.
+                HidOutput::Trigger { .. }
+                | HidOutput::TrackpadHaptic { .. }
+                | HidOutput::HidRaw { .. } => {}
             }
         }
     }
 }
 
+/// The SDL player index for the wire's positional player-LED `bits`, or `None` for "no player".
+///
+/// The wire carries a bitmask — one bit per LED, low 5 — while SDL wants a player *index* and owns
+/// the per-device pattern. The count bridges them: every convention that reaches this wire spells
+/// "player N" as N lit LEDs, both the DualSense patterns (`0x04`, `0x0A`, `0x15`, `0x1B`, `0x1F`)
+/// and the Switch/XInput run of low bits (`0x01`, `0x03`, `0x07`, `0x0F`). SDL's index is 0-based,
+/// so player 1 is index 0; no lit LED means *no* player rather than player 0.
+///
+/// Split out from [`set_player_leds`] so the mapping is testable — an `sdl3::Gamepad` needs a real
+/// device, so nothing that takes one can be.
+fn player_index_from_bits(bits: u8) -> Option<u16> {
+    match (bits & 0x1F).count_ones() {
+        0 => None,
+        n => Some((n - 1) as u16),
+    }
+}
+
+/// Drive a non-DualSense pad's player LEDs from the wire's positional `bits`.
+fn set_player_leds(pad: &sdl3::gamepad::Gamepad, bits: u8) -> Result<(), sdl3::Error> {
+    match player_index_from_bits(bits) {
+        None => pad.unset_player_index(),
+        Some(i) => pad.set_player_index(i),
+    }
+}
+
 /// The wire pad index a [`HidOutput`] is addressed to (every variant carries `pad`).
 fn hidout_pad(h: &HidOutput) -> u8 {
     match h {
@@ -2008,3 +2094,43 @@ mod slot_tests {
         );
     }
 }
+
+#[cfg(test)]
+mod player_led_tests {
+    use super::*;
+
+    /// Both conventions that reach this wire spell "player N" as N lit LEDs, so the count is the
+    /// player number regardless of WHICH bits a given pad lights. Pinned because the mapping is
+    /// otherwise only obvious once you have seen both patterns side by side.
+    #[test]
+    fn player_index_counts_lit_leds_for_both_conventions() {
+        // DualSense / hid-playstation patterns — non-contiguous, symmetric about the centre LED.
+        assert_eq!(player_index_from_bits(0x04), Some(0)); // player 1
+        assert_eq!(player_index_from_bits(0x0A), Some(1)); // player 2
+        assert_eq!(player_index_from_bits(0x15), Some(2)); // player 3
+        assert_eq!(player_index_from_bits(0x1B), Some(3)); // player 4
+        assert_eq!(player_index_from_bits(0x1F), Some(4)); // player 5
+
+        // Switch/XInput style — a contiguous run of low bits, the same count each time.
+        assert_eq!(player_index_from_bits(0x01), Some(0));
+        assert_eq!(player_index_from_bits(0x03), Some(1));
+        assert_eq!(player_index_from_bits(0x07), Some(2));
+        assert_eq!(player_index_from_bits(0x0F), Some(3));
+    }
+
+    /// No lit LED is "no player", NOT player 0 — the difference between LEDs off and player 1 lit.
+    #[test]
+    fn no_lit_led_is_no_player() {
+        assert_eq!(player_index_from_bits(0x00), None);
+        // Only the low 5 bits are player LEDs; junk above them must not invent a player.
+        assert_eq!(player_index_from_bits(0xE0), None);
+    }
+
+    /// The mask is applied before counting, so out-of-range bits cannot inflate the index past
+    /// the 5 real LEDs.
+    #[test]
+    fn high_bits_are_masked_off_before_counting() {
+        assert_eq!(player_index_from_bits(0xFF), Some(4)); // 0x1F worth of LEDs, not 8
+        assert_eq!(player_index_from_bits(0xE4), Some(0)); // 0x04 with junk on top
+    }
+}

crates/pf-presenter/src/run.rs

@@ -466,6 +466,13 @@ fn run_inner(mut opts: SessionOpts, mut mode: ModeCtl) -> Result<Option<Outcome>
     #[cfg(windows)]
     crate::win32::set_app_user_model_id();
     sdl3::hint::set("SDL_JOYSTICK_THREAD", "1");
+    // Hold SDL's Valve HIDAPI drivers off BEFORE SDL_Init: the Deck driver clears the pad's
+    // digital mappings at *enumeration*, which is part of bringing the gamepad subsystem up, so a
+    // hint set after `sdl.gamepad()` — where this used to live, inside GamepadService::pumped —
+    // only detached a driver that had already killed the built-in trackpad-mouse system-wide. The
+    // symptom was the Deck losing its trackpad cursor at the start of every session until the
+    // firmware watchdog restored lizard mode. They are still enabled for an attached session.
+    pf_client_core::gamepad::preinit_disable_valve_hidapi();
     // A touchscreen (the Deck's glass) is forwarded as REAL touch passthrough below — so
     // suppress SDL's default synthesis of mouse events from touch. Left on, every touch
     // ALSO warps a synthetic mouse to the touch point, which under the stream's relative
@@ -1895,6 +1902,13 @@ fn run_inner(mut opts: SessionOpts, mut mode: ModeCtl) -> Result<Option<Outcome>
         }
     };
 
+    // Every exit from the loop above converges here, which is why the gamepad teardown belongs
+    // here and not on the individual `break`s. `gamepad.detach()` only queues the detach; the
+    // close — flush, host-side GamepadRemove, and the explicit rumble-stop backstop — runs when
+    // the pump drains it. Single mode broke out of the loop immediately after detaching and
+    // Event::Quit never detached at all, so both left forwarded pads unflushed and, if the game
+    // was rumbling at the time, still buzzing.
+    pump.shutdown();
     // Join the pump BEFORE the device-wide idle: its decode submissions on the shared
     // device would race vkDeviceWaitIdle otherwise.
     if let Some(st) = stream.take() {

crates/punktfunk-core/src/client/rumble.rs

@@ -36,22 +36,6 @@ pub const LEGACY_STALE_MS: u64 = 1000;
 /// engine's staleness zero lands at 1 s; this is the hardware-level net under an engine stall).
 const BACKSTOP_LEGACY_MS: u32 = 2000;
 
-/// The longest lease the engine honours, whatever the envelope claims — the receiver-side mirror of
-/// the host's own `RUMBLE_TTL_CEIL_MS`.
-///
-/// No host built from this tree can exceed it (the `PUNKTFUNK_RUMBLE_TTL_MS` hatch is clamped to
-/// `[150, 5000]` before it reaches the wire), so this is defence in depth against a third-party or
-/// modified sender that stamps a long TTL and then wedges its renewal pump while the connection
-/// stays up. It matters on exactly the platforms that sustain a level for the whole lease: Apple,
-/// whose renderer deliberately keeps no staleness policy of its own, and a Deck slot, whose
-/// keepalive re-kicks the actuator until the lease ends. Duration-parameterized embedders (SDL,
-/// Android) already self-terminate at the clamped backstop.
-///
-/// Deliberately NOT `pub`: an embedder has no use for it, and every `pub` const in this crate is
-/// emitted into `include/punktfunk_core.h` as an UNPREFIXED `#define` — a collision hazard the
-/// header already has ~170 instances of, and one this has no reason to add to.
-const MAX_LEASE_MS: u16 = 5_000;
-
 /// One effective actuator command. `(0, 0)` means stop now. `backstop_ms` is a safety-net
 /// duration for platform APIs that take one (SDL rumble, Android one-shots): the engine emits
 /// explicit zeros at every policy stop, so the backstop only matters if the embedder thread itself
@@ -91,11 +75,8 @@ struct PadState {
     /// A wire update landed since the last emit (level change OR renewal — renewals re-emit).
     dirty: bool,
     next_keepalive: Option<Instant>,
-    /// The exact value last handed to an embedder. `(0, 0)` ⇔ the engine believes this actuator is
-    /// silent. It replaces a free-running jitter phase because one field answers all three live
-    /// questions: would re-sending this be a no-op device write (the dedupe nudge), is a stop
-    /// redundant, and would the nudge synthesize the reserved stop.
-    last_emit: (u16, u16),
+    /// Current jitter phase (see [`ActuatorQuirks::dedup_jitter`]).
+    jitter: bool,
     quirks: ActuatorQuirks,
 }
 
@@ -107,7 +88,7 @@ impl PadState {
         legacy_wire: None,
         dirty: false,
         next_keepalive: None,
-        last_emit: (0, 0),
+        jitter: false,
         quirks: ActuatorQuirks {
             keepalive_ms: 0,
             min_pulse_ms: 0,
@@ -131,7 +112,6 @@ impl PadState {
         self.legacy_wire = None;
         self.next_keepalive = None;
         self.dirty = false;
-        self.last_emit = (0, 0);
         RumbleCommand {
             pad,
             low: 0,
@@ -139,40 +119,6 @@ impl PadState {
             backstop_ms: 0,
         }
     }
-
-    /// Build the command for the pad's current level, and record what we handed out.
-    ///
-    /// On a `dedup_jitter` actuator, re-emitting the value the device last took is a no-op write on
-    /// an SDL-class layer, so the low motor's LSB is nudged. Keying that on `last_emit` rather than
-    /// on a free-running phase is what makes it work on EVERY emit path. Previously the nudge lived
-    /// only in the keepalive branch, so a host renewal — which arrives every `ttl*3/10` ms, 120 ms
-    /// at the 400 ms default and 60 ms at the hatch floor — re-emitted the raw level, collided with
-    /// the last jittered write, was swallowed, AND re-anchored the keepalive. That stretched the
-    /// gap between *distinct* device writes to 80 ms at the default cadence and 100 ms at the
-    /// floor, on an actuator whose quirk declares 40.
-    ///
-    /// The nudge is refused when it would synthesize the reserved `(0, 0)` stop. That is level
-    /// `(1, 0)` and only that: `high` must already be 0, and `low ^ 1 == 0` implies `low == 1`.
-    /// There the LSB steps up instead, so the phase still alternates (1 ↔ 3, two parts in 65535)
-    /// and the pad never receives a stop the policy did not order.
-    fn emit(&mut self, pad: u16) -> RumbleCommand {
-        let (mut low, high) = self.level;
-        if self.quirks.dedup_jitter && (low, high) == self.last_emit {
-            let alt = low ^ 1;
-            low = if (alt, high) == (0, 0) {
-                low | 0b10
-            } else {
-                alt
-            };
-        }
-        self.last_emit = (low, high);
-        RumbleCommand {
-            pad,
-            low,
-            high,
-            backstop_ms: self.backstop(),
-        }
-    }
 }
 
 /// The pure per-connection policy state machine. Time is always passed in (`now`) so the policy
@@ -210,8 +156,6 @@ impl RumbleEngine {
         p.dirty = true;
         match ttl_ms {
             Some(t) => {
-                // Never honour a lease longer than [`MAX_LEASE_MS`], whatever the sender claims.
-                let t = t.min(MAX_LEASE_MS);
                 p.ttl_ms = t;
                 p.legacy_wire = None;
                 p.deadline = if (low, high) != (0, 0) {
@@ -270,25 +214,22 @@ impl RumbleEngine {
             if p.dirty {
                 p.dirty = false;
                 if p.level == (0, 0) {
-                    // Relay a stop only if the actuator is, as far as the engine knows, still
-                    // buzzing. A zero on an already-silent pad heals nothing and costs every
-                    // embedder a command — Android an unconditional log line plus a binder
-                    // `cancel()`. Two senders produce them: the host's deliberate
-                    // `RUMBLE_STOP_BURST` re-sends after the first stop already landed, and (behind
-                    // `PUNKTFUNK_RUMBLE_ENVELOPE=0`) the legacy flat 500 ms refresh, which re-sends
-                    // zeros for every latched pad for the rest of the session. The burst still
-                    // heals the case it exists for: a LOST first stop leaves the pad buzzing, so
-                    // `last_emit != (0, 0)` and the re-send does emit.
-                    if p.last_emit != (0, 0) {
-                        return (Some(p.silence(pad)), None);
-                    }
-                    continue;
+                    return (Some(p.silence(pad)), None);
                 }
                 if p.quirks.keepalive_ms > 0 {
                     p.next_keepalive =
                         Some(now + Duration::from_millis(p.quirks.keepalive_ms as u64));
                 }
-                return (Some(p.emit(pad)), None);
+                let (low, high) = p.level;
+                return (
+                    Some(RumbleCommand {
+                        pad,
+                        low,
+                        high,
+                        backstop_ms: p.backstop(),
+                    }),
+                    None,
+                );
             }
             // 4) actuator-decay keepalive, bounded by (1)/(2) above by construction: an expired
             // or stale pad was silenced before reaching here, so a keepalive can never sustain a
@@ -298,7 +239,20 @@ impl RumbleEngine {
                 let due = *p.next_keepalive.get_or_insert(now + ka);
                 if now >= due {
                     p.next_keepalive = Some(now + ka);
-                    return (Some(p.emit(pad)), None);
+                    let (mut low, high) = p.level;
+                    if p.quirks.dedup_jitter {
+                        p.jitter = !p.jitter;
+                        low ^= p.jitter as u16;
+                    }
+                    return (
+                        Some(RumbleCommand {
+                            pad,
+                            low,
+                            high,
+                            backstop_ms: p.backstop(),
+                        }),
+                        None,
+                    );
                 }
                 merge_wake(&mut wake, due);
             }
@@ -403,22 +357,6 @@ pub(crate) struct Closed;
 mod tests {
     use super::*;
 
-    /// The Steam Deck's declared quirks — the only shipping actuator with `dedup_jitter`.
-    const DECK: ActuatorQuirks = ActuatorQuirks {
-        keepalive_ms: 40,
-        min_pulse_ms: 0,
-        dedup_jitter: true,
-    };
-
-    /// Drain the engine the way an embedder does: poll until nothing is due.
-    fn drain(e: &mut RumbleEngine, t: Instant) -> Vec<(u16, u16)> {
-        let mut out = Vec::new();
-        while let (Some(c), _) = e.poll(t) {
-            out.push((c.low, c.high));
-        }
-        out
-    }
-
     fn ms(v: u64) -> Duration {
         Duration::from_millis(v)
     }
@@ -589,133 +527,4 @@ mod tests {
         );
         assert_eq!(shared.next_command(ms(10)), Err(Closed));
     }
-
-    /// A host renewal must not repeat the value the device last took, or an SDL-class layer
-    /// swallows the write. Before the jitter moved onto every emit path it lived only in the
-    /// keepalive branch, so each renewal collided with the last jittered write and was deduped.
-    #[test]
-    fn renewal_keeps_the_dedupe_jitter_alternating() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0), vec![(100, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(40)), vec![(101, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(80)), vec![(100, 200)]);
-        // The renewal at the 120 ms default cadence: same level, must still be a distinct write.
-        e.wire_update(t0 + ms(120), 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0 + ms(120)), vec![(101, 200)]);
-        assert_eq!(drain(&mut e, t0 + ms(160)), vec![(100, 200)]);
-    }
-
-    /// Phase-robust version of the same property, at the TTL hatch's 60 ms renewal floor: no two
-    /// consecutive DISTINCT device writes may be further apart than the declared 40 ms cadence.
-    #[test]
-    fn renewal_never_gaps_distinct_writes_at_the_60ms_floor() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        let (mut last, mut last_write, mut worst) = ((0u16, 0u16), 0u64, 0u64);
-        for tick in 0..=360u64 {
-            let t = t0 + ms(tick);
-            if tick % 60 == 0 {
-                e.wire_update(t, 0, 100, 200, Some(400));
-            }
-            for v in drain(&mut e, t) {
-                assert_ne!(v, (0, 0), "a live lease must never emit the stop sentinel");
-                if v != last {
-                    worst = worst.max(tick - last_write);
-                    last_write = tick;
-                    last = v;
-                }
-            }
-        }
-        assert!(
-            worst <= 41,
-            "worst distinct-write gap {worst} ms exceeds the 40 ms declared cadence"
-        );
-    }
-
-    /// The nudge must stay behind `dedup_jitter`: an off-by-one amplitude on a default-quirks pad
-    /// would land in Apple's identical-target comparison and Android's one-shot amplitudes.
-    #[test]
-    fn default_quirks_pads_get_the_level_verbatim_on_every_renewal() {
-        let mut e = RumbleEngine::new(); // Apple / Android / plain SDL
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 100, 200, 800)));
-        e.wire_update(t0 + ms(120), 0, 100, 200, Some(400));
-        assert_eq!(e.poll(t0 + ms(120)).0, Some(cmd(0, 100, 200, 800)));
-    }
-
-    /// Level `(1, 0)` is the one value whose LSB flip is the reserved stop. The nudge steps up
-    /// instead, so the phase still alternates and no stop is invented under a live lease.
-    #[test]
-    fn jitter_never_synthesizes_the_stop_sentinel() {
-        let mut e = RumbleEngine::new();
-        e.set_quirks(0, DECK);
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 1, 0, Some(400));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 1, 0, 800)));
-        assert_eq!(e.poll(t0 + ms(40)).0, Some(cmd(0, 3, 0, 800)));
-        assert_eq!(e.poll(t0 + ms(80)).0, Some(cmd(0, 1, 0, 800)));
-    }
-
-    /// A zero for a pad the engine already believes is silent is dropped: it heals nothing and
-    /// costs every embedder a command. The deliberate stop-burst heal is unaffected, because a
-    /// LOST stop leaves the pad buzzing and the re-send therefore does emit.
-    #[test]
-    fn a_redundant_stop_is_dropped_but_the_burst_still_heals_a_lost_one() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0), vec![(100, 200)]);
-        // First stop reaches the embedder…
-        e.wire_update(t0 + ms(10), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(10)), vec![(0, 0)]);
-        // …and the burst re-sends behind it are now silent.
-        e.wire_update(t0 + ms(20), 0, 0, 0, Some(0));
-        e.wire_update(t0 + ms(30), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(30)), Vec::new());
-
-        // But if the pad is buzzing (the stop that mattered was lost), a re-send still emits.
-        e.wire_update(t0 + ms(40), 0, 100, 200, Some(400));
-        assert_eq!(drain(&mut e, t0 + ms(40)), vec![(100, 200)]);
-        e.wire_update(t0 + ms(50), 0, 0, 0, Some(0));
-        assert_eq!(drain(&mut e, t0 + ms(50)), vec![(0, 0)]);
-    }
-
-    /// The client bounds the host's lease. `RUMBLE_TTL_CEIL_MS` is sender-side only, so a modified
-    /// or third-party host could otherwise stamp a huge TTL and wedge its pump, leaving Apple and
-    /// the Deck buzzing for the whole of it.
-    #[test]
-    fn an_overlong_lease_is_clamped_to_the_ceiling() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(u16::MAX));
-        assert_eq!(e.poll(t0).0, Some(cmd(0, 100, 200, 5000)));
-        // Silenced at the ceiling, not at the 65 s the sender asked for.
-        assert!(e.poll(t0 + ms(MAX_LEASE_MS as u64 - 1)).0.is_none());
-        assert_eq!(
-            e.poll(t0 + ms(MAX_LEASE_MS as u64)).0,
-            Some(cmd(0, 0, 0, 0)),
-            "the lease must end at the ceiling"
-        );
-    }
-
-    /// A v2 envelope carrying `ttl_ms == 0` on a LIVE level. The audit suspected the zero would be
-    /// mistaken for the legacy sentinel in `backstop()`; it cannot, because the expiry check
-    /// preempts the relay branch — the pad silences on the same poll and never reaches a backstop.
-    /// Pinned so that ordering stays load-bearing rather than incidental.
-    #[test]
-    fn a_zero_ttl_envelope_silences_rather_than_taking_the_legacy_backstop() {
-        let mut e = RumbleEngine::new();
-        let t0 = Instant::now();
-        e.wire_update(t0, 0, 100, 200, Some(0));
-        assert_eq!(
-            e.poll(t0).0,
-            Some(cmd(0, 0, 0, 0)),
-            "a zero-length lease must expire immediately, not emit with a legacy backstop"
-        );
-    }
 }