feat(client): say which GPU can do Vulkan Video, and why not when it can't

Field report from an Intel Arc + NVIDIA laptop: pinning the Vulkan rung on the Arc
iGPU silently produced D3D11VA, and there was no way to tell whether the build had
tried at all. That ambiguity was ours, in three places.

The "unavailable" log printed three of the FIVE conjuncts that gate Vulkan Video.
A device with 1.3, the features and a decode queue family — but no codec extension
— logged dev_is_13=true features_ok=true decode_family=true next to the word
"unavailable" and named nothing actionable. It now prints all five, plus which
base extensions are missing, which codec extensions are present, the decode
family's own advertised codec operations, and the device name and vendor. It also
no longer says "VAAPI/software" on Windows, where the rung below is D3D11VA.

The native-vulkan PIN refusal logged `video_decode` alone. On a device that
decodes something but not THIS codec, that reads as a contradiction: refused, yet
video_decode=true. It now carries the caps mask and the codec bit that was wanted,
so "your GPU can't" is distinguishable from "we asked for the wrong thing" — only
the second is our bug.

And `--probe-decode` is new: per-adapter Vulkan Video capability with no session,
no surface and no logical device. For each GPU it answers usable yes/no, the
driver's own decode ops, the extensions, and — when the answer is no — which
conjunct failed, in words. Separate from --list-adapters, which the desktop shells
parse line-by-line for their GPU picker and which therefore keeps printing bare
names.

The listing is ordered like pick_device (discrete first) and marks entry 0 as the
default presenter, because that ordering is very likely the reporter's actual
answer: pick_device ranks DISCRETE_GPU above INTEGRATED_GPU, Vulkan Video decodes
on the PRESENTER's device by design (that is what makes it zero-copy), and
PUNKTFUNK_DECODER does not move the presenter. So on a hybrid laptop, pinning the
decoder while the dGPU presents probes the wrong GPU entirely —
PUNKTFUNK_VK_DEVICE=<index> is the knob that moves it, and the index printed is
that value.

To keep the probe honest, VIDEO_BASE and VIDEO_CODECS moved to module scope and
the five-way AND became video_decode_gate(), called by both the probe and device
creation. A probe holding its own copy of the rule is one that eventually reports
a capability the session then refuses — which reads to everyone as a decoder bug
rather than a probe bug.

Gates: fmt clean; clippy -D warnings over punktfunk-client-session and
pf-presenter. The Linux container was unavailable (the host's disk filled and took
the docker daemon with it), so this ran on the macOS host target only — the
container leg is owed, and CI covers it on the PR.

.gitea/workflows/android.yml

@@ -160,22 +160,6 @@ jobs:
           key: gradle-${{ hashFiles('clients/android/**/*.gradle.kts', 'clients/android/gradle/wrapper/gradle-wrapper.properties') }}
           restore-keys: gradle-
 
-      # Clippy for the ANDROID target. Like the kit tests below, this was running NOWHERE: ci.yml
-      # lints `--workspace` on the host, where `clients/android/native` and every
-      # `#[cfg(target_os = "android")]` module elsewhere compile out, and this workflow only ever
-      # built. Discovered in 2026-08 with five lints already resident — code no gate had ever read.
-      #
-      # Placed BEFORE assembleDebug deliberately: a lint failure should cost the ~10 s the lint
-      # takes, not the full three-ABI build first. It shares sccache and the target dir with the
-      # build that follows, so the compile is not paid twice.
-      #
-      # The task lints arm64-v8a AND armeabi-v7a, and reuses the build task's exact cargo-ndk
-      # environment — see the long note on `registerCargoNdkClippy` in kit/build.gradle.kts for why
-      # both pointer widths are load-bearing and why the environment must not be duplicated here.
-      - name: Clippy (Android target, deny warnings)
-        working-directory: clients/android
-        run: ./gradlew :kit:cargoNdkClippy --stacktrace
-
       # The kit's JVM unit tests — the pure parsers, migrations and feedback policies. They were
       # running nowhere: this workflow only assembled, and android-screenshots.yml runs the :app
       # module's tests, so nothing enforced :kit's. Cheap (a couple of seconds against an already

.gitea/workflows/arch.yml

@@ -48,26 +48,7 @@ on:
     # `punktfunk-canary` pacman repo as X.Y.Z-0.<run#> (sorts below the eventual X.Y.Z-1),
     # tags to `punktfunk` — separate repos, so neither channel can shadow the other.
     tags: ['v*']
-  # REBUILDING A PUBLISHED RELEASE, because on a rolling distro the ground moves under one.
-  # Arch went FFmpeg 8 -> 9 (every libav soname +1) four minutes before v0.25.0 was tagged, so
-  # the release's punktfunk-host was linked in a builder image that still had 8 and shipped
-  # `libavcodec.so=62-64`. No up-to-date Arch box can satisfy that — and pacman prepares the
-  # whole transaction at once, so it did not merely block our package, it blocked those users'
-  # entire `pacman -Syu`. The repair is a rebuild of the SAME upstream version at a HIGHER
-  # pkgrel; nothing else reaches a box that already has the broken build recorded in its db.
-  # The workflow file at the tag can never carry inputs added after it was tagged, so dispatch
-  # this from `main`: it checks the tag's SOURCE out, publishes to the STABLE repo, and
-  # replaces the release-page assets. Same lever for any future "the distro moved" rebuild.
   workflow_dispatch:
-    inputs:
-      release_tag:
-        description: 'Rebuild this published release (e.g. v0.25.0) into the stable `punktfunk` repo. Empty = ordinary canary build of the dispatched ref.'
-        required: false
-        default: ''
-      pkgrel:
-        description: 'pkgrel for that rebuild — MUST be above the published one (2, 3, …); a same-pkgrel republish is invisible to pacman. Ignored without release_tag.'
-        required: false
-        default: '2'
 
 env:
   REGISTRY: git.unom.io
@@ -113,52 +94,7 @@ jobs:
           }
           bun --version
 
-      # THE BUILDER'S FFmpeg IS PART OF THE PACKAGE CONTRACT, not merely a build detail.
-      # packaging/arch/PKGBUILD binds punktfunk-host to the exact libav sonames it linked
-      # (`libavcodec.so=63-64` …), so a builder one FFmpeg major behind Arch emits a package
-      # that NOBODY can install — and takes the user's whole `pacman -Syu` down with it, since
-      # pacman prepares the transaction as a unit. That is exactly how v0.25.0 shipped: PR #108
-      # re-keyed this image for FFmpeg 9, the release tag fired four minutes later, and the job
-      # still got the FFmpeg-8 `:latest`. The image is a cache and is allowed to lag — but never
-      # on this one axis. So heal it in-job and shout, instead of building a dead package.
-      # (Runs BEFORE checkout: a stale image should be repaired before anything depends on it.)
-      - name: FFmpeg soname parity with today's Arch (heals a stale builder image)
-        run: |
-          export LC_ALL=C   # `Provides` is a localized field name
-          # Piped (never a TTY here) pacman prints each field on ONE line, unwrapped.
-          sonames() { sed -n 's/^Provides *: *//p' | tr ' ' '\n' | grep -E '^lib(av|sw)[a-z]*\.so=' | sort | tr '\n' ' '; }
-          # A SEPARATE --dbpath: this refreshes only a throwaway view of the repos, so the
-          # container's own db never enters the partial-upgrade state a bare `pacman -Sy` leaves.
-          mkdir -p /tmp/pf-archsync
-          if ! pacman -Sy --dbpath /tmp/pf-archsync --logfile /dev/null >/dev/null 2>&1; then
-            echo "::warning::could not refresh the Arch db — skipping the FFmpeg parity check"
-            exit 0
-          fi
-          HAVE="$(pacman -Qi ffmpeg | sonames)"
-          WANT="$(pacman -Si --dbpath /tmp/pf-archsync ffmpeg | sonames)"
-          echo "builder ffmpeg $(pacman -Q ffmpeg | cut -d' ' -f2): $HAVE"
-          echo "arch    ffmpeg $(pacman -Si --dbpath /tmp/pf-archsync ffmpeg | sed -n 's/^Version *: *//p'): $WANT"
-          if [ "$HAVE" = "$WANT" ]; then
-            echo "OK: the builder links the FFmpeg every up-to-date Arch box already has"
-            exit 0
-          fi
-          echo "::warning::arch-ci is stale ACROSS AN FFMPEG SONAME BUMP — upgrading it for this run."
-          echo "::warning::Bump the 'refreshed:' date in ci/arch-ci.Dockerfile so the IMAGE carries it."
-          pacman -Syu --noconfirm || true
-          HAVE="$(pacman -Qi ffmpeg | sonames)"
-          if [ "$HAVE" != "$WANT" ]; then
-            echo "::error::builder still links $HAVE while Arch ships $WANT."
-            echo "::error::Building on would publish a package no Arch box can install."
-            exit 1
-          fi
-          echo "healed: builder now links $HAVE"
-
       - uses: actions/checkout@v4
-        with:
-          # A dispatched release rebuild takes its WORKFLOW from the ref you dispatch (the only
-          # way it can carry inputs the tag predates) and its SOURCE from the tag. Empty string
-          # = checkout's own default, i.e. the triggering ref, for every other trigger.
-          ref: ${{ github.event.inputs.release_tag }}
 
       # Cache cargo's git dir too, not just the registry: the workspace includes
       # clients/windows, whose windows-reactor/windows deps are git-pinned — cargo must CLONE
@@ -191,30 +127,12 @@ jobs:
         # Keep the leading `0.` — it is what sorts a canary BELOW the eventual `X.Y.Z-1` stable
         # release. (A pkgrel is digits+dots only, so `0.` is the only prefix available; raising
         # it to `1.` would sort canaries ABOVE the release and is not an option.)
-        env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag }}
-          REBUILD_PKGREL: ${{ github.event.inputs.pkgrel }}
         run: |
           eval "$(bash scripts/ci/pf-version.sh)"   # -> PF_BASE (one minor ahead of latest stable)
-          if [ -n "${RELEASE_TAG:-}" ]; then
-            # Dispatched rebuild of a published release (see the workflow_dispatch note at the
-            # top): same upstream version, higher pkgrel, straight into the stable repo.
-            # ⚠ Keep that pkgrel SINGLE-DIGIT. Gitea's Arch registry picks the version its .db
-            # advertises by STRING order (the same trap the canary zero-padding below exists for),
-            # so "0.25.0-10" sorts BELOW "0.25.0-2" and the rebuild would never be advertised.
-            V="${RELEASE_TAG#v}"
-            R="${REBUILD_PKGREL:-2}"
-            REPO=punktfunk
-            case "$R" in
-              ''|*[!0-9.]*) echo "::error::pkgrel '$R' is not digits+dots"; exit 1 ;;
-              1) echo "::error::pkgrel 1 is the published build — a rebuild MUST go up (2, 3, …)"; exit 1 ;;
-            esac
-          else
-            case "$GITHUB_REF" in
-              refs/tags/v*) V="${GITHUB_REF_NAME#v}"; R="1";                       REPO=punktfunk ;;
-              *)            V="$PF_BASE";  R="0.$(printf '%08d' "$GITHUB_RUN_NUMBER")";  REPO=punktfunk-canary ;;
-            esac
-          fi
+          case "$GITHUB_REF" in
+            refs/tags/v*) V="${GITHUB_REF_NAME#v}"; R="1";                       REPO=punktfunk ;;
+            *)            V="$PF_BASE";  R="0.$(printf '%08d' "$GITHUB_RUN_NUMBER")";  REPO=punktfunk-canary ;;
+          esac
           echo "PF_PKGVER=$V" >> "$GITHUB_ENV"
           echo "PF_PKGREL=$R" >> "$GITHUB_ENV"
           echo "REPO=$REPO" >> "$GITHUB_ENV"
@@ -255,46 +173,6 @@ jobs:
             makepkg -f -d --holdver
           ls -lh "$GITHUB_WORKSPACE/dist"
 
-      # The host must ship a VERSIONED libav soname dep, and nothing else in this pipeline proves
-      # it. packaging/arch/PKGBUILD lists bare `libavcodec.so` etc. and relies on makepkg rewriting
-      # each into `libavcodec.so=<soname>-<arch>` from the built binary's DT_NEEDED; if that
-      # rewrite ever stops happening — Arch dropping the soname `provides`, someone "tidying" the
-      # entries out of `depends`, a makepkg change — the dep silently degrades to an unversioned
-      # name that ANY ffmpeg satisfies. That is precisely the 2026-08-08 state in which `pacman
-      # -Syu` walked every Arch/CachyOS install across the FFmpeg 8 -> 9 soname bump and left the
-      # host unable to start (exit 127 before main(), restart loop). The failure is invisible in a
-      # green build and only shows up as a bricked box weeks later, so assert it here.
-      - name: Assert the host pins the FFmpeg soname
-        run: |
-          PKG="$(ls "$GITHUB_WORKSPACE"/dist/punktfunk-host-*.pkg.tar.zst | head -1)"
-          DEPS="$(bsdtar -xOf "$PKG" .PKGINFO | sed -n 's/^depend = //p')"
-          echo "$DEPS" | sed 's/^/  depend = /'
-          for lib in libavcodec libavutil; do
-            echo "$DEPS" | grep -qE "^$lib\.so=[0-9]+-[0-9]+$" || {
-              echo "::error::punktfunk-host declares no VERSIONED $lib.so dependency."
-              echo "::error::makepkg did not expand the bare soname from DT_NEEDED, so pacman can"
-              echo "::error::upgrade FFmpeg across a soname break and brick the install."
-              echo "::error::See the depends comment in packaging/arch/PKGBUILD."
-              exit 1
-            }
-          done
-          echo "OK: $(echo "$DEPS" | grep -E '^libav|^libsw' | tr '\n' ' ')"
-
-      # 0.26.0-1 setcap'd `cap_sys_nice=ep` on the host from this package's .INSTALL scriptlet and
-      # killed desktop streaming on every KDE box — with a green board, because nothing here ever
-      # looked at what the built package would DO. The lesson recorded then was "verify the
-      # PACKAGE, never the board"; this is that, and pacman is the channel where it matters most,
-      # since capabilities live in the scriptlet rather than in package metadata.
-      #
-      # Host must carry NOTHING, the worker exactly cap_sys_nice=ep. `--self-test` runs first so a
-      # guard that has quietly lost the ability to fail takes the job down rather than approving a
-      # release. (Only the host package is checked: the client/web/scripting packages ship neither
-      # binary and the script skips them by itself.)
-      - name: Assert the capability matrix (Arch package)
-        run: |
-          bash scripts/ci/assert-cap-matrix.sh --self-test
-          bash scripts/ci/assert-cap-matrix.sh "$GITHUB_WORKSPACE"/dist/punktfunk-host-*.pkg.tar.zst
-
       # The optional HDR gamescope companion (packaging/gamescope) — a separate pkgbase with a
       # completely different dependency set, published into the same repo so `pacman -S
       # punktfunk-gamescope` is all an Arch/SteamOS box needs for 10-bit BT.2020 PQ.
@@ -332,63 +210,6 @@ jobs:
             rm -rf dist-gamescope   # never cache a failed build (an empty path is not saved)
           fi
 
-      # THE GATE THIS PIPELINE WAS MISSING. The soname assert above proves the libav dep is
-      # VERSIONED; it cannot prove the version is one that EXISTS. v0.25.0 passed it and still
-      # shipped `libavcodec.so=62-64` to a world that had moved to 63 — every affected user got
-      # "unable to satisfy dependency … required by punktfunk-host", and because pacman prepares
-      # one transaction, their whole system upgrade stopped there. So ask the only question that
-      # matters before publishing: would a real, up-to-date Arch box install this?
-      #
-      # An empty --dbpath is what makes the answer honest. It means "nothing is installed", so
-      # pacman must satisfy every dependency FROM THE REPOS exactly as a user's box does. Checking
-      # against the builder's own installed set instead would let a stale ffmpeg satisfy the stale
-      # bound and hide the break completely — the very illusion that shipped v0.25.0. `--print`
-      # resolves and prints; it downloads nothing and installs nothing. Verified against the real
-      # broken artifact on an ffmpeg-9 box: it reproduces the user-visible failure verbatim.
-      - name: Assert every package installs on an up-to-date Arch box
-        run: |
-          export LC_ALL=C
-          mkdir -p /tmp/pf-instcheck
-          if ! pacman -Sy --dbpath /tmp/pf-instcheck --logfile /dev/null >/dev/null 2>&1; then
-            echo "::error::could not sync the Arch db — cannot prove these packages install"
-            exit 1
-          fi
-          check() {   # check FILE -> 0 installable, 1 not (reason on stdout)
-            pacman -U --print --noconfirm --dbpath /tmp/pf-instcheck --logfile /dev/null "$1" 2>&1
-          }
-          ls dist/*.pkg.tar.zst >/dev/null 2>&1 || { echo "::error::nothing in dist/ to check"; exit 1; }
-          rc=0
-          for pkg in dist/*.pkg.tar.zst; do
-            if out="$(check "$pkg")"; then
-              echo "OK  $(basename "$pkg")  ($(echo "$out" | wc -l) targets resolve)"
-            else
-              rc=1
-              echo "::error::$(basename "$pkg") CANNOT be installed on an up-to-date Arch box:"
-              echo "$out" | sed 's/^/    /'
-            fi
-          done
-          # gamescope stays best-effort, exactly as its build step is: a companion that cannot
-          # install is dropped from the upload with a warning, never a reason to withhold the
-          # packages this workflow exists to publish. (It is also the one package that can be
-          # restored from a cache older than the current Arch snapshot.)
-          for pkg in dist-gamescope/*.pkg.tar.zst; do
-            [ -e "$pkg" ] || continue
-            if out="$(check "$pkg")"; then
-              echo "OK  $(basename "$pkg")  ($(echo "$out" | wc -l) targets resolve)"
-            else
-              echo "::warning::$(basename "$pkg") is not installable on current Arch — NOT publishing it"
-              echo "$out" | sed 's/^/    /'
-              rm -f "$pkg"
-            fi
-          done
-          if [ "$rc" != 0 ]; then
-            echo "::error::refusing to publish: pacman would reject this on a current box, and a"
-            echo "::error::rejected dependency blocks the user's ENTIRE upgrade, not just punktfunk."
-            echo "::error::Usual cause: the arch-ci builder image lags Arch across a soname bump —"
-            echo "::error::bump 'refreshed:' in ci/arch-ci.Dockerfile, let docker.yml republish it, re-run."
-            exit 1
-          fi
-
       # NOTE deliberately NO sysext image is built or published here: a prebuilt HOST binary on
       # SteamOS breaks on the next A/B soname bump (and /var — where sysexts live — is
       # per-partition-set), which is the standing packaging verdict behind the on-device
@@ -416,48 +237,14 @@ jobs:
           done
           echo "published to $OWNER/arch/$REPO"
 
-      # On a real release, also attach the packages to the unified Gitea Release. A dispatched
-      # rebuild attaches to that SAME release object: the release page is a distribution surface
-      # too, and leaving the superseded .pkg.tar.zst sitting on it is one click away from handing
-      # someone the exact break the rebuild exists to fix.
-      - name: Attach packages to the Gitea release (stable tags + release rebuilds)
-        if: startsWith(gitea.ref, 'refs/tags/v') || github.event.inputs.release_tag != ''
+      # On a real release, also attach the packages to the unified Gitea Release.
+      - name: Attach packages to the Gitea release (stable tags only)
+        if: startsWith(gitea.ref, 'refs/tags/v')
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag }}
         run: |
           . scripts/ci/gitea-release.sh
-          TAG="${RELEASE_TAG:-$GITHUB_REF_NAME}"
-          RID=$(ensure_release "$TAG" "$TAG" auto)
+          RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
           for pkg in dist/*.pkg.tar.zst; do
             upsert_asset "$RID" "$pkg"
           done
-          # A rebuild bumps pkgrel, so its FILENAMES differ from the ones already attached, and
-          # upsert_asset only replaces by name — the superseded set would survive untouched.
-          # Drop every pacman asset (and .sha256 sidecar) this upload did not just write.
-          #
-          # ⚠⚠ THIS MUST LIVE IN THE WORKFLOW, NOT IN scripts/ci/gitea-release.sh. The sourced
-          # script comes from the CHECKED-OUT TREE, which on a release rebuild is the OLD TAG —
-          # so it can only ever offer the helpers that existed when that tag was cut. A helper
-          # added for this feature is therefore guaranteed ABSENT in the one code path that
-          # calls it: the first attempt failed with `prune_release_assets: command not found`
-          # after publishing perfectly. Only the workflow file itself is taken from the ref you
-          # dispatch. Same reason a packaging fix made after a tag does NOT reach a rebuild of
-          # that tag — the PKGBUILD is the tag's too.
-          if [ -n "${RELEASE_TAG:-}" ]; then
-            KEEP="$(cd dist && printf '%s ' *.pkg.tar.zst)"
-            # An UNMATCHED glob would come through literally and match nothing in the keep set —
-            # i.e. "delete every pacman asset on the release". Skip entirely instead.
-            case "$KEEP" in *'*'*) KEEP="" ;; esac
-            API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
-            if [ -n "$KEEP" ]; then
-              curl -fsS "$API/releases/$RID/assets" -H "Authorization: token $GITEA_TOKEN" \
-                | python3 -c "import json,sys;k=set(sys.argv[1].split());k|={n+'.sha256' for n in k};print('\n'.join('%s %s'%(a['id'],a['name']) for a in json.load(sys.stdin) if a.get('name','').endswith(('.pkg.tar.zst','.pkg.tar.zst.sha256')) and a['name'] not in k))" "$KEEP" \
-                | while read -r id name; do
-                    [ -n "$id" ] || continue
-                    echo "dropping superseded release asset: $name"
-                    curl -fsS -o /dev/null -X DELETE "$API/releases/$RID/assets/$id" \
-                      -H "Authorization: token $GITEA_TOKEN" || true
-                  done
-            fi
-          fi

.gitea/workflows/deb.yml

@@ -310,14 +310,8 @@ jobs:
           # with "there is no reactor running, must be called from the context of a Tokio 1.x runtime".
           # It WAS listed here, which is why only the .deb shipped a crashing tray while the RPM and
           # Arch packages — which already split it — were fine.
-          #
-          # punktfunk-encode-worker IS in this invocation: it is the capability-carrying PyroWave
-          # encode worker that ships next to the host in /usr/bin, and build-deb.sh only builds it
-          # if the artifact is missing — building it here keeps it on the same sccache pass as the
-          # host. Unlike the tray it shares the host's dependency graph by design (v1 accepts that
-          # the worker links the same FFmpeg), so feature unification here is harmless.
           cargo build --release --locked --features punktfunk-host/nvenc,punktfunk-host/vulkan-encode \
-            -p punktfunk-host -p punktfunk-encode-worker
+            -p punktfunk-host
 
       - name: Build host .deb (FFmpeg bundled)
         # BUNDLE_FFMPEG=1 copies the image's /opt/ffmpeg libav* into the package and repoints the
@@ -326,93 +320,6 @@ jobs:
         run: |
           VERSION="$VERSION" BUNDLE_FFMPEG=1 bash packaging/debian/build-deb.sh
 
-      # Read the capability matrix out of the BUILT .deb before it is published. dpkg carries no
-      # capability metadata — the postinst applies them — so this reads the postinst that will
-      # actually run on a user's box, plus the payload. 0.26.0-1 granted the host cap_sys_nice=ep
-      # from exactly that postinst and killed every KDE desktop session while every board stayed
-      # green: host must carry NOTHING, worker exactly cap_sys_nice=ep. `--self-test` first so a
-      # guard that can no longer fail takes the job down instead of waving the release through.
-      - name: Assert the capability matrix (host .deb)
-        run: |
-          bash scripts/ci/assert-cap-matrix.sh --self-test
-          bash scripts/ci/assert-cap-matrix.sh dist/punktfunk-host_*.deb
-
-      # punktfunk-gamescope for apt. Same reasoning as the RPM leg in rpm.yml: without a packaged
-      # build, a Debian/Ubuntu box has no route to the patched gamescope except compiling it, and a
-      # stock gamescope streams SDR, cursorless, and tells every game its display is 60 Hz.
-      #
-      # CACHED on packaging/gamescope/** alone — it depends on nothing else in this repo, so a
-      # normal push restores a binary instead of spending ~10 minutes on someone else's tree.
-      - uses: actions/cache@v4
-        id: gamescope
-        with:
-          path: gs-cache
-          key: punktfunk-gamescope-noble-${{ hashFiles('packaging/gamescope/**') }}
-
-      - name: Build the patched gamescope
-        if: steps.gamescope.outputs.cache-hit != 'true'
-        # Best-effort, exactly like rpm.yml: the host packages above are the primary delivery and
-        # work without this binary, so a hiccup building an unrelated tree must not fail the job.
-        # `build-dep gamescope` resolves the distro's much older packaged version, so it can come up
-        # short — that is what the `|| true`s absorb, and the marker check downstream is what makes
-        # a half-built result impossible to ship.
-        run: |
-          set -x
-          apt-get update
-          apt-get install -y --no-install-recommends meson ninja-build glslc git || true
-          apt-get build-dep -y gamescope || true
-          # NOT best-effort. `build-dep gamescope` resolves the distro's much older packaged
-          # gamescope — where noble has one at all — so it misses what the master tree needs, and
-          # wayland-protocols is the gap that actually stops the build: meson dies in
-          # protocol/meson.build with "Neither a subproject directory nor a wayland-protocols.wrap
-          # file was found", because the tree has no wrap fallback for it. That is what happened on
-          # the v0.26.0 tag: the step warned and skipped, the job stayed green, and the release
-          # shipped with no gamescope .deb while the notes said it had one.
-          apt-get install -y --no-install-recommends wayland-protocols
-          # The remaining Arch makedepends the older packaged gamescope does not necessarily pull.
-          # Best-effort: meson falls back or does without, and a name that moves between Ubuntu
-          # releases should not fail the job. (No libstdc++ static package is needed here — g++
-          # ships libstdc++.a, which is why only Fedora tripped the sanity check.)
-          # `build-dep gamescope` gives noble almost nothing — the distro has no comparable package
-          # — so the tree's real dependency set has to be named outright. One `apt-get` per name on
-          # purpose: a single transaction aborts wholesale on one unknown package, which would
-          # install NOTHING and hide the real gap behind a name typo. Best-effort per package, with
-          # the missing one named; the end-of-job gate below is what actually decides.
-          for p in libxdamage-dev libxcomposite-dev libxrender-dev libxext-dev libxxf86vm-dev \
-                   libxtst-dev libx11-dev libxres-dev libxmu-dev libxcursor-dev libxi-dev \
-                   libxfixes-dev libxkbcommon-dev libxkbcommon-x11-dev libcap-dev libdrm-dev \
-                   libinput-dev libudev-dev libpipewire-0.3-dev libseat-dev libsdl2-dev \
-                   libluajit-5.1-dev libavif-dev libdecor-0-dev hwdata libglm-dev libbenchmark-dev \
-                   glslang-tools libvulkan-dev libwayland-dev libxcb1-dev libxcb-composite0-dev \
-                   libxcb-xfixes0-dev libxcb-res0-dev libxcb-ewmh-dev libxcb-icccm4-dev \
-                   libxcb-errors-dev libpixman-1-dev libdisplay-info-dev libgbm-dev libegl-dev \
-                   cmake xwayland; do
-            apt-get install -y --no-install-recommends "$p" \
-              || echo "::warning::no such noble package: $p (gamescope may still build without it)"
-          done
-          if bash packaging/gamescope/build-punktfunk-gamescope.sh \
-               --destdir "$PWD/gs-stage" --prefix /usr --jobs "$(nproc)"; then
-            install -Dm0755 gs-stage/usr/bin/punktfunk-gamescope gs-cache/punktfunk-gamescope
-          else
-            # Warn only, even on a tag. The hard gate moved to the END of this job: failing HERE
-            # skips the host .deb's own publish + release-attach steps below, which is how the
-            # v0.26.0 release ended up still carrying the pre-CAP_SYS_NICE host .deb from an
-            # earlier tag commit — a KDE-breaking artifact withheld from replacement by a gate
-            # meant to protect the release. Never let a missing EXTRA stop a good artifact
-            # shipping; go red afterwards instead.
-            echo "::warning::punktfunk-gamescope failed to build on noble — no .deb this run (gamescope sessions stay SDR)"
-          fi
-
-      - name: Build punktfunk-gamescope .deb
-        # Picked up by the publish loop below, which globs dist/*.deb.
-        run: |
-          if [ -x gs-cache/punktfunk-gamescope ] && gs-cache/punktfunk-gamescope --version >/dev/null 2>&1; then
-            bash packaging/debian/build-gamescope-deb.sh --binary gs-cache/punktfunk-gamescope
-          else
-            # Warn only — see the note on the build step. The gate is the last step of this job.
-            echo "::warning::no usable punktfunk-gamescope — skipping its .deb"
-          fi
-
       - name: Publish to the Gitea apt registry
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
@@ -440,26 +347,6 @@ jobs:
             upsert_asset "$RID" "$DEB"
           done
 
-      # A release must not be able to make a claim its own CI silently dropped: v0.26.0's notes and
-      # docs-site said the patched gamescope was apt-installable while no .deb had ever been built,
-      # because every failure on this path was a `::warning::` that returned 0.
-      #
-      # ⚠ LAST step on purpose. The first version of this gate failed at the build step instead, and
-      # that skipped the host .deb's own publish + attach below — so the release kept the PREVIOUS
-      # tag commit's host .deb, which still carried the CAP_SYS_NICE postinst that breaks KDE. A
-      # gate protecting the release withheld the fix for it. Everything good ships first; the job
-      # goes red afterwards.
-      - name: A stable tag must ship the gamescope .deb
-        if: startsWith(gitea.ref, 'refs/tags/v')
-        run: |
-          shopt -s nullglob
-          built=(dist/punktfunk-gamescope_*.deb)
-          if [ ${#built[@]} -eq 0 ]; then
-            echo "::error::no punktfunk-gamescope .deb was built — a stable tag must not ship without it (the release notes and docs-site say it is apt-installable). Everything else in this job published normally; see the gamescope build step above for the meson error."
-            exit 1
-          fi
-          echo "gamescope .deb present: ${built[*]}"
-
   # ---------------------------------------------------------------------------------------------
   # The aarch64 CLIENT .deb. Cross-compiled on the ordinary amd64 runner in the
   # punktfunk-rust-ci-arm64cross image (the rust-ci toolchain + an arm64 multiarch sysroot — see

.gitea/workflows/nix.yml

@@ -7,24 +7,10 @@
 # Two tiers, because a full `nix flake check` builds the whole Rust workspace with crane and would
 # run for an hour on every push:
 #
-#   * eval  — `nix flake check --no-build`: instantiates every package, app, check and devShell
-#             without building them. Catches the failures that actually happen to this flake — a
-#             renamed file, a callPackage argument that no longer exists, a syntax error, a package
-#             attribute dropped from packages.nix.
-#
-#             ⚠ It does NOT, on its own, check the NixOS module. `nix flake check` handles
-#             `nixosModules` by forcing the value and asserting it is a lambda taking an open
-#             attribute set — nothing more (nix's own source: `// FIXME: if we have a 'nixpkgs'
-#             input, use it to check the module.`). MEASURED: a module setting a nonexistent
-#             OPTION, referencing a nonexistent `pkgs` attribute AND calling a nonexistent `lib`
-#             function passes clean, printing `checking NixOS module ... all checks passed!`. This
-#             header used to claim the module was covered here; it was not, for the module's whole
-#             life. It is covered NOW because `checks.<system>.nixos-module`
-#             (packaging/nix/module-check.nix) evaluates it against real nixpkgs and asserts on the
-#             rendered systemd units — and because those assertions are pure Nix, INSTANTIATING
-#             that check runs them, so `--no-build` is enough. Keep them pure: a shell script in
-#             the derivation body would only run under a full `nix flake check`, which builds the
-#             hour-long Rust packages.
+#   * eval  — `nix flake check --no-build`: instantiates every package, app, check, devShell and
+#             the NixOS module without building them. Catches the failures that actually happen to
+#             this flake — a renamed file, a callPackage argument that no longer exists, a syntax
+#             error, a package attribute dropped from packages.nix.
 #   * bun   — actually BUILDS punktfunk-web + punktfunk-scripting. These are the two derivations
 #             whose inputs churn constantly (every dependency bump moves a lockfile) and they cost
 #             minutes, not hours, because neither compiles Rust. This is the end-to-end proof that
@@ -36,12 +22,6 @@
 # They are the expensive ones and their inputs are already gated by the `rust` job in ci.yml; build
 # them by hand on a Nix box, or with the `build-rust` dispatch input below.
 #
-# ⚠ punktfunk-gamescope deserves the dispatch run more than it looks: `host.gamescopeHdr` DEFAULTS
-# TRUE, so it is on the critical path of every `services.punktfunk.host.enable = true` build, while
-# being the one package nothing here compiles. It patches whatever gamescope the pinned nixpkgs
-# carries, so a nixpkgs bump — not a change of ours — is what breaks it, and the first person to
-# find out would be an operator whose system rebuild fails. Run the dispatch after a flake.lock bump.
-#
 # ⚠ pull_request is deliberately present. flatpak.yml shipped with push-only triggers and manifest
 # breakage reached main invisibly for weeks — do not "simplify" this workflow by dropping it.
 # ⚠ The two path lists are duplicated on purpose: a YAML anchor would be tidier, but Gitea's
@@ -86,10 +66,6 @@ on:
         description: "Also build punktfunk-host + punktfunk-client (slow: full Rust workspace)"
         type: boolean
         default: false
-      build-gamescope:
-        description: "Also build punktfunk-gamescope (patched gamescope from source; run after a flake.lock bump)"
-        type: boolean
-        default: false
 
 jobs:
   flake:
@@ -189,13 +165,3 @@ jobs:
         if: ${{ github.event.inputs.build-rust == 'true' }}
         run: |
           "$NIX" build --print-build-logs .#punktfunk-host .#punktfunk-client
-
-      # The patched compositor. Separate from build-rust because its failure mode is different: it
-      # tracks nixpkgs' gamescope, not our Rust, so it wants a run after a flake.lock bump rather
-      # than after a code change. `gamescope.nix` fails loudly (an eval-time `throw` if nixpkgs no
-      # longer exposes a patchable derivation, a `+pfhdr` grep in installCheckPhase) — but only if
-      # something actually builds it.
-      - name: Build the patched gamescope (dispatch opt-in)
-        if: ${{ github.event.inputs.build-gamescope == 'true' }}
-        run: |
-          "$NIX" build --print-build-logs .#punktfunk-gamescope

.gitea/workflows/plugin-kit-publish.yml

@@ -66,13 +66,6 @@ jobs:
           test -f node_modules/@punktfunk/host/package.json
           test -f node_modules/@punktfunk/host/dist/index.d.ts
 
-      # The kit had no biome config and no lint step, while every plugin repo that consumes it does
-      # — so its source drifted (unused imports, formatting) with nothing to catch it. Now gated
-      # here, on the same config and pinned biome version the plugins use.
-      - name: Lint & format
-        working-directory: plugin-kit
-        run: bun run check
-
       - name: Typecheck
         working-directory: plugin-kit
         run: bun run typecheck

.gitea/workflows/rpm.yml

@@ -103,11 +103,7 @@ jobs:
           # gamescope`.) Matches packaging/rpm/punktfunk.spec, which dropped its BuildRequires too.
           dnf -y install gtk4-devel libadwaita-devel SDL3-devel
           # sysext build (packaging/bazzite/build-sysext.sh): squashfs + SELinux labeling.
-          # libcap = setcap/getcap: the sysext is the ONLY place the image can acquire
-          # cap_sys_nice=ep on punktfunk-encode-worker (a merged /usr is read-only squashfs and no
-          # scriptlet ever runs), and it is also what the build's host-must-be-uncapped assertion
-          # and the capability-matrix CI leg read with. Without it the image ships the lever inert.
-          dnf -y install squashfs-tools cpio libselinux-utils selinux-policy-targeted libcap
+          dnf -y install squashfs-tools cpio libselinux-utils selinux-policy-targeted
           # Fedora's own gamescope, for its RUNTIME libraries only — never shipped, never run. The
           # sysext folds in our punktfunk-gamescope and verifies it by executing `--version`, and
           # on a cache hit (the common case) nothing else in this job would have pulled libavif /
@@ -159,20 +155,6 @@ jobs:
           RPM_GPG_PASSPHRASE: ${{ secrets.RPM_GPG_PASSPHRASE }}
         run: bash packaging/rpm/sign-rpms.sh
 
-      # Read the file-capability matrix out of the BUILT rpm, before anything is signed or
-      # published. 0.26.0-1 shipped `%caps(cap_sys_nice=ep)` on the host through this very spec —
-      # on Fedora and, via rpm-ostree layering, on Bazzite — and every board was green while every
-      # KDE desktop session died in the field. The lesson recorded then was "verify the PACKAGE,
-      # never the board"; this is that. Host must carry NOTHING; the worker must carry exactly
-      # cap_sys_nice=ep. `--self-test` first, so a guard that has quietly stopped being able to
-      # fail takes the job down instead of waving the release through.
-      - name: Assert the capability matrix (rpm)
-        run: |
-          bash scripts/ci/assert-cap-matrix.sh --self-test
-          # Only the main host package carries binaries; -debuginfo/-debugsource and the
-          # client/web/scripting subpackages ship neither and are skipped by the script itself.
-          bash scripts/ci/assert-cap-matrix.sh dist/punktfunk-[0-9]*.rpm
-
       - name: Publish to the Gitea RPM registry
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
@@ -224,89 +206,13 @@ jobs:
           dnf -y install dnf-plugins-core meson ninja-build glslc || true
           dnf builddep -y gamescope || true
           dnf -y install xorg-x11-server-Xwayland-devel || true
-          # NOT best-effort: build-punktfunk-gamescope.sh appends `-static-libstdc++` to LDFLAGS
-          # (so the binary still starts on SteamOS's older libstdc++ — see its comment), and
-          # without the static library meson's very FIRST sanity check dies with
-          # "cannot find -lstdc++ / have you installed the static version", so nothing builds at
-          # all. That is what happened on the v0.26.0 tag: both Fedora bases warned and skipped,
-          # the job stayed green, and the release shipped with no gamescope RPM while the notes
-          # said it had one. A rename here must be LOUD, hence no `|| true`.
-          dnf -y install libstdc++-static
-          # The rest of the Arch package's makedepends that Fedora's older packaged gamescope does
-          # not necessarily pull. Best-effort: unlike the static runtime, meson finds fallbacks or
-          # does without, and a name that moves between Fedora releases should not fail the job.
-          dnf -y install wayland-protocols-devel glm-devel cmake libXcursor-devel || true
           if bash packaging/gamescope/build-punktfunk-gamescope.sh \
                --destdir "$PWD/gs-stage" --prefix /usr --jobs "$(nproc)"; then
             install -Dm0755 gs-stage/usr/bin/punktfunk-gamescope gs-cache/punktfunk-gamescope
           else
-            # Warn only, even on a tag — the hard gate is the LAST step of this job. Failing here
-            # would skip the sysext build, the sysext feed, AND the release attach below, so a
-            # missing gamescope would also withhold the punktfunk RPMs and the .raw images that
-            # built perfectly well. deb.yml learned that the expensive way on v0.26.0.
             echo "::warning::punktfunk-gamescope failed to build for f${{ matrix.fedver }} — the sysext ships without it (gamescope sessions stay SDR)"
           fi
 
-      # The same binary, as an ordinary RPM. The sysext below is the Atomic/Bazzite delivery; this
-      # is the one a traditional Fedora-family box (Nobara, plain Fedora) can actually install —
-      # until it existed those users had no packaged route to the patched build at all, and a stock
-      # gamescope tells every game its display is 60 Hz whatever the client negotiated.
-      #
-      # Same best-effort rule as the build above: no binary, no package, and the host stays on its
-      # existing SDR/host-composited path. The spec re-checks the +pfhdr marker itself.
-      - name: Package punktfunk-gamescope as an RPM
-        run: |
-          if [ -x gs-cache/punktfunk-gamescope ] && gs-cache/punktfunk-gamescope --version >/dev/null 2>&1; then
-            bash packaging/gamescope/build-gamescope-rpm.sh \
-              --binary gs-cache/punktfunk-gamescope \
-              --release "$PF_RELEASE"
-          else
-            # Warn only — see the note on the build step. The gate is the last step of this job.
-            echo "::warning::no usable punktfunk-gamescope for f${{ matrix.fedver }} — skipping its RPM"
-          fi
-
-      # A SECOND signing pass, for this package only. The main "Sign RPMs" step ran back at build
-      # time, long before this RPM existed — the gamescope build sits behind its own ~10-minute
-      # cache and deliberately runs after the host RPMs are already published. So every
-      # punktfunk-gamescope RPM went to the registry UNSIGNED, and the repo file we tell users to
-      # install carries gpgcheck=1: `dnf install punktfunk-gamescope` failed with "The package is
-      # not signed" on every Fedora and Nobara box. The package was in the channel the whole time
-      # and could not be installed from it — which is worse than absent, because the release notes
-      # and the docs-site both say it is there.
-      #
-      # Same fail-closed rule as the first pass: sign-rpms.sh hard-fails on refs/tags/v* if the org
-      # secret is missing, rather than republishing something a user's dnf will reject.
-      - name: Sign punktfunk-gamescope
-        env:
-          RPM_GPG_PRIVATE_KEY: ${{ secrets.RPM_GPG_PRIVATE_KEY }}
-          RPM_GPG_PASSPHRASE: ${{ secrets.RPM_GPG_PASSPHRASE }}
-        run: |
-          shopt -s nullglob
-          rpms=(dist/punktfunk-gamescope-*.rpm)
-          # No RPM here is the best-effort skip above, already warned about — not a signing failure.
-          if [ "${#rpms[@]}" -eq 0 ]; then
-            echo "no punktfunk-gamescope RPM to sign (see the packaging step above)"
-            exit 0
-          fi
-          bash packaging/rpm/sign-rpms.sh "${rpms[@]}"
-
-      - name: Publish punktfunk-gamescope to the Gitea RPM registry
-        env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          shopt -s nullglob
-          for rpm in dist/punktfunk-gamescope-*.rpm; do
-            case "$rpm" in *debuginfo*|*debugsource*) continue;; esac
-            NAME=$(rpm -qp --qf '%{NAME}' "$rpm" 2>/dev/null)
-            VR=$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$rpm" 2>/dev/null)
-            ARCH=$(rpm -qp --qf '%{ARCH}' "$rpm" 2>/dev/null)
-            echo "uploading $rpm"
-            curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
-              "https://$REGISTRY/api/packages/$OWNER/rpm/$GROUP/package/$NAME/$VR/$ARCH" || true
-            curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$rpm" \
-              "https://$REGISTRY/api/packages/$OWNER/rpm/$GROUP/upload"
-          done
-
       # The no-layering Bazzite path: wrap the just-built host + web RPMs into a systemd-sysext
       # image and publish it to the per-Fedora-major feed (punktfunk-sysext/f43[-canary], …) that
       # `punktfunk-sysext install|update` reads. Same RPMs, same channels — just no rpm-ostree.
@@ -330,19 +236,6 @@ jobs:
             dist/punktfunk-web-"${PF_VERSION}-${PF_RELEASE}"*.rpm \
             dist/punktfunk-scripting-"${PF_VERSION}-${PF_RELEASE}"*.rpm
 
-      # Read the capability matrix back OUT of the image that is about to be published — the one
-      # channel where getting it wrong is unrepairable, because a merged sysext's /usr is read-only
-      # squashfs and the only fix is a new image plus a feed republish. 0.26.0-1's Bazzite breakage
-      # was confirmed exactly this way, after the fact, by mounting the published .raw and running
-      # getcap on it. Doing it here means the .raw never reaches the feed.
-      #
-      # The script proves its own reader first (cap a file, squash it, unsquash it, read it back)
-      # so a runner that cannot see file capabilities FAILS the leg instead of blessing the image.
-      - name: Assert the capability matrix (sysext image)
-        run: |
-          bash scripts/ci/assert-cap-matrix.sh \
-            "dist-sysext/punktfunk-${PF_VERSION}-${PF_RELEASE}-x86-64.raw"
-
       # The feed's SHA256SUMS is OpenPGP-signed with the same packages@unom.io key as the RPMs, and
       # punktfunk-sysext(8) refuses a feed it can't verify — the checksums alone never proved
       # anything, sitting on the same registry as the images they describe.
@@ -383,26 +276,3 @@ jobs:
           for raw in dist-sysext/*.raw; do
             upsert_asset "$RID" "$raw" "$(basename "$raw" .raw).f${{ matrix.fedver }}.raw"
           done
-
-      # A release must not be able to make a claim its own CI silently dropped — v0.26.0's notes
-      # said the patched gamescope was dnf-installable while both Fedora bases had skipped it on a
-      # `::warning::` (missing libstdc++-static, which the -static-libstdc++ link needs).
-      #
-      # ⚠ LAST step on purpose, matching deb.yml: failing at the build step instead would skip the
-      # sysext image, the feed publish AND the attach above, withholding the punktfunk RPMs and
-      # .raw images that built perfectly well. Everything good ships first; the job goes red after.
-      - name: A stable tag must ship the gamescope RPM
-        if: startsWith(gitea.ref, 'refs/tags/v')
-        run: |
-          shopt -s nullglob
-          built=(dist/punktfunk-gamescope-*.rpm)
-          keep=()
-          for r in "${built[@]}"; do
-            case "$r" in *debuginfo*|*debugsource*) continue;; esac
-            keep+=("$r")
-          done
-          if [ ${#keep[@]} -eq 0 ]; then
-            echo "::error::no punktfunk-gamescope RPM was built for f${{ matrix.fedver }} — a stable tag must not ship without it (the release notes and docs-site say it is installable). Everything else in this job published normally; see the gamescope build step above for the meson error."
-            exit 1
-          fi
-          echo "gamescope RPM present: ${keep[*]}"

.gitea/workflows/sbom.yml

@@ -9,7 +9,7 @@
 #
 # What goes in: scripts/ci/gen-sbom.sh = syft over the checkout (every lockfile-pinned dep in
 # both Rust workspaces + the JS trees + Swift Package.resolved) merged with
-# compliance/sbom/manual-components.cdx.json (vendored C/C++, bundled DLLs, gamescope).
+# compliance/sbom/manual-components.cdx.json (vendored C/C++, bundled DLLs, VB-CABLE, gamescope).
 name: sbom
 # One pending run per workflow+ref: a newer push supersedes the queued/running one and cancels
 # it (a canary only needs the latest commit; each release tag is its own ref so tag runs never

.gitea/workflows/windows-host.yml

@@ -150,6 +150,13 @@ jobs:
           if (-not $env:FFMPEG_DIR) {
             "FFMPEG_DIR=C:\Users\Public\ffmpeg" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
           }
+          # VBCABLE_DIR: the pinned official VB-CABLE package (provisioned by
+          # provision-windows-punktfunk-extras.ps1) -> pack-host-installer.ps1 bundles the
+          # streaming virtual microphone. Same daemon-env-or-fallback pattern as FFMPEG_DIR
+          # (the daemon env only refreshes on a runner-task restart).
+          if (-not $env:VBCABLE_DIR) {
+            "VBCABLE_DIR=C:\Users\Public\vbcable" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          }
           $pf = & "$env:GITHUB_WORKSPACE/scripts/ci/pf-version.ps1"   # single source of truth: base is one minor ahead of the latest stable tag
           $v = if ($env:GITHUB_REF -like 'refs/tags/v*') {
             $env:GITHUB_REF_NAME -replace '^v', ''
@@ -399,6 +406,7 @@ jobs:
             @{ n = 'bun runtime (BUN_EXE)';           p = $env:BUN_EXE;          f = '' }
             @{ n = 'plugin runner (SCRIPTING_BUNDLE)';p = $env:SCRIPTING_BUNDLE; f = '' }
             @{ n = 'FFmpeg DLLs (FFMPEG_DIR\bin)';    p = $env:FFMPEG_DIR;       f = 'bin' }
+            @{ n = 'VB-CABLE (VBCABLE_DIR)';          p = $env:VBCABLE_DIR;      f = 'VBCABLE_Setup_x64.exe' }
           )
           $missing = @()
           foreach ($x in $need) {

Cargo.lock

@@ -647,9 +647,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.4.1"
+version = "1.2.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9066c49992464636f92905fa096ec58baaa4d57ec19a5c096c68d3e25ef3d136"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -994,7 +994,7 @@ dependencies = [
 
 [[package]]
 name = "cursor-probe"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "pf-capture",
@@ -1114,7 +1114,7 @@ dependencies = [
 
 [[package]]
 name = "display-disturb"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "windows 0.62.2 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
@@ -1290,9 +1290,9 @@ dependencies = [
 
 [[package]]
 name = "ffmpeg-next"
-version = "9.0.0"
+version = "8.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6380599799e175191eb7ffe82c97f36a2a90a36cbc54c738a903e5287d7f516a"
+checksum = "f7c4bd5ab1ac61f29c634df1175d350ded29cf74c3c6d4f7030431a5ae3c7d5d"
 dependencies = [
  "bitflags 2.13.0",
  "ffmpeg-sys-next",
@@ -1301,9 +1301,9 @@ dependencies = [
 
 [[package]]
 name = "ffmpeg-sys-next"
-version = "9.0.0"
+version = "8.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b939bf79dd5949412a4b81cfe21a07f48ea21b47fcbb5f57816c8c2de5ae30b"
+checksum = "a314bc0e022a33a99567ed4bd2576bd58ffd8fcff7891c29194cfecc26a62547"
 dependencies = [
  "bindgen",
  "cc",
@@ -1341,9 +1341,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.10"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -2358,7 +2358,7 @@ dependencies = [
 
 [[package]]
 name = "latency-probe"
-version = "0.27.0"
+version = "0.24.0"
 
 [[package]]
 name = "lazy_static"
@@ -2463,7 +2463,7 @@ dependencies = [
 
 [[package]]
 name = "libvpl-sys"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "bindgen",
  "cmake",
@@ -2498,7 +2498,7 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "loss-harness"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "punktfunk-core",
 ]
@@ -2988,7 +2988,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pf-bitstream"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "cros-codecs",
  "tracing",
@@ -2996,7 +2996,7 @@ dependencies = [
 
 [[package]]
 name = "pf-capture"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -3017,7 +3017,7 @@ dependencies = [
 
 [[package]]
 name = "pf-client-core"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -3047,12 +3047,11 @@ dependencies = [
  "wasapi",
  "windows 0.62.2 (git+https://github.com/microsoft/windows-rs?rev=acb5a1a7441033d9312b16842af02eb0c2b403dc)",
  "winreg",
- "x11rb",
 ]
 
 [[package]]
 name = "pf-clipboard"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -3070,7 +3069,7 @@ dependencies = [
 
 [[package]]
 name = "pf-console-ui"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -3091,7 +3090,7 @@ dependencies = [
 
 [[package]]
 name = "pf-dxvadec"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "cros-codecs",
  "pf-bitstream",
@@ -3101,7 +3100,7 @@ dependencies = [
 
 [[package]]
 name = "pf-encode"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -3118,8 +3117,6 @@ dependencies = [
  "pf-zerocopy",
  "punktfunk-core",
  "pyrowave-sys",
- "serde",
- "serde_json",
  "tracing",
  "tracing-subscriber",
  "windows 0.62.2 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -3127,7 +3124,7 @@ dependencies = [
 
 [[package]]
 name = "pf-frame"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "libc",
@@ -3139,7 +3136,7 @@ dependencies = [
 
 [[package]]
 name = "pf-gpu"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "pf-host-config",
@@ -3153,11 +3150,11 @@ dependencies = [
 
 [[package]]
 name = "pf-host-config"
-version = "0.27.0"
+version = "0.24.0"
 
 [[package]]
 name = "pf-inject"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -3186,20 +3183,19 @@ dependencies = [
 
 [[package]]
 name = "pf-paths"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "tracing",
 ]
 
 [[package]]
 name = "pf-presenter"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ash",
  "async-channel",
  "pf-client-core",
- "pf-vkdecode",
  "punktfunk-core",
  "sdl3",
  "tracing",
@@ -3208,7 +3204,7 @@ dependencies = [
 
 [[package]]
 name = "pf-update"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3216,7 +3212,7 @@ dependencies = [
 
 [[package]]
 name = "pf-update-check"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -3228,7 +3224,7 @@ dependencies = [
 
 [[package]]
 name = "pf-vaadec"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "cros-codecs",
  "pf-bitstream",
@@ -3237,7 +3233,7 @@ dependencies = [
 
 [[package]]
 name = "pf-vdisplay"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ashpd",
@@ -3270,7 +3266,7 @@ dependencies = [
 
 [[package]]
 name = "pf-vkdecode"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "ash",
  "cros-codecs",
@@ -3281,7 +3277,7 @@ dependencies = [
 
 [[package]]
 name = "pf-win-display"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "pf-paths",
@@ -3293,7 +3289,7 @@ dependencies = [
 
 [[package]]
 name = "pf-zerocopy"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ash",
@@ -3516,7 +3512,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-cli"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "pf-client-core",
  "punktfunk-core",
@@ -3527,7 +3523,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-android"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "android_logger",
  "jni",
@@ -3545,7 +3541,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-linux"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3562,7 +3558,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-session"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "pf-client-core",
@@ -3577,7 +3573,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-windows"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "async-channel",
  "mdns-sd",
@@ -3596,7 +3592,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-core"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "aes-gcm",
  "bytes",
@@ -3626,18 +3622,9 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "punktfunk-encode-worker"
-version = "0.27.0"
-dependencies = [
- "pf-encode",
- "tracing",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "punktfunk-host"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -3722,7 +3709,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-probe"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "mdns-sd",
@@ -3736,7 +3723,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-tray"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "anyhow",
  "ksni",
@@ -3759,7 +3746,7 @@ checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
 
 [[package]]
 name = "pyrowave-sys"
-version = "0.27.0"
+version = "0.24.0"
 dependencies = [
  "bindgen",
  "cmake",

Cargo.toml

@@ -4,9 +4,6 @@ members = [
     "crates/punktfunk-core",
     "crates/punktfunk-host",
     "crates/punktfunk-host/vendor/usbip-sim",
-    # The capability-carrying PyroWave encode worker. A SEPARATE binary by design — never a
-    # hardlink of, or a subcommand of, punktfunk-host (design/gpu-priority-capability-worker.md).
-    "crates/punktfunk-encode-worker",
     "crates/punktfunk-tray",
     "crates/pf-bitstream",
     "crates/pf-bitstream/vendor/cros-codecs",
@@ -49,11 +46,6 @@ members = [
 exclude = [
     "packaging/linux/steam-deck-gadget/usbip-poc",
     "clients/android/native/vendor/ndk",
-    # Bring-your-own-hardware measurement tools. `hid-descriptor-dump` pulls `hidapi`, a C library
-    # wanting libudev on Linux; `win-input-matrix` is Windows-only and asks the live input stacks
-    # what they can see. Neither belongs in `cargo build --workspace` or on a CI leg with no pad.
-    "tools/hid-descriptor-dump",
-    "tools/win-input-matrix",
 ]
 
 # ndk 0.9.0 verbatim from crates.io plus ONE visibility change (and two warning fixes — an
@@ -65,7 +57,7 @@ exclude = [
 ndk = { path = "clients/android/native/vendor/ndk" }
 
 [workspace.package]
-version = "0.27.0"
+version = "0.24.0"
 edition = "2021"
 rust-version = "1.82"
 license = "MIT OR Apache-2.0"

THIRD-PARTY-NOTICES.txt

@@ -83,7 +83,7 @@ MANIFEST (crate version — SPDX license — source)
   cast 0.3.0 — MIT OR Apache-2.0 — https://github.com/japaric/cast.rs
   cbc 0.1.2 — MIT OR Apache-2.0 — https://github.com/RustCrypto/block-modes
   cbindgen 0.29.4 — MPL-2.0 — https://github.com/mozilla/cbindgen
-  cc 1.4.1 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
+  cc 1.2.65 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
   cesu8 1.1.0 — Apache-2.0/MIT — https://github.com/emk/cesu8-rs
   cexpr 0.6.0 — Apache-2.0/MIT — https://github.com/jethrogb/rust-cexpr
   cfg-expr 0.20.8 — MIT OR Apache-2.0 — https://github.com/EmbarkStudios/cfg-expr
@@ -148,12 +148,12 @@ MANIFEST (crate version — SPDX license — source)
   fastbloom 0.14.1 — MIT OR Apache-2.0 — https://github.com/tomtomwombat/fastbloom/
   fastrand 2.4.1 — Apache-2.0 OR MIT — https://github.com/smol-rs/fastrand
   fdeflate 0.3.7 — MIT OR Apache-2.0 — https://github.com/image-rs/fdeflate
-  ffmpeg-next 9.0.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg
-  ffmpeg-sys-next 9.0.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg-sys
+  ffmpeg-next 8.1.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg
+  ffmpeg-sys-next 8.1.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg-sys
   fiat-crypto 0.2.9 — MIT OR Apache-2.0 OR BSD-1-Clause — https://github.com/mit-plv/fiat-crypto
   field-offset 0.3.6 — MIT OR Apache-2.0 — https://github.com/Diggsey/rust-field-offset
   filetime 0.2.29 — MIT/Apache-2.0 — https://github.com/alexcrichton/filetime
-  find-msvc-tools 0.1.10 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
+  find-msvc-tools 0.1.9 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
   fixedbitset 0.5.7 — MIT OR Apache-2.0 — https://github.com/petgraph/fixedbitset
   flate2 1.1.9 — MIT OR Apache-2.0 — https://github.com/rust-lang/flate2-rs
   flume 0.12.0 — Apache-2.0/MIT — https://github.com/zesterer/flume
@@ -628,7 +628,7 @@ Crates whose package did not embed a license file (SPDX + source only)
   atomig-macro 0.4.0 — MIT/Apache-2.0 — https://github.com/LukasKalbertodt/atomig/
   cookie-factory 0.3.3 — MIT — https://github.com/rust-bakery/cookie-factory
   defmt-parser 1.0.0 — MIT OR Apache-2.0 — https://github.com/knurling-rs/defmt
-  ffmpeg-sys-next 9.0.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg-sys
+  ffmpeg-sys-next 8.1.0 — WTFPL — https://github.com/zmwangx/rust-ffmpeg-sys
   jni-sys-macros 0.4.1 — MIT OR Apache-2.0 — https://github.com/jni-rs/jni-sys
   ndk 0.9.0 — MIT OR Apache-2.0 — https://github.com/rust-mobile/ndk
   ndk-sys 0.6.0+11769913 — MIT OR Apache-2.0 — https://github.com/rust-mobile/ndk
@@ -2266,7 +2266,7 @@ SOFTWARE.
 
 
 ----------------------------------------------------------------------------
-The following license (LICENSE-APACHE) applies to: asn1-rs 0.6.2, asn1-rs-derive 0.5.1, assert_matches 1.5.0, async-channel 2.5.0, async-executor 1.14.0, async-io 2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.1.1, async-signal 0.2.14, async-task 4.7.1, atomic-waker 1.1.2, autocfg 1.5.1, base64 0.22.1, bitflags 1.3.2, bitflags 2.13.0, blocking 1.6.2, bumpalo 3.20.3, cast 0.3.0, cc 1.4.1, cexpr 0.6.0, cfg-if 1.0.4, cmake 0.1.58, concurrent-queue 2.5.0, core-foundation 0.10.1, core-foundation-sys 0.8.7, criterion 0.5.1, criterion-plot 0.5.0, crossbeam-deque 0.8.6, crossbeam-epoch 0.9.20, crossbeam-utils 0.8.21, curve25519-dalek-derive 0.1.1, der-parser 9.0.0, displaydoc 0.2.6, either 1.16.0, equivalent 1.0.2, errno 0.3.14, event-listener 5.4.1, event-listener-strategy 0.5.4, fastrand 2.4.1, filetime 0.2.29, find-msvc-tools 0.1.10, fixedbitset 0.5.7, flate2 1.1.9, fnv 1.0.7, form_urlencoded 1.2.2, fs-err 3.3.0, futures-lite 2.6.1, gethostname 1.1.0, gif 0.14.2, glob 0.3.3, hashbrown 0.16.1, hashbrown 0.17.1, heck 0.5.0, hermit-abi 0.5.2, httparse 1.10.1, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.0, itertools 0.10.5, itertools 0.13.0, jni 0.21.1, jobserver 0.1.34, js-sys 0.3.103, khronos-egl 6.0.0, lazy_static 1.5.0, linux-raw-sys 0.12.1, lock_api 0.4.14, log 0.4.33, mime 0.3.17, nasm-rs 0.3.2, num-bigint 0.4.6, num-bigint-dig 0.8.6, num-derive 0.4.2, num-integer 0.1.46, num-iter 0.1.45, num-traits 0.2.19, num_cpus 1.17.0, oid-registry 0.7.1, once_cell 1.21.4, openssl-probe 0.2.1, opus 0.3.1, ordered-stream 0.2.0, parking 2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, pkg-config 0.3.33, png 0.18.1, polling 3.11.0, proptest 1.11.0, rayon 1.12.0, rayon-core 1.13.0, regex 1.12.4, regex-automata 0.4.14, regex-syntax 0.8.11, roxmltree 0.21.1, rsa 0.9.10, rustc_version 0.4.1, rusticata-macros 4.1.0, rustix 1.1.4, rustls 0.23.41, rustls-native-certs 0.8.4, rusty-fork 0.3.1, scopeguard 1.2.0, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, smallvec 1.15.2, socket2 0.6.4, stable_deref_trait 1.2.1, system-deps 7.0.8, tar 0.4.46, tempfile 3.27.0, thread_local 1.1.9, tinytemplate 1.2.1, unicode-segmentation 1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.23.4, vcpkg 0.2.15, version_check 0.9.5, wait-timeout 0.2.1, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126, weezl 0.1.12, wit-bindgen 0.57.1, x509-parser 0.16.0, xattr 1.6.1
+The following license (LICENSE-APACHE) applies to: asn1-rs 0.6.2, asn1-rs-derive 0.5.1, assert_matches 1.5.0, async-channel 2.5.0, async-executor 1.14.0, async-io 2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.1.1, async-signal 0.2.14, async-task 4.7.1, atomic-waker 1.1.2, autocfg 1.5.1, base64 0.22.1, bitflags 1.3.2, bitflags 2.13.0, blocking 1.6.2, bumpalo 3.20.3, cast 0.3.0, cc 1.2.65, cexpr 0.6.0, cfg-if 1.0.4, cmake 0.1.58, concurrent-queue 2.5.0, core-foundation 0.10.1, core-foundation-sys 0.8.7, criterion 0.5.1, criterion-plot 0.5.0, crossbeam-deque 0.8.6, crossbeam-epoch 0.9.20, crossbeam-utils 0.8.21, curve25519-dalek-derive 0.1.1, der-parser 9.0.0, displaydoc 0.2.6, either 1.16.0, equivalent 1.0.2, errno 0.3.14, event-listener 5.4.1, event-listener-strategy 0.5.4, fastrand 2.4.1, filetime 0.2.29, find-msvc-tools 0.1.9, fixedbitset 0.5.7, flate2 1.1.9, fnv 1.0.7, form_urlencoded 1.2.2, fs-err 3.3.0, futures-lite 2.6.1, gethostname 1.1.0, gif 0.14.2, glob 0.3.3, hashbrown 0.16.1, hashbrown 0.17.1, heck 0.5.0, hermit-abi 0.5.2, httparse 1.10.1, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.0, itertools 0.10.5, itertools 0.13.0, jni 0.21.1, jobserver 0.1.34, js-sys 0.3.103, khronos-egl 6.0.0, lazy_static 1.5.0, linux-raw-sys 0.12.1, lock_api 0.4.14, log 0.4.33, mime 0.3.17, nasm-rs 0.3.2, num-bigint 0.4.6, num-bigint-dig 0.8.6, num-derive 0.4.2, num-integer 0.1.46, num-iter 0.1.45, num-traits 0.2.19, num_cpus 1.17.0, oid-registry 0.7.1, once_cell 1.21.4, openssl-probe 0.2.1, opus 0.3.1, ordered-stream 0.2.0, parking 2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, pkg-config 0.3.33, png 0.18.1, polling 3.11.0, proptest 1.11.0, rayon 1.12.0, rayon-core 1.13.0, regex 1.12.4, regex-automata 0.4.14, regex-syntax 0.8.11, roxmltree 0.21.1, rsa 0.9.10, rustc_version 0.4.1, rusticata-macros 4.1.0, rustix 1.1.4, rustls 0.23.41, rustls-native-certs 0.8.4, rusty-fork 0.3.1, scopeguard 1.2.0, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, smallvec 1.15.2, socket2 0.6.4, stable_deref_trait 1.2.1, system-deps 7.0.8, tar 0.4.46, tempfile 3.27.0, thread_local 1.1.9, tinytemplate 1.2.1, unicode-segmentation 1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.23.4, vcpkg 0.2.15, version_check 0.9.5, wait-timeout 0.2.1, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126, weezl 0.1.12, wit-bindgen 0.57.1, x509-parser 0.16.0, xattr 1.6.1
 ----------------------------------------------------------------------------
 Apache License
                         Version 2.0, January 2004
@@ -4011,7 +4011,7 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 
 ----------------------------------------------------------------------------
-The following license (LICENSE-MIT) applies to: cc 1.4.1, cfg-if 1.0.4, cmake 0.1.58, filetime 0.2.29, find-msvc-tools 0.1.10, jobserver 0.1.34, js-sys 0.3.103, openssl-probe 0.2.1, pkg-config 0.3.33, socket2 0.6.4, wait-timeout 0.2.1, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126
+The following license (LICENSE-MIT) applies to: cc 1.2.65, cfg-if 1.0.4, cmake 0.1.58, filetime 0.2.29, find-msvc-tools 0.1.9, jobserver 0.1.34, js-sys 0.3.103, openssl-probe 0.2.1, pkg-config 0.3.33, socket2 0.6.4, wait-timeout 0.2.1, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126
 ----------------------------------------------------------------------------
 Copyright (c) 2014 Alex Crichton
 
@@ -6183,7 +6183,7 @@ DEALINGS IN THE SOFTWARE.
 
 
 ----------------------------------------------------------------------------
-The following license (LICENSE) applies to: ffmpeg-next 9.0.0
+The following license (LICENSE) applies to: ffmpeg-next 8.1.0
 ----------------------------------------------------------------------------
 DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
                     Version 2, December 2004

api/openapi.json

@@ -10,7 +10,7 @@
       "name": "MIT OR Apache-2.0",
       "identifier": "MIT OR Apache-2.0"
     },
-    "version": "0.25.0"
+    "version": "0.24.0"
   },
   "paths": {
     "/api/v1/clients": {
@@ -997,7 +997,7 @@
           "library"
         ],
         "summary": "List the game library",
-        "description": "Every installed-store title (Steam, read from the host's local files — no Steam API key)\nmerged with the user's custom entries, sorted by title. Artwork fields are URLs the client\nfetches directly (the public Steam CDN for Steam titles). `?provider=` narrows to the\nentries a given external provider owns; `?platform=` to one platform (case-insensitive —\ninstalled-store titles are `PC`, custom/provider entries carry whatever was authored).\n\n**The operator's own lane additionally sees the titles they have HIDDEN**, each carrying\n`hidden: true`; every other lane gets them filtered out upstream and cannot tell they exist. The\nconsole needs them to offer \"un-hide\", and it is the only surface that does.",
+        "description": "Every installed-store title (Steam, read from the host's local files — no Steam API key)\nmerged with the user's custom entries, sorted by title. Artwork fields are URLs the client\nfetches directly (the public Steam CDN for Steam titles). `?provider=` narrows to the\nentries a given external provider owns; `?platform=` to one platform (case-insensitive —\ninstalled-store titles are `PC`, custom/provider entries carry whatever was authored).",
         "operationId": "getLibrary",
         "parameters": [
           {
@@ -1021,13 +1021,13 @@
         ],
         "responses": {
           "200": {
-            "description": "Unified library across all stores (the operator's lane also gets hidden entries, flagged)",
+            "description": "Unified library across all stores",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "array",
                   "items": {
-                    "$ref": "#/components/schemas/OperatorGameEntry"
+                    "$ref": "#/components/schemas/GameEntry"
                   }
                 }
               }
@@ -1301,79 +1301,6 @@
         }
       }
     },
-    "/api/v1/library/hidden/{id}": {
-      "put": {
-        "tags": [
-          "library"
-        ],
-        "summary": "Hide or un-hide one library title",
-        "description": "Curation, not access control: a hidden title disappears from every play surface — the console\ngrid on a client, native clients, the GameStream app list, and launch resolution — while nothing\nis deleted and un-hiding restores it immediately. The operator's own console still lists it\n(flagged `hidden`) so it can be brought back.\n\nKeyed by the entry's stable `<store>:<external_id>` id, which survives re-scans and reconciles by\nconstruction (D2). The id is **not** validated against the current library on purpose: a title\ncan be legitimately absent at this moment (launcher closed, plugin mid-sync, drive unmounted),\nand refusing the operator's choice in that window would be worse than storing an id that\ncurrently matches nothing. Emits `library.changed` (source = the store) only on a real change.",
-        "operationId": "setLibraryEntryHidden",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "description": "The library entry id (e.g. `steam:70`)",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/HiddenToggle"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "Stored; the entry's visibility after the call",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HiddenState"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Empty entry id",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiError"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Missing or invalid bearer token",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiError"
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "Could not persist the settings",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiError"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/api/v1/library/provider/{provider}": {
       "put": {
         "tags": [
@@ -4118,51 +4045,6 @@
           }
         }
       },
-      "AudioWiring": {
-        "type": "object",
-        "description": "The Windows host's audio wiring verdict — which endpoint carries each role. The names are\nthe endpoints' friendly names as the Sound settings show them (on current hosts the minted\n\"Punktfunk\" instances of Steam's streaming drivers).",
-        "required": [
-          "readiness",
-          "mic_withheld",
-          "last_resort"
-        ],
-        "properties": {
-          "last_resort": {
-            "type": "boolean",
-            "description": "The loopback is the known-degraded last resort — desktop audio may be silent until the\nendpoint set changes."
-          },
-          "loopback": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Friendly name of the desktop-audio loopback source; absent = desktop audio unavailable."
-          },
-          "mic": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Friendly name of the virtual-mic write target; absent = mic passthrough unavailable."
-          },
-          "mic_withheld": {
-            "type": "boolean",
-            "description": "The mic was WITHHELD so game audio could keep the only working sink — mic passthrough\nneeds Steam installed (the host mints its own microphone) or a virtual cable."
-          },
-          "narrowing": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Why the chosen loopback endpoint NARROWS the desktop mix (rate/channels), when it does."
-          },
-          "readiness": {
-            "type": "string",
-            "description": "`full` | `audio_only` | `mic_only` | `none` — whether desktop audio and mic passthrough\neach have an endpoint at all.",
-            "example": "full"
-          }
-        }
-      },
       "AvailableCompositor": {
         "type": "object",
         "description": "A compositor backend the host can drive a virtual output on, and whether it's usable now.",
@@ -5626,37 +5508,6 @@
           }
         }
       },
-      "HiddenState": {
-        "type": "object",
-        "description": "What `setLibraryEntryHidden` echoes back.",
-        "required": [
-          "id",
-          "hidden"
-        ],
-        "properties": {
-          "hidden": {
-            "type": "boolean",
-            "description": "Its visibility after the call."
-          },
-          "id": {
-            "type": "string",
-            "description": "The entry id the call addressed."
-          }
-        }
-      },
-      "HiddenToggle": {
-        "type": "object",
-        "description": "Request body for `setLibraryEntryHidden`.",
-        "required": [
-          "hidden"
-        ],
-        "properties": {
-          "hidden": {
-            "type": "boolean",
-            "description": "Whether this title should be hidden from every play surface."
-          }
-        }
-      },
       "HookEntry": {
         "type": "object",
         "description": "One hook: fire `run` and/or `webhook` when an event matching `on` (+ `filter`) occurs.",
@@ -6443,23 +6294,6 @@
           }
         }
       },
-      "OperatorGameEntry": {
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/GameEntry"
-          },
-          {
-            "type": "object",
-            "properties": {
-              "hidden": {
-                "type": "boolean",
-                "description": "The operator hid this title ([`set_entry_hidden`]) — omitted when false, so the shape only\ngrows for entries that actually are hidden."
-              }
-            }
-          }
-        ],
-        "description": "A library entry plus the operator's own view of it — today, whether they hid it.\n\nA separate type rather than a field on [`GameEntry`] for two reasons. It keeps the visibility\nanswer out of the providers entirely: a store parser has no opinion on what the operator hid, and\nadding `hidden: false` to all eight construction sites would imply it does. More importantly it\nmakes the lane rule a TYPE guarantee instead of a discipline — `GET /library` answers\n`Vec<GameEntry>` on every lane but the operator's, so a hidden entry cannot leak to a paired\nclient by someone forgetting a filter; there is no field there to leak.\n\n`flatten` keeps the wire shape identical to a plain entry with one extra key, so the console\nparses one model either way."
-      },
       "PairedClient": {
         "type": "object",
         "description": "A paired (certificate-pinned) Moonlight client.",
@@ -6971,17 +6805,6 @@
             "description": "Number of live streaming sessions across BOTH planes (GameStream + native punktfunk/1). The\nnative server admits concurrent sessions, so this can exceed 1; `session`/`stream` below\ndescribe a single representative session for the detail card.",
             "minimum": 0
           },
-          "audio": {
-            "oneOf": [
-              {
-                "type": "null"
-              },
-              {
-                "$ref": "#/components/schemas/AudioWiring",
-                "description": "The audio wiring verdict (Windows hosts; absent on other platforms and before the first\nwiring pass). Present even while idle — the wiring exists for the host's lifetime."
-              }
-            ]
-          },
           "audio_streaming": {
             "type": "boolean",
             "description": "True while the audio stream thread is running."

ci/arch-ci.Dockerfile

@@ -9,26 +9,7 @@
 # from the last image rebuild instead of a fresh -Syu per run. That is the same staleness
 # the gamescope cache already embraces ("a stale binary against newer system libs is the
 # same risk the distro's own package carries between rebuilds"), and any ci/ edit — or
-# bumping the date in this line (refreshed: 2026-08-08) — re-keys and re-snapshots it.
-#
-# ⚠ That staleness has a sharp edge, and 2026-08-08 is why the date above moved: this snapshot is
-# what decides which FFmpeg the HOST links, and arch.yml deliberately runs no -Syu, so the builder
-# stayed frozen on ffmpeg 8 (libavcodec 62) even after Arch shipped 2:9.0-5 (libavcodec 63) to
-# every user. A canary built from the old snapshot therefore CANNOT satisfy the soname dep that
-# packaging/arch/PKGBUILD now derives from the link (libavcodec.so=62-64 against a box that has
-# 63-64), so it would simply refuse to install rather than start. Re-keying this image is the step
-# that makes the ffmpeg-9 bump actually reach the package — a Cargo.toml bump alone does nothing
-# here. Whenever Arch moves to an FFmpeg major, bump the date in the same commit.
-#
-# ⚠ AND KNOW WHY THAT WAS NOT ENOUGH: bumping this date only helps once docker.yml has actually
-# republished the image, and nothing sequences the two workflows. v0.25.0 was tagged four minutes
-# after the ffmpeg-9 merge, so the release build still pulled the FFmpeg-8 `:latest` and published
-# a punktfunk-host that no up-to-date Arch box could install — which blocks the user's ENTIRE
-# `pacman -Syu`, not just our package. arch.yml therefore no longer trusts this image on that one
-# axis: it compares the builder's libav sonames against the repos before building (and `-Syu`s
-# itself if they differ), and refuses to publish anything a pristine-db `pacman -U --print` says
-# is unsatisfiable. This file staying current is still the CHEAP path — those guards are the
-# backstop, not the plan.
+# bumping the date in this line (refreshed: 2026-07-29) — re-keys and re-snapshots it.
 FROM docker.io/library/archlinux:base-devel
 
 # One transaction: the main build/runtime deps (first list) + the gamescope companion's

ci/rust-ci-noble.Dockerfile

@@ -45,14 +45,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Sourced from the official FFmpeg GitHub mirror by release tag, NOT ffmpeg.org: the CI build network
 # can't reach ffmpeg.org (curl times out) but reaches github.com fine. The `nX.Y` tag pins the version
 # (n8.0 -> libavcodec 62); bump it to move FFmpeg. Immutable-tag clone, so no separate checksum needed.
-#
-# STAYING ON 8.0 THROUGH THE 2026-08-08 FFmpeg-9 BUMP IS DELIBERATE. `ffmpeg-next` moved to 9, but a
-# crate major is a CEILING (ffmpeg-sys-next 9 spans libavcodec 56..63), so an 8.0 tree still compiles
-# — and this .deb is the one package with NO exposure to the soname break that motivated the bump: it
-# BUNDLES these libs into /usr/lib/punktfunk-host behind an rpath and strips the libav* sonames from
-# its Depends, so nothing the user's apt does can move them underneath it. Bumping this tag would
-# re-qualify the encode stack for every Ubuntu user and buy none of them anything, so it is its own
-# change — and it drags NVHDR_TAG and the soname assertion below along with it.
 ARG FFMPEG_TAG=n8.0
 # nv-codec-headers must MATCH the FFmpeg version: its `master` is NVENC SDK 13, which renamed
 # NV_ENC_CLOCK_TIMESTAMP_SET.countingType -> countingTypeLSB and won't compile against FFmpeg 8.0's

ci/rust-ci.Dockerfile

@@ -13,9 +13,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
     # toolchain + bindgen; nodejs runs the JS actions (checkout/cache); unzip is for the bun installer
     build-essential clang libclang-dev pkg-config cmake git curl ca-certificates nodejs unzip \
-    # ffmpeg-next 9, built against whatever libav* 26.04 ships (FFmpeg 8 / libavcodec 62 today).
-    # The crate major is a CEILING — ffmpeg-sys-next 9 spans libavcodec 56..63 — so this image does
-    # not need to move in lockstep with Arch's FFmpeg 9; it just links what the distro has.
+    # ffmpeg-next 8 (system FFmpeg 8 / libavcodec 62 on 26.04)
     libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libavfilter-dev \
     libavdevice-dev \
     # capture / audio / display stacks (+xkbcommon for the wlr input backend)

clients/android/app/src/main/assets/THIRD-PARTY-NOTICES.txt

@@ -49,7 +49,7 @@ MANIFEST (crate version — SPDX license — source)
   bytes 1.12.0 — MIT — https://github.com/tokio-rs/bytes
   cast 0.3.0 — MIT OR Apache-2.0 — https://github.com/japaric/cast.rs
   cbindgen 0.29.4 — MPL-2.0 — https://github.com/mozilla/cbindgen
-  cc 1.4.1 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
+  cc 1.2.65 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
   cesu8 1.1.0 — Apache-2.0/MIT — https://github.com/emk/cesu8-rs
   cfg-if 1.0.4 — MIT OR Apache-2.0 — https://github.com/rust-lang/cfg-if
   cfg_aliases 0.2.1 — MIT — https://github.com/katharostech/cfg_aliases
@@ -88,7 +88,7 @@ MANIFEST (crate version — SPDX license — source)
   fastbloom 0.14.1 — MIT OR Apache-2.0 — https://github.com/tomtomwombat/fastbloom/
   fastrand 2.4.1 — Apache-2.0 OR MIT — https://github.com/smol-rs/fastrand
   fiat-crypto 0.2.9 — MIT OR Apache-2.0 OR BSD-1-Clause — https://github.com/mit-plv/fiat-crypto
-  find-msvc-tools 0.1.10 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
+  find-msvc-tools 0.1.9 — MIT OR Apache-2.0 — https://github.com/rust-lang/cc-rs
   fixedbitset 0.5.7 — MIT OR Apache-2.0 — https://github.com/petgraph/fixedbitset
   flume 0.12.0 — Apache-2.0/MIT — https://github.com/zesterer/flume
   fnv 1.0.7 — Apache-2.0 / MIT — https://github.com/servo/rust-fnv
@@ -1390,7 +1390,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 
 ----------------------------------------------------------------------------
-The following license (LICENSE-APACHE) applies to: autocfg 1.5.1, base64 0.22.1, bitflags 2.13.0, bumpalo 3.20.3, cast 0.3.0, cc 1.4.1, cfg-if 1.0.4, cmake 0.1.58, core-foundation 0.10.1, core-foundation-sys 0.8.7, criterion 0.5.1, criterion-plot 0.5.0, crossbeam-deque 0.8.6, crossbeam-epoch 0.9.20, crossbeam-utils 0.8.21, curve25519-dalek-derive 0.1.1, either 1.16.0, equivalent 1.0.2, errno 0.3.14, fastrand 2.4.1, find-msvc-tools 0.1.10, fixedbitset 0.5.7, fnv 1.0.7, hashbrown 0.17.1, heck 0.5.0, hermit-abi 0.5.2, indexmap 2.14.0, itertools 0.10.5, jni 0.21.1, jobserver 0.1.34, js-sys 0.3.103, linux-raw-sys 0.12.1, lock_api 0.4.14, log 0.4.33, num-traits 0.2.19, once_cell 1.21.4, openssl-probe 0.2.1, opus 0.3.1, parking_lot 0.12.5, parking_lot_core 0.9.12, pkg-config 0.3.33, proptest 1.11.0, rayon 1.12.0, rayon-core 1.13.0, regex 1.12.4, regex-automata 0.4.14, regex-syntax 0.8.11, rustc_version 0.4.1, rustix 1.1.4, rustls 0.23.41, rustls-native-certs 0.8.4, rusty-fork 0.3.1, scopeguard 1.2.0, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, smallvec 1.15.2, socket2 0.6.4, tempfile 3.27.0, tinytemplate 1.2.1, version_check 0.9.5, wait-timeout 0.2.1, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126, wit-bindgen 0.57.1
+The following license (LICENSE-APACHE) applies to: autocfg 1.5.1, base64 0.22.1, bitflags 2.13.0, bumpalo 3.20.3, cast 0.3.0, cc 1.2.65, cfg-if 1.0.4, cmake 0.1.58, core-foundation 0.10.1, core-foundation-sys 0.8.7, criterion 0.5.1, criterion-plot 0.5.0, crossbeam-deque 0.8.6, crossbeam-epoch 0.9.20, crossbeam-utils 0.8.21, curve25519-dalek-derive 0.1.1, either 1.16.0, equivalent 1.0.2, errno 0.3.14, fastrand 2.4.1, find-msvc-tools 0.1.9, fixedbitset 0.5.7, fnv 1.0.7, hashbrown 0.17.1, heck 0.5.0, hermit-abi 0.5.2, indexmap 2.14.0, itertools 0.10.5, jni 0.21.1, jobserver 0.1.34, js-sys 0.3.103, linux-raw-sys 0.12.1, lock_api 0.4.14, log 0.4.33, num-traits 0.2.19, once_cell 1.21.4, openssl-probe 0.2.1, opus 0.3.1, parking_lot 0.12.5, parking_lot_core 0.9.12, pkg-config 0.3.33, proptest 1.11.0, rayon 1.12.0, rayon-core 1.13.0, regex 1.12.4, regex-automata 0.4.14, regex-syntax 0.8.11, rustc_version 0.4.1, rustix 1.1.4, rustls 0.23.41, rustls-native-certs 0.8.4, rusty-fork 0.3.1, scopeguard 1.2.0, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, smallvec 1.15.2, socket2 0.6.4, tempfile 3.27.0, tinytemplate 1.2.1, version_check 0.9.5, wait-timeout 0.2.1, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126, wit-bindgen 0.57.1
 ----------------------------------------------------------------------------
 Apache License
                         Version 2.0, January 2004
@@ -2435,7 +2435,7 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 
 ----------------------------------------------------------------------------
-The following license (LICENSE-MIT) applies to: cc 1.4.1, cfg-if 1.0.4, cmake 0.1.58, find-msvc-tools 0.1.10, jobserver 0.1.34, js-sys 0.3.103, openssl-probe 0.2.1, pkg-config 0.3.33, socket2 0.6.4, wait-timeout 0.2.1, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126
+The following license (LICENSE-MIT) applies to: cc 1.2.65, cfg-if 1.0.4, cmake 0.1.58, find-msvc-tools 0.1.9, jobserver 0.1.34, js-sys 0.3.103, openssl-probe 0.2.1, pkg-config 0.3.33, socket2 0.6.4, wait-timeout 0.2.1, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126, wasm-bindgen-macro-support 0.2.126, wasm-bindgen-shared 0.2.126
 ----------------------------------------------------------------------------
 Copyright (c) 2014 Alex Crichton
 

clients/android/app/src/main/kotlin/io/unom/punktfunk/App.kt

@@ -69,14 +69,11 @@ fun App(forceGamepadUi: Boolean = false) {
     // later manual Back out of the library is not undone by a stale value.
     var reopenLibraryHostId by remember { mutableStateOf<String?>(null) }
 
-    // Console (gamepad) mode mirrors the Apple client: the setting AND (its mode says Always OR a
-    // pad is attached OR this is a TV OR the dev force flag). Flips live as controllers
-    // connect/disconnect — unless the mode is Always, where it simply stays.
+    // Console (gamepad) mode mirrors the Apple client: the setting AND (a pad is attached OR this is
+    // a TV OR the dev force flag). Flips live as controllers connect/disconnect.
     val tv = remember { isTvDevice(context) }
     val controllerConnected by rememberControllerConnected()
-    val gamepadUi = gamepadUiActive(
-        settings.gamepadUiEnabled, settings.gamepadUiMode, controllerConnected, tv, forceGamepadUi,
-    )
+    val gamepadUi = gamepadUiActive(settings.gamepadUiEnabled, controllerConnected, tv, forceGamepadUi)
 
     // Publish the live session process-wide, so a `punktfunk://` link that arrives as a SECOND
     // activity instance (the normal case under `launchMode = standard`) can refuse it before that

clients/android/app/src/main/kotlin/io/unom/punktfunk/GamepadPalette.kt

@@ -67,7 +67,7 @@ class GamepadPalette(
         )
 
         /**
-         * The thirteen shipped palettes: the brand default, six more dark fields, then six pale
+         * The twelve shipped palettes: the brand default, five more dark fields, then six pale
          * ones. Cycling order runs dark → light, so stepping the row walks the range one way.
          */
         val ALL = listOf(
@@ -77,26 +77,6 @@ class GamepadPalette(
                 ground = Triple(0.075, 0.060, 0.160),
                 accent = Triple(0.525, 0.471, 0.961), light = false,
             ),
-            GamepadPalette(
-                // For OLED and AMOLED panels, where a black pixel is a pixel switched off — no
-                // glow, no power. The first two stops are literally (0,0,0), so the shaded half
-                // of the field is genuinely off rather than "very dark grey", and the ground is
-                // pure black too: the calm mix on the form screens lifts toward nothing. What is
-                // left is a faint indigo→violet ember in the bright corner. The accent stays the
-                // brand violet — focus has to be findable on black.
-                // Named for the look, not the panel technology — black with a thin violet corona
-                // belongs beside Nebula and Abyss. ⚠ The ID stays "oled": it is the stored
-                // `ui_palette` value and the cross-client key, so renaming it would orphan saved
-                // choices and desync the clients.
-                "oled", "Eclipse",
-                listOf(
-                    Triple(0.000, 0.000, 0.000), Triple(0.000, 0.000, 0.000),
-                    Triple(0.010, 0.020, 0.100), Triple(0.045, 0.016, 0.115),
-                    Triple(0.120, 0.024, 0.130),
-                ),
-                ground = Triple(0.0, 0.0, 0.0),
-                accent = Triple(0.525, 0.471, 0.961), light = false,
-            ),
             GamepadPalette(
                 // Deep indigo climbing through violet into a hot magenta.
                 "nebula", "Nebula",

clients/android/app/src/main/kotlin/io/unom/punktfunk/GamepadSettingsScreen.kt

@@ -57,7 +57,6 @@ import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import dev.chrisbanes.haze.HazeState
 import dev.chrisbanes.haze.hazeSource
-import io.unom.punktfunk.kit.DeviceGyro
 import io.unom.punktfunk.kit.deviceBodyVibrator
 import io.unom.punktfunk.kit.security.KnownHost
 import io.unom.punktfunk.kit.security.KnownHostStore
@@ -127,8 +126,6 @@ fun GamepadSettingsScreen(
     val context = LocalContext.current
     // Gates the "Rumble on this phone" row — a TV box has no body vibrator to mirror onto.
     val hasBodyVibrator = remember { deviceBodyVibrator(context) != null }
-    // Gates "Gyro from this phone" the same way — a TV box has no gyroscope to mirror from.
-    val hasGyroscope = remember { DeviceGyro.available(context) }
     // Gates the AV1 codec row the same way the touch settings do (see `codecOptionsFor`).
     val av1Capable = remember { io.unom.punktfunk.kit.VideoDecoders.pickDecoder("video/av01") != null }
 
@@ -162,7 +159,7 @@ fun GamepadSettingsScreen(
     // path there is this screen's own Controller-optimized UI toggle, which swaps in the standard
     // interface remote-navigably. The strings branch on it.
     val tv = remember { isTvDevice(context) }
-    val allRows = buildSettingsRows(s, hasBodyVibrator, hasGyroscope, av1Capable, ::update) +
+    val allRows = buildSettingsRows(s, hasBodyVibrator, av1Capable, ::update) +
         buildProfileRows(profiles, savedHosts, tv) { pinProfile = it }
     // Which section is showing, and where each one's focus was when it was last left — a detour
     // into another tab shouldn't lose your place.
@@ -448,13 +445,12 @@ private fun SettingRowView(row: GpRow, focused: Boolean, adjustDir: Int, onClick
 }
 
 /** Build the console settings rows from the current [Settings], writing through [update].
- * [hasBodyVibrator] gates the "Rumble on this phone" row and [hasGyroscope] the "Gyro from this
- * phone" row (both absent on TVs); [av1Capable] gates the AV1 codec entry (see
- * `codecOptionsFor`). Every row declares its [GpTab]; the screen shows one tab at a time. */
+ * [hasBodyVibrator] gates the "Rumble on this phone" row (absent on TVs); [av1Capable] gates the
+ * AV1 codec entry (see `codecOptionsFor`). Every row declares its [GpTab]; the screen shows one
+ * tab at a time. */
 internal fun buildSettingsRows(
     s: Settings,
     hasBodyVibrator: Boolean,
-    hasGyroscope: Boolean,
     av1Capable: Boolean,
     update: (Settings) -> Unit,
 ): List<GpRow> {
@@ -602,18 +598,6 @@ internal fun buildSettingsRows(
         } else {
             null
         },
-        // The rumble mirror's sibling, data flowing the other way — needs a gyroscope to
-        // mirror FROM, which a TV box lacks.
-        if (hasGyroscope) {
-            toggle(
-                "phoneGyro", GpTab.CONTROLLER, null, "Gyro from this phone",
-                "When the controller has no gyro of its own, send this phone's motion " +
-                    "sensors as controller 1's — for clip-on pads without one.",
-                s.gyroOnPhone,
-            ) { update(s.copy(gyroOnPhone = it)) }
-        } else {
-            null
-        },
     ) + listOf(
         // NOT gated on the vibrator (the bug A2 fixed in the touch settings): an SC2 capture has
         // nothing to do with this device's motor, and a TV box is where it matters most.
@@ -665,21 +649,6 @@ internal fun buildSettingsRows(
             "Turn off to use the touch interface even with a controller connected.",
             s.gamepadUiEnabled,
         ) { update(s.copy(gamepadUiEnabled = it)) },
-    ) + listOfNotNull(
-        // WHEN the switch above takes over. Built only while it is ON: turn the switch off from
-        // this very screen and the row under the cursor would otherwise be one deciding nothing,
-        // on a screen that is itself about to disappear.
-        if (s.gamepadUiEnabled) {
-            choice(
-                "gamepadUIMode", GpTab.INTERFACE, null, "Show it",
-                "With a controller: the touch interface comes back when the last one " +
-                    "disconnects. Always keeps this layout either way — for a device that lives " +
-                    "docked to a TV. A TV itself is always in this mode regardless.",
-                GAMEPAD_UI_MODE_OPTIONS, s.gamepadUiMode,
-            ) { update(s.copy(gamepadUiMode = it)) }
-        } else {
-            null
-        },
     )
 }
 

clients/android/app/src/main/kotlin/io/unom/punktfunk/GamepadUi.kt

@@ -16,35 +16,15 @@ import androidx.compose.runtime.remember
 import androidx.compose.ui.platform.LocalContext
 import io.unom.punktfunk.kit.Gamepad
 
-/**
- * [Settings.gamepadUiMode]: take over only while a controller is attached. The default, and what
- * the switch meant when it was a lone Boolean.
- */
-const val GAMEPAD_UI_WHEN_CONNECTED = "connected"
-
-/**
- * [Settings.gamepadUiMode]: take over whenever the switch is on, pad or no pad — for a phone or
- * tablet that lives docked to a TV, where the console layout is the one wanted and the pad is not
- * always awake.
- */
-const val GAMEPAD_UI_ALWAYS = "always"
-
 /**
  * Whether the controller-optimized "console" home (the host carousel + gamepad chrome) should
  * replace the touch UI — the Android mirror of the Apple client's `GamepadUIEnvironment.isActive`:
- * the user's [enabled] setting AND (the [mode] is [GAMEPAD_UI_ALWAYS] OR a controller is attached
- * OR this is a TV OR the dev [forced] flag). A TV counts unconditionally — its remote/gamepad is
- * the only input, so it's always the console UI (as long as the setting is on), which is why the
- * mode row means nothing there. An unrecognized [mode] waits for a controller, so a value a newer
- * client wrote can never strand this one in a layout it has no way back out of.
+ * the user's [enabled] setting AND (a controller is attached OR this is a TV OR the dev [forced]
+ * flag). A TV counts unconditionally — its remote/gamepad is the only input, so it's always the
+ * console UI (as long as the setting is on).
  */
-fun gamepadUiActive(
-    enabled: Boolean,
-    mode: String,
-    controllerConnected: Boolean,
-    tv: Boolean,
-    forced: Boolean,
-): Boolean = enabled && (mode == GAMEPAD_UI_ALWAYS || controllerConnected || tv || forced)
+fun gamepadUiActive(enabled: Boolean, controllerConnected: Boolean, tv: Boolean, forced: Boolean): Boolean =
+    enabled && (controllerConnected || tv || forced)
 
 /** True on a TV: the leanback/television feature or the TELEVISION ui-mode. */
 fun isTvDevice(context: Context): Boolean {

clients/android/app/src/main/kotlin/io/unom/punktfunk/Settings.kt

@@ -94,20 +94,11 @@ data class Settings(
     val touchMode: TouchMode = TouchMode.TRACKPAD,
     /**
      * Swap the whole home screen for the controller-optimized "console" UI (the host carousel +
-     * gamepad chrome) — mirrors the Apple client's `gamepadUIEnabled`. On by default; turn it off
-     * to keep the touch UI even with a pad attached. WHEN it takes over is [gamepadUiMode].
+     * gamepad chrome) whenever a controller is connected — mirrors the Apple client's
+     * `gamepadUIEnabled`. On by default; turn it off to keep the touch UI even with a pad attached.
      * A TV (leanback) is always in this mode regardless (its remote/pad is the only input).
      */
     val gamepadUiEnabled: Boolean = true,
-    /**
-     * When [gamepadUiEnabled] actually takes over — the cross-client `gamepad_ui_mode` pair,
-     * mirroring the Apple client's `gamepadUIMode`: `"connected"` (default, and what the switch
-     * has always meant) waits for a controller; `"always"` keeps the console UI with no pad in
-     * reach, for a phone or tablet that lives docked to a TV. Read only while [gamepadUiEnabled]
-     * is on, which is why both settings screens hide the row when the switch is off. Anything
-     * unrecognized resolves to `"connected"`. A TV ignores it — it is always in console mode.
-     */
-    val gamepadUiMode: String = GAMEPAD_UI_WHEN_CONNECTED,
     /**
      * Show the experimental game-library browser (the coverflow reached with Y from a saved host).
      * Fetched from the host's management API over mTLS; needs a paired host. Mirrors the Apple
@@ -116,10 +107,9 @@ data class Settings(
     val libraryEnabled: Boolean = true,
     /**
      * Which colour family the console (gamepad) UI's living backdrop drifts through — the
-     * cross-client `ui_palette` key: `"violet"` (the brand default), then `"oled"`, `"nebula"`,
-     * `"abyss"`, `"ember"`, `"moss"`, `"graphite"`, then the six pale fields. See
-     * [GamepadPalette], whose table and maths mirror the desktop console's and the Apple
-     * client's under the same names. Presentation only: nothing
+     * cross-client `ui_palette` key: `"violet"` (the brand default), `"tide"`, `"forest"`,
+     * `"ember"`, `"rose"`, `"graphite"`. See [GamepadPalette], whose table and maths mirror the
+     * desktop console's and the Apple client's under the same names. Presentation only: nothing
      * about a stream depends on it, so it is a device preference and never part of a profile.
      * An unknown value reads as the default rather than failing — a newer client may have shipped
      * a palette this build doesn't know.
@@ -168,16 +158,6 @@ data class Settings(
      * toggle is hidden on devices without a vibrator (TVs), where this would be a silent no-op.
      */
     val rumbleOnPhone: Boolean = false,
-    /**
-     * Opt-in: use this phone's own gyroscope as controller 1's motion when the forwarded pad has
-     * none of its own — for clip-on gamepads without an IMU, where the phone body moves with the
-     * player's hands. The rumble mirror's sibling, data flowing the other way. Off by default;
-     * read once per session by StreamScreen (it starts a [io.unom.punktfunk.kit.DeviceGyro] only
-     * when set), and the mirror stands down by itself whenever wire pad 0 is fed by a capture
-     * link (USB DualSense / SC2 — pads with a real gyro). The toggle is hidden on devices
-     * without a gyroscope (TVs), where this would be a silent no-op.
-     */
-    val gyroOnPhone: Boolean = false,
 
     /**
      * Capture a Steam Controller 2 (wired / Puck dongle over USB, or an already-paired BLE pad)
@@ -313,8 +293,6 @@ class SettingsStore(context: Context) {
             // Migration: the pre-enum Boolean "trackpad_mode" (true = trackpad, false = direct).
             ?: if (prefs.getBoolean(K_TRACKPAD, true)) TouchMode.TRACKPAD else TouchMode.POINTER,
         gamepadUiEnabled = prefs.getBoolean(K_GAMEPAD_UI, true),
-        gamepadUiMode = prefs.getString(K_GAMEPAD_UI_MODE, GAMEPAD_UI_WHEN_CONNECTED)
-            ?: GAMEPAD_UI_WHEN_CONNECTED,
         libraryEnabled = prefs.getBoolean(K_LIBRARY, true),
         uiPalette = prefs.getString(K_UI_PALETTE, "violet") ?: "violet",
         lowLatencyMode = prefs.getBoolean(K_LOW_LATENCY, true),
@@ -322,7 +300,6 @@ class SettingsStore(context: Context) {
         smoothBuffer = prefs.getInt(K_SMOOTH_BUFFER, 0),
         autoWakeEnabled = prefs.getBoolean(K_AUTO_WAKE, true),
         rumbleOnPhone = prefs.getBoolean(K_RUMBLE_ON_PHONE, false),
-        gyroOnPhone = prefs.getBoolean(K_GYRO_ON_PHONE, false),
         sc2Capture = prefs.getBoolean(K_SC2_CAPTURE, true),
         dsCapture = prefs.getBoolean(K_DS_CAPTURE, true),
         padHaptics = prefs.getBoolean(K_PAD_HAPTICS, true),
@@ -356,7 +333,6 @@ class SettingsStore(context: Context) {
             .putString(K_STATS_VERBOSITY, s.statsVerbosity.name)
             .putString(K_TOUCH_MODE, s.touchMode.name)
             .putBoolean(K_GAMEPAD_UI, s.gamepadUiEnabled)
-            .putString(K_GAMEPAD_UI_MODE, s.gamepadUiMode)
             .putBoolean(K_LIBRARY, s.libraryEnabled)
             .putString(K_UI_PALETTE, s.uiPalette)
             .putBoolean(K_LOW_LATENCY, s.lowLatencyMode)
@@ -364,7 +340,6 @@ class SettingsStore(context: Context) {
             .putInt(K_SMOOTH_BUFFER, s.smoothBuffer)
             .putBoolean(K_AUTO_WAKE, s.autoWakeEnabled)
             .putBoolean(K_RUMBLE_ON_PHONE, s.rumbleOnPhone)
-            .putBoolean(K_GYRO_ON_PHONE, s.gyroOnPhone)
             .putBoolean(K_SC2_CAPTURE, s.sc2Capture)
             .putBoolean(K_DS_CAPTURE, s.dsCapture)
             .putBoolean(K_PAD_HAPTICS, s.padHaptics)
@@ -397,7 +372,6 @@ class SettingsStore(context: Context) {
         const val K_HUD = "stats_hud_enabled"
         const val K_TOUCH_MODE = "touch_mode"
         const val K_GAMEPAD_UI = "gamepad_ui_enabled"
-        const val K_GAMEPAD_UI_MODE = "gamepad_ui_mode"
         const val K_LIBRARY = "library_enabled"
         const val K_UI_PALETTE = "ui_palette"
 
@@ -416,7 +390,6 @@ class SettingsStore(context: Context) {
         const val K_SMOOTH_BUFFER = "smooth_buffer"
         const val K_AUTO_WAKE = "auto_wake_enabled"
         const val K_RUMBLE_ON_PHONE = "rumble_on_phone"
-        const val K_GYRO_ON_PHONE = "gyro_on_phone"
         const val K_SC2_CAPTURE = "sc2_capture"
         const val K_DS_CAPTURE = "ds_capture"
         const val K_PAD_HAPTICS = "pad_haptics"
@@ -792,13 +765,6 @@ fun smoothBufferOptions(hz: Int): List<Pair<Int, String>> {
     )
 }
 
-/** (stored value, label) for when the console UI takes over — the Apple client's table verbatim.
- * Only offered while [Settings.gamepadUiEnabled] is on; a TV is in console mode either way. */
-val GAMEPAD_UI_MODE_OPTIONS = listOf(
-    GAMEPAD_UI_WHEN_CONNECTED to "With a controller",
-    GAMEPAD_UI_ALWAYS to "Always",
-)
-
 /** (mode, label) for the touch-input model. */
 val TOUCH_MODE_OPTIONS = listOf(
     TouchMode.TRACKPAD to "Trackpad",

clients/android/app/src/main/kotlin/io/unom/punktfunk/SettingsScreen.kt

@@ -77,7 +77,6 @@ import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import androidx.core.content.ContextCompat
-import io.unom.punktfunk.kit.DeviceGyro
 import io.unom.punktfunk.kit.VideoDecoders
 import io.unom.punktfunk.kit.deviceBodyVibrator
 import io.unom.punktfunk.kit.security.KnownHostStore
@@ -592,24 +591,11 @@ private fun GeneralSettings(s: Settings, update: (Settings) -> Unit) {
         SettingsGroup("Interface") {
             ToggleRow(
                 title = "Controller-optimized UI",
-                subtitle = "Swap the touch home for the console home — the host carousel and " +
-                    "gamepad chrome. A TV always uses it.",
+                subtitle = "Switch to the console home when a controller is connected. A TV " +
+                    "always uses it.",
                 checked = s.gamepadUiEnabled,
                 onCheckedChange = { on -> update(s.copy(gamepadUiEnabled = on)) },
             )
-            // Only decides anything while the switch above is on, so it is HIDDEN rather than
-            // dimmed when it isn't — a picker whose every option changes nothing is worse than
-            // no picker, and this group is short enough that nothing jumps far.
-            if (s.gamepadUiEnabled) {
-                SettingDropdown(
-                    label = "Show it",
-                    options = GAMEPAD_UI_MODE_OPTIONS,
-                    selected = s.gamepadUiMode,
-                    caption = "With a controller: the touch home comes back when the last one " +
-                        "disconnects. Always keeps the console home either way — for a device " +
-                        "that lives docked to a TV.",
-                ) { v -> update(s.copy(gamepadUiMode = v)) }
-            }
         }
     }
 }
@@ -863,8 +849,7 @@ private fun ControllerSettings(s: Settings, update: (Settings) -> Unit, onOpenCo
             field = "gamepad",
             enabled = s.gamepadForwarding,
             caption = "The virtual pad the host creates. Automatic matches your controller; " +
-                "every connected one is forwarded as its own player. An X-Box type has no " +
-                "gyroscope, so pick a DualSense-class one if you want motion.",
+                "every connected one is forwarded as its own player.",
         ) { g -> update(s.copy(gamepad = g)) }
         SettingDropdown(
             label = "Guide button",
@@ -903,18 +888,6 @@ private fun ControllerSettings(s: Settings, update: (Settings) -> Unit, onOpenCo
                     onCheckedChange = { on -> update(s.copy(rumbleOnPhone = on)) },
                 )
             }
-            // The rumble mirror's sibling, data flowing the other way: needs a gyroscope to
-            // mirror FROM — a TV box has none, so the row would be a silent no-op there.
-            val hasGyroscope = remember { DeviceGyro.available(context) }
-            if (hasGyroscope) {
-                ToggleRow(
-                    title = "Gyro from this phone",
-                    subtitle = "When the controller has no gyro, send this phone's motion " +
-                        "sensors as controller 1's",
-                    checked = s.gyroOnPhone,
-                    onCheckedChange = { on -> update(s.copy(gyroOnPhone = on)) },
-                )
-            }
             // NOT gated on the vibrator: SC2 passthrough is a USB/BLE capture that has nothing to do
             // with rumbling this device's body, and the gate hid the toggle on exactly the machines
             // that most want it — TV boxes, where a Steam Controller 2 is the whole input story.

clients/android/app/src/main/kotlin/io/unom/punktfunk/StatsOverlay.kt

@@ -18,13 +18,12 @@ import kotlin.math.roundToInt
  * The live stats overlay — the unified HUD (`design/stats-unification.md`): headline is
  * `capture→displayed` tiled by `host+network` + `decode` + `display` when the platform delivered
  * OnFrameRendered render callbacks this window (`dispValid`), falling back to the v1
- * `capture→decoded` headline without the `display` term when it didn't. Reads the 35-double
+ * `capture→decoded` headline without the `display` term when it didn't. Reads the 33-double
  * layout from [NativeBridge.nativeVideoStats] (that KDoc is the authoritative index list):
  * `[fps, mbps, e2eP50Ms, e2eP95Ms, latValid, skew, w, h, hz, lostTotal, bitDepth, colorPrimaries,
  * colorTransfer, chromaFormatIdc, hostNetP50Ms, decodeP50Ms, hostP50Ms, netP50Ms, lost, skipped,
  * fec, frames, dispValid, displayP50Ms, e2eDispP50Ms, e2eDispP95Ms, paceP50Ms, latchP50Ms,
- * presentsWindow, presenterActive, feedP50Ms, codecP50Ms, skippedOverflowWindow, audioBufferMs,
- * audioAvOffsetMs]`. Every read
+ * presentsWindow, presenterActive, feedP50Ms, codecP50Ms, skippedOverflowWindow]`. Every read
  * is length-guarded, so an older native lib simply omits the lines it can't feed.
  *
  * The shown `display` and `end-to-end` numbers EXCLUDE the OS present floor (see [osFloorMs]) at
@@ -45,7 +44,7 @@ import kotlin.math.roundToInt
  *   reliability counters (18–21) when nonzero.
  * - [StatsVerbosity.DETAILED] — also the decoder label, the video-feed descriptor (10–13), the
  *   stage equation (14/15, split into `host + network` when the Phase-2 terms at 16/17 are nonzero),
- *   the excluded-floor line when one was measured, and the audio plane's own latency (33/34).
+ *   and the excluded-floor line when one was measured.
  * [StatsVerbosity.OFF] renders nothing. Older native layouts simply omit the lines they lack (the
  * counter line falls back to the cumulative `lostTotal` at index 9 on a pre-window lib).
  */
@@ -179,42 +178,10 @@ internal fun StatsOverlay(
                 }
             }
         }
-        if (detailed) {
-            audioLine(s)?.let { statLine(it, Color.White) }
-        }
         counterLine(s, lost)?.let { statLine(it, Color(0xFFFFB0B0)) }
     }
 }
 
-/**
- * The audio plane's own latency from the live gauges at 33/34 — `audio buffer 42 ms · a/v +18 ms`,
- * the same wording the desktop HUD uses. `buffer` is how much decoded audio is queued ahead of the
- * speaker; `a/v` is where that PUTS it relative to the picture (positive = audio behind). `null`
- * before any audio has been queued (buffer 0 — audio off, or the ring not yet primed) and on an
- * older native layout.
- *
- * Both terms, not just the depth: a deep ring on a jittery link is correct behaviour — the
- * underrun-driven floor earned that buffer — and only the offset distinguishes it from a ring that
- * is simply holding audio late. The offset term is dropped at zero, which is both "aligned" and
- * "no measurement yet"; the depth alone is still the triage number, and it is the one that did not
- * exist at all before (the plane published nothing any surface could render, so a "the audio delay
- * is way too high" report had no instrument behind it).
- *
- * NOT shaved by [osFloorMs], unlike every video figure above. That shave is a reporting policy —
- * metrics report what Punktfunk controls — but sound has to reach the ear when the light reaches
- * the eye, so the sync loop aligns against the RAW capture→displayed time (see the native
- * `DisplayTracker`) and this offset is stated in those same terms. Subtracting the floor here would
- * report an alignment the listener is not getting.
- */
-private fun audioLine(s: DoubleArray): String? {
-    if (s.size < 35) return null
-    val bufferMs = s[33].roundToInt()
-    if (bufferMs <= 0) return null
-    val avOffset = s[34].roundToInt()
-    val avTerm = if (avOffset != 0) " · a/v ${if (avOffset > 0) "+" else ""}$avOffset ms" else ""
-    return "audio buffer $bufferMs ms$avTerm"
-}
-
 /** One monospace HUD line — the shared type ramp so every tier's rows line up. */
 @Composable
 private fun statLine(text: String, color: Color) {

clients/android/app/src/main/kotlin/io/unom/punktfunk/StreamScreen.kt

@@ -67,13 +67,11 @@ import androidx.core.view.WindowInsetsControllerCompat
 import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.LifecycleEventObserver
 import androidx.lifecycle.LifecycleOwner
-import io.unom.punktfunk.kit.DeviceGyro
 import io.unom.punktfunk.kit.DsCapture
 import io.unom.punktfunk.kit.GamepadFeedback
 import io.unom.punktfunk.kit.GamepadRouter
 import io.unom.punktfunk.kit.deviceBodyVibrator
 import io.unom.punktfunk.kit.NativeBridge
-import io.unom.punktfunk.kit.PadSensors
 import io.unom.punktfunk.kit.Sc2Capture
 import io.unom.punktfunk.kit.SessionEndReason
 import io.unom.punktfunk.kit.VideoDecoders
@@ -139,19 +137,6 @@ fun StreamScreen(session: ActiveSession, onSessionEnded: (SessionEndReason) -> U
             micHint = null
         }
     }
-    // A captured pad has a gyro this session's virtual controller cannot carry (see
-    // GamepadRouter.onMotionUnreachable). Shown briefly, then gone: the failure is otherwise
-    // completely silent — the gyro simply does nothing, which from the couch is indistinguishable
-    // from a broken sensor — and the fix is a setting, so the notice has to name it.
-    var motionHint by remember { mutableStateOf(false) }
-    LaunchedEffect(motionHint) {
-        if (motionHint) {
-            // Longer than the mic chord's 1.6 s: that one confirms something the user just did,
-            // this one explains something they did not, in a sentence they have to read.
-            delay(6000)
-            motionHint = false
-        }
-    }
     // The one place mute is toggled — Compose state + the native flag, always together.
     val setMicMuted = { muted: Boolean ->
         micMuted = muted
@@ -374,9 +359,6 @@ fun StreamScreen(session: ActiveSession, onSessionEnded: (SessionEndReason) -> U
         // Select + Y toggles the mic — the couch reach for the on-screen mute button, which a
         // gamepad/TV user has no pointer for. Ignored when no capture is running (there is nothing
         // to mute, and claiming otherwise would be the lie the control exists to avoid).
-        // A captured Sony pad whose motion this session cannot carry. Fires once per pad, at the
-        // moment it is claimed, on the main thread.
-        router.onMotionUnreachable = { motionHint = true }
         router.onMicChord = {
             if (micRunning) {
                 val next = !micMuted
@@ -473,39 +455,9 @@ fun StreamScreen(session: ActiveSession, onSessionEnded: (SessionEndReason) -> U
             router,
             deviceVibrator = if (initialSettings.rumbleOnPhone) deviceBodyVibrator(context) else null,
         ).also { it.start() }
-        // "Gyro from this phone" (opt-in): this device's IMU speaks for controller 1's motion
-        // while wire pad 0 is a controller without a gyro of its own — the rumble mirror's
-        // sibling, data flowing the other way. The mirror gates itself per sample (it stands
-        // down whenever pad 0's controller has motion of its own — a capture link below, or a
-        // pad whose own sensors PadSensors is reading), so it composes without coordination here.
-        val phoneGyro = if (initialSettings.gyroOnPhone && initialSettings.gamepadForwarding) {
-            DeviceGyro(context, handle, router).also { it.start() }
-        } else {
-            null
-        }
-        // A Bluetooth controller's OWN gyro, through the platform sensor framework (API 31+):
-        // a BT DualSense / DS4 / Switch Pro / 8BitDo is an ordinary InputDevice, so none of the
-        // capture links below ever sees it and its motion used to go nowhere at all. No separate
-        // setting — this is the pad's own IMU doing what the pad is for, and unlike the USB
-        // captures it claims nothing; forwarding being off is the only thing that silences it.
-        val padSensors = if (initialSettings.gamepadForwarding) {
-            PadSensors(router).also { it.start() }
-        } else {
-            null
-        }
         // Free a disconnected controller's rumble/lights bindings promptly (else the open lights
-        // session leaks until the session ends), and take its sensor listeners off with it — the
-        // same callback also fires when a USB capture below CLAIMS the pad, which is what keeps
-        // the claimed pad from being fed motion twice. The router owns hot-plug; the feedback owns
-        // the binds. Assigned before the captures are constructed, so their claims land on it.
-        router.onSlotClosed = { deviceId ->
-            feedback.onDeviceRemoved(deviceId)
-            padSensors?.onSlotClosed(deviceId)
-        }
-        // The other edge: a controller that arrives (or first speaks) mid-session gets its sensors
-        // read too. The pads already connected were swept by PadSensors.start() above — both run
-        // on the main thread with nothing between them, so no controller falls through the gap.
-        router.onSlotOpened = { deviceId -> padSensors?.onSlotOpened(deviceId) }
+        // session leaks until the session ends). The router owns hot-plug; the feedback owns the binds.
+        router.onSlotClosed = feedback::onDeviceRemoved
         // Steam Controller 2 as-is passthrough (opt-out): capture a wired/Puck USB pad — or an
         // already-paired BLE one — and forward its raw reports; the host mirrors a real
         // 28DE:1302 that its Steam drives directly, and Steam's rumble/settings writes come back
@@ -635,17 +587,12 @@ fun StreamScreen(session: ActiveSession, onSessionEnded: (SessionEndReason) -> U
             feedback.onHidRaw = null
             feedback.sink = null
             feedback.stop() // stop + join the poll threads BEFORE the router is released / handle freed
-            phoneGyro?.stop() // join the sensor thread + park pad 0's rotation at zero, same ordering rule
-            // After the mirror, so it cannot resume writing pad 0 in the gap when a pad's own
-            // sensors let go of it; before the router is released, so the parks still find slots.
-            padSensors?.stop()
             sc2UsbReceiver?.let { runCatching { context.unregisterReceiver(it) } }
             sc2?.stop() // release the USB/BLE link + free the wire slot (host tears the pad down)
             dsUsbReceiver?.let { runCatching { context.unregisterReceiver(it) } }
             ds?.stop() // rumble-stop on the physical pad + release the USB link + free the wire slot
             router.onExitArmed = null // don't poke Compose state from release()'s disarm while tearing down
             router.onMicChord = null // same: no mute toggle on buttons released during teardown
-            router.onMotionUnreachable = null // same: no notice raised by a slot closing at teardown
             router.release() // flush every slot (nothing sticks host-side) + drop the hot-plug listener
             activity?.gamepadRouter = null
             // Mouse/remote-pointer teardown: lift held buttons, drop the grab, restore the cursor.
@@ -906,11 +853,6 @@ fun StreamScreen(session: ActiveSession, onSessionEnded: (SessionEndReason) -> U
         }
         // Chord confirmation (gamepad/TV) — the counterpart to the button changing under a finger.
         micHint?.let { MicChordHint(it, Modifier.align(Alignment.TopCenter).padding(top = 16.dp)) }
-        // Bottom, not top: this can coincide with a mic-chord confirmation or the exit cue, and a
-        // notice landing on top of one of those would cost the user both.
-        if (motionHint) {
-            MotionUnreachableHint(Modifier.align(Alignment.BottomCenter).padding(bottom = 24.dp))
-        }
     }
 }
 
@@ -997,28 +939,6 @@ private fun MicChordHint(text: String, modifier: Modifier = Modifier) {
     )
 }
 
-/**
- * "This pad's gyro can't reach the game" — shown briefly when a captured controller with motion
- * meets a session whose virtual pad has no motion plane (the X-Box classes have no gyro in their
- * HID contract, so every sample would be decoded and dropped host-side).
- *
- * It names the setting because that is the whole point: without it the player has a gyro that
- * silently does nothing and no way to tell that from a broken sensor. Not a control — the setting
- * applies from the next session, so offering to change it here would promise something this stream
- * cannot deliver. [GamepadRouter.onMotionUnreachable] raises it.
- */
-@Composable
-private fun MotionUnreachableHint(modifier: Modifier = Modifier) {
-    Text(
-        "Motion won't reach this session — set Controller type to DualSense",
-        modifier = modifier
-            .background(Color.Black.copy(alpha = 0.55f), RoundedCornerShape(8.dp))
-            .padding(horizontal = 14.dp, vertical = 8.dp),
-        color = Color.White,
-        fontSize = 15.sp,
-    )
-}
-
 /**
  * The "hold to quit" cue shown while the gamepad exit chord (Select + Start + L1 + R1) is held. The
  * chord no longer quits on a quick press — the router debounces it on a ~1 s hold — so this confirms

clients/android/app/src/test/kotlin/io/unom/punktfunk/GamepadPaletteTest.kt

@@ -33,14 +33,14 @@ class GamepadPaletteTest {
     fun tableMatchesTheOtherClients() {
         assertEquals(
             listOf(
-                "violet", "oled", "nebula", "abyss", "ember", "moss", "graphite",
+                "violet", "nebula", "abyss", "ember", "moss", "graphite",
                 "holo", "sunset", "bloom", "dawn", "mint", "opal",
             ),
             GamepadPalette.ALL.map { it.id },
         )
         // Dark fields lead, pale ones follow, so stepping the row walks one direction.
         val firstLight = GamepadPalette.ALL.indexOfFirst { it.light }
-        assertEquals(7, firstLight)
+        assertEquals(6, firstLight)
         assertTrue(GamepadPalette.ALL.drop(firstLight).all { it.light })
         // An unknown name is a newer client's palette, not an error.
         assertEquals("violet", GamepadPalette.named("chartreuse").id)
@@ -72,25 +72,6 @@ class GamepadPaletteTest {
         }
     }
 
-    /**
-     * OLED is the one palette whose selling point is measurable: it has to be genuinely black,
-     * not merely the darkest of the dark fields. The blob field this client draws samples the
-     * ramp at 0.15/0.40/0.65/0.90, so its darkest blob lands in the all-black head of the ramp.
-     */
-    @Test
-    fun oledIsActuallyBlack() {
-        val oled = GamepadPalette.named("oled")
-        assertEquals(Triple(0.0, 0.0, 0.0), oled.ground)
-        assertEquals(0f, oled.blobColors[0].red, 1e-6f)
-        assertEquals(0f, oled.blobColors[0].green, 1e-6f)
-        assertEquals(0f, oled.blobColors[0].blue, 1e-6f)
-        val mean = oled.stops.sumOf { luma(it) } / oled.stops.size
-        val darkestOther = GamepadPalette.ALL
-            .filter { it.id != "oled" && it.stops.isNotEmpty() }
-            .minOf { p -> p.stops.sumOf { luma(it) } / p.stops.size }
-        assertTrue("oled means $mean, barely under $darkestOther", mean < darkestOther / 2)
-    }
-
     /** A pale palette really is pale — its ink flips, so a mislabelled one is unreadable. */
     @Test
     fun palettesAreHonestAboutLightness() {
@@ -142,9 +123,7 @@ class GamepadPaletteTest {
      */
     @Test
     fun everySettingsRowHasATab() {
-        val rows = buildSettingsRows(
-            Settings(), hasBodyVibrator = true, hasGyroscope = true, av1Capable = true,
-        ) {}
+        val rows = buildSettingsRows(Settings(), hasBodyVibrator = true, av1Capable = true) {}
         assertTrue(rows.isNotEmpty())
         assertEquals(rows.size, rows.map { it.id }.toSet().size)
         // Profiles is built separately (from the catalog), so no settings row claims it.
@@ -158,9 +137,7 @@ class GamepadPaletteTest {
     @Test
     fun backgroundRowStepsTheSharedKey() {
         var s = Settings()
-        fun rows() = buildSettingsRows(
-            s, hasBodyVibrator = false, hasGyroscope = false, av1Capable = false,
-        ) { s = it }
+        fun rows() = buildSettingsRows(s, hasBodyVibrator = false, av1Capable = false) { s = it }
         fun palette() = rows().first { it.id == "palette" }
 
         assertEquals("violet", s.uiPalette)

clients/android/app/src/test/kotlin/io/unom/punktfunk/GamepadSettingsRowsTest.kt

@@ -24,7 +24,6 @@ class GamepadSettingsRowsTest {
     ): List<GpRow> = buildSettingsRows(
         Settings(gamepadForwarding = forwarding),
         hasBodyVibrator = true,
-        hasGyroscope = true,
         av1Capable = true,
     ) { sink += it }
 
@@ -95,47 +94,4 @@ class GamepadSettingsRowsTest {
         // Drawn as a switch, and reading the persisted default.
         assertEquals(true, row(on, "dsCapture").toggled)
     }
-
-    /**
-     * The activation-mode row is a sub-setting of the Controller-optimized UI switch, so it is
-     * OFFERED only while that switch is on — hidden rather than dimmed, because with the switch
-     * off this whole screen is about to be replaced by the touch UI and a dimmed row there would
-     * be one last thing to step past on the way out.
-     */
-    @Test
-    fun `the activation-mode row follows the switch it belongs to`() {
-        fun ids(enabled: Boolean) = buildSettingsRows(
-            Settings(gamepadUiEnabled = enabled),
-            hasBodyVibrator = false, hasGyroscope = false, av1Capable = false,
-        ) {}.map { it.id }
-
-        val on = ids(enabled = true)
-        assertTrue("the mode row is missing", "gamepadUIMode" in on)
-        assertEquals(
-            "the mode belongs directly under the switch it qualifies",
-            on.indexOf("gamepadUI") + 1,
-            on.indexOf("gamepadUIMode"),
-        )
-        val off = ids(enabled = false)
-        assertFalse("the mode row must not outlive its switch", "gamepadUIMode" in off)
-        assertTrue("the switch itself stays, or it could never be turned back on", "gamepadUI" in off)
-    }
-
-    /** Stepping the mode row writes the shared `gamepad_ui_mode` value, and wraps on A. */
-    @Test
-    fun `the activation-mode row steps the shared key`() {
-        var s = Settings()
-        fun mode() = buildSettingsRows(
-            s, hasBodyVibrator = false, hasGyroscope = false, av1Capable = false,
-        ) { s = it }.first { it.id == "gamepadUIMode" }
-
-        assertEquals(GAMEPAD_UI_WHEN_CONNECTED, s.gamepadUiMode)
-        assertEquals("With a controller", mode().value)
-        assertFalse("already the first = thud", mode().adjust(-1))
-        assertTrue(mode().adjust(1))
-        assertEquals(GAMEPAD_UI_ALWAYS, s.gamepadUiMode)
-        // A from the last entry wraps home.
-        mode().activate()
-        assertEquals(GAMEPAD_UI_WHEN_CONNECTED, s.gamepadUiMode)
-    }
 }

clients/android/app/src/test/kotlin/io/unom/punktfunk/GamepadUiTest.kt

@@ -1,53 +0,0 @@
-package io.unom.punktfunk
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * [gamepadUiActive] is pure — table-tested over its inputs, and the mirror of the Apple client's
- * `GamepadUIEnvironmentTests`. The two clients share the stored `gamepad_ui_mode` values, so a
- * disagreement here is a device that behaves differently from the same setting.
- */
-class GamepadUiTest {
-
-    /** The default mode is what the switch meant when it was a lone Boolean. */
-    @Test
-    fun whenConnectedWaitsForAPad() {
-        assertTrue(gamepadUiActive(true, GAMEPAD_UI_WHEN_CONNECTED, true, tv = false, forced = false))
-        assertFalse(gamepadUiActive(true, GAMEPAD_UI_WHEN_CONNECTED, false, tv = false, forced = false))
-        assertFalse(gamepadUiActive(false, GAMEPAD_UI_WHEN_CONNECTED, true, tv = false, forced = false))
-        assertFalse(gamepadUiActive(false, GAMEPAD_UI_WHEN_CONNECTED, false, tv = false, forced = false))
-        // A TV is in console mode whatever the mode says — its remote is the only input.
-        assertTrue(gamepadUiActive(true, GAMEPAD_UI_WHEN_CONNECTED, false, tv = true, forced = false))
-    }
-
-    /** Always drops the controller from the decision — but never the switch, which is the one
-     * way back to the touch UI. */
-    @Test
-    fun alwaysIgnoresThePadButNotTheSwitch() {
-        assertTrue(gamepadUiActive(true, GAMEPAD_UI_ALWAYS, false, tv = false, forced = false))
-        assertTrue(gamepadUiActive(true, GAMEPAD_UI_ALWAYS, true, tv = false, forced = false))
-        assertFalse(gamepadUiActive(false, GAMEPAD_UI_ALWAYS, false, tv = false, forced = false))
-        assertFalse(gamepadUiActive(false, GAMEPAD_UI_ALWAYS, true, tv = false, forced = false))
-    }
-
-    /** A value a newer client wrote waits for a pad rather than stranding this build in a
-     * layout it has no way back out of. */
-    @Test
-    fun anUnknownModeWaitsForAPad() {
-        assertFalse(gamepadUiActive(true, "whenever-i-say-so", false, tv = false, forced = false))
-        assertTrue(gamepadUiActive(true, "whenever-i-say-so", true, tv = false, forced = false))
-        assertFalse(gamepadUiActive(true, "", false, tv = false, forced = false))
-    }
-
-    /** The shipped default: the console UI still waits for a controller. */
-    @Test
-    fun theDefaultIsUnchangedBehaviour() {
-        val s = Settings()
-        assertTrue(s.gamepadUiEnabled)
-        assertEquals(GAMEPAD_UI_WHEN_CONNECTED, s.gamepadUiMode)
-        assertFalse(gamepadUiActive(s.gamepadUiEnabled, s.gamepadUiMode, false, tv = false, forced = false))
-    }
-}

clients/android/app/src/test/kotlin/io/unom/punktfunk/ProfilesTest.kt

@@ -77,7 +77,6 @@ class ProfilesTest {
 
         // Device-scope settings are not in the overlay at all, so no profile can move them.
         assertEquals(base.gamepadUiEnabled, out.gamepadUiEnabled)
-        assertEquals(base.gamepadUiMode, out.gamepadUiMode)
         assertEquals(base.libraryEnabled, out.libraryEnabled)
         assertEquals(base.autoWakeEnabled, out.autoWakeEnabled)
         assertEquals(base.sc2Capture, out.sc2Capture)

clients/android/app/src/test/kotlin/io/unom/punktfunk/StatsOverlayAudioTest.kt

@@ -1,94 +0,0 @@
-package io.unom.punktfunk
-
-import androidx.activity.ComponentActivity
-import androidx.compose.ui.test.junit4.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithText
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-/**
- * The stats HUD's audio line — `audio buffer N ms · a/v ±N ms`, from the live gauges at indexes
- * 33/34 (`design/audio-latency-overhaul.md`).
- *
- * Worth pinning because the whole point of the overhaul's stats half is that the audio plane became
- * OBSERVABLE. Before it, ring depth and A/V offset existed only as a log line, and on a device
- * launched by a game launcher that goes to a pipe nobody can read — so the single number that
- * identifies a deep ring was unobtainable on the exact device reporting the latency, and a field
- * investigation ran to its conclusion without it. A measurement that never reaches a surface is
- * indistinguishable from no measurement, which is what this asserts.
- *
- * `sdk = [36]` for the same reason as the screenshot tests: Robolectric ships android-all jars only
- * up to API 36 while the app's compileSdk is 37.
- */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [36])
-class StatsOverlayAudioTest {
-    @get:Rule
-    val compose = createAndroidComposeRule<ComponentActivity>()
-
-    /**
-     * A plausible 35-double window with the audio gauges dialled in. Everything before 33 is the
-     * DETAILED-renderable shape the ShotScenes fixture uses; only the last two matter here.
-     */
-    private fun stats(bufferMs: Double, avOffsetMs: Double, size: Int = 35): DoubleArray {
-        val full = doubleArrayOf(
-            238.0, 921.4, 1.3, 2.1, 1.0, 1.0, 5120.0, 1440.0, 240.0, 2.0,
-            10.0, 9.0, 16.0, 1.0, 0.9, 0.4, 0.6, 0.3,
-            2.0, 1.0, 5.0, 238.0,
-            1.0, 0.5, 1.8, 2.6,
-            0.2, 0.3, 236.0, 1.0,
-            0.1, 0.3, 0.0,
-            bufferMs, avOffsetMs,
-        )
-        return full.copyOf(size)
-    }
-
-    private fun show(s: DoubleArray, verbosity: StatsVerbosity = StatsVerbosity.DETAILED) {
-        compose.setContent { StatsOverlay(s, verbosity = verbosity) }
-    }
-
-    @Test
-    fun detailedShowsDepthAndOffset() {
-        show(stats(bufferMs = 42.0, avOffsetMs = 18.0))
-        // Positive = audio playing BEHIND the picture, and the sign is explicit so a glance tells
-        // which way the loop still has to move.
-        compose.onNodeWithText("audio buffer 42 ms · a/v +18 ms").assertExists()
-    }
-
-    @Test
-    fun audioAheadOfThePictureReadsNegative() {
-        show(stats(bufferMs = 42.0, avOffsetMs = -12.0))
-        compose.onNodeWithText("audio buffer 42 ms · a/v -12 ms").assertExists()
-    }
-
-    /** Aligned (or not yet measured) drops the offset term; the depth alone is still the triage number. */
-    @Test
-    fun alignedShowsDepthAlone() {
-        show(stats(bufferMs = 42.0, avOffsetMs = 0.0))
-        compose.onNodeWithText("audio buffer 42 ms").assertExists()
-    }
-
-    /** Nothing queued (audio off, or the ring not yet primed) — the line has nothing to say. */
-    @Test
-    fun silentPlaneRendersNoLine() {
-        show(stats(bufferMs = 0.0, avOffsetMs = 0.0))
-        compose.onNodeWithText("audio buffer", substring = true).assertDoesNotExist()
-    }
-
-    /** The line is DETAILED-only, like every other per-stage figure. */
-    @Test
-    fun normalTierOmitsTheLine() {
-        show(stats(bufferMs = 42.0, avOffsetMs = 18.0), verbosity = StatsVerbosity.NORMAL)
-        compose.onNodeWithText("audio buffer", substring = true).assertDoesNotExist()
-    }
-
-    /** An older native lib emits 33 doubles; the overlay must omit the line, not index past the end. */
-    @Test
-    fun olderNativeLayoutOmitsTheLine() {
-        show(stats(bufferMs = 42.0, avOffsetMs = 18.0, size = 33))
-        compose.onNodeWithText("audio buffer", substring = true).assertDoesNotExist()
-    }
-}

clients/android/app/src/test/kotlin/io/unom/punktfunk/screenshots/ShotScenes.kt

@@ -355,12 +355,10 @@ internal fun StreamScene(verbosity: StatsVerbosity = StatsVerbosity.DETAILED) {
                 Brush.linearGradient(listOf(Color(0xFF2A1E5C), Color(0xFF0E1B3D), Color(0xFF06122B))),
             ),
     ) {
-        // The full 35-double unified layout — NativeBridge.nativeVideoStats' KDoc is the
-        // authoritative index list: [fps, mbps, e2eP50, e2eP95, latValid, skew, w, h, hz,
-        // lostTotal, bitDepth, colorPrimaries, colorTransfer, chromaFormatIdc, hostNetP50,
-        // decodeP50, hostP50, netP50, lost, skipped, fec, frames, dispValid, displayP50,
-        // e2eDispP50, e2eDispP95, paceP50, latchP50, presents, presenterActive, feedP50, codecP50,
-        // skippedOverflow, audioBufferMs, audioAvOffsetMs].
+        // The full 26-double unified layout (design/stats-unification.md): [fps, mbps, e2eP50,
+        // e2eP95, latValid, skew, w, h, hz, lostTotal, bitDepth, colorPrimaries, colorTransfer,
+        // chromaFormatIdc, hostNetP50, decodeP50, hostP50, netP50, lost, skipped, fec, frames,
+        // dispValid, displayP50, e2eDispP50, e2eDispP95].
         // 10/9/16/1 = a 10-bit BT.2020 PQ (HDR) 4:2:0 feed so the DETAILED HUD renders its
         // video-feed line; the display stage is valid (dispValid 1) so the headline is the
         // directly-measured capture→displayed pair, less the excluded OS present floor (the 0.3
@@ -378,12 +376,6 @@ internal fun StreamScene(verbosity: StatsVerbosity = StatsVerbosity.DETAILED) {
                 1.0, 0.5, 1.8, 2.6,
                 // Timeline-presenter split: pace + latch tile the display term; presents ≈ fps.
                 0.2, 0.3, 236.0, 1.0,
-                // The decode term's own split (feed + codec = 0.4), and no overflow — the one
-                // `skipped` above is benign newest-wins pacing, not a decoder falling behind.
-                0.1, 0.3, 0.0,
-                // The audio plane: a 28 ms ring placed 4 ms behind the picture — a converged sync
-                // loop, i.e. inside the deadband it deliberately leaves alone.
-                28.0, 4.0,
             ),
             verbosity = verbosity,
             decoderLabel = "c2.qti.hevc.decoder · low-latency",

clients/android/kit/build.gradle.kts

@@ -67,37 +67,30 @@ fun androidSdkDir(): String {
     return "${System.getProperty("user.home")}/Library/Android/sdk"
 }
 
-// Every cargo-ndk invocation needs the same discovery environment, and they must not drift apart:
-// a lint that ran against a different toolchain/sysroot than the build is a lint about a different
-// program. Applied by both `registerCargoNdk` (build) and `registerCargoNdkClippy` (lint).
-fun Exec.cargoNdkEnvironment() {
-    val sdk = androidSdkDir()
-    // A GUI Android Studio launch does not source the login shell, so make cargo, the NDK, and
-    // cmake (libopus builds via the cmake crate) discoverable explicitly — same as a bare CLI.
-    val cmakeBin = "$sdk/cmake/3.22.1/bin"
-    environment(
-        "PATH",
-        cargoBin + File.pathSeparator + cmakeBin + File.pathSeparator + System.getenv("PATH"),
-    )
-    environment("ANDROID_HOME", sdk)
-    environment("ANDROID_NDK_HOME", "$sdk/ndk/$ndkVer")
-    // CMake's built-in Android support (used by the cmake crate for libopus) finds the NDK via
-    // these, and uses Ninja (bundled next to the SDK cmake) since there's no `make`.
-    environment("ANDROID_NDK_ROOT", "$sdk/ndk/$ndkVer")
-    environment("ANDROID_NDK", "$sdk/ndk/$ndkVer")
-    environment("CMAKE_GENERATOR", "Ninja")
-    // audiopus_sys picks static-vs-dynamic by HOST not target — force the bundled static libopus
-    // (pure C) so the android .so links it instead of looking for the host's libopus.so.
-    environment("LIBOPUS_STATIC", "1")
-    environment("LIBOPUS_NO_PKG", "1")
-}
-
 fun registerCargoNdk(taskName: String, release: Boolean) =
     tasks.register<Exec>(taskName) {
         group = "rust"
         description = "cargo-ndk build of punktfunk-client-android (${if (release) "release" else "debug"})"
         workingDir = repoRoot
-        cargoNdkEnvironment()
+        val sdk = androidSdkDir()
+        // A GUI Android Studio launch does not source the login shell, so make cargo, the NDK, and
+        // cmake (libopus builds via the cmake crate) discoverable explicitly — same as a bare CLI.
+        val cmakeBin = "$sdk/cmake/3.22.1/bin"
+        environment(
+            "PATH",
+            cargoBin + File.pathSeparator + cmakeBin + File.pathSeparator + System.getenv("PATH"),
+        )
+        environment("ANDROID_HOME", sdk)
+        environment("ANDROID_NDK_HOME", "$sdk/ndk/$ndkVer")
+        // CMake's built-in Android support (used by the cmake crate for libopus) finds the NDK via
+        // these, and uses Ninja (bundled next to the SDK cmake) since there's no `make`.
+        environment("ANDROID_NDK_ROOT", "$sdk/ndk/$ndkVer")
+        environment("ANDROID_NDK", "$sdk/ndk/$ndkVer")
+        environment("CMAKE_GENERATOR", "Ninja")
+        // audiopus_sys picks static-vs-dynamic by HOST not target — force the bundled static libopus
+        // (pure C) so the android .so links it instead of looking for the host's libopus.so.
+        environment("LIBOPUS_STATIC", "1")
+        environment("LIBOPUS_NO_PKG", "1")
         // Resolve cargo by ABSOLUTE path: Gradle's Exec resolves command[0] via the JVM's
         // inherited PATH, NOT the environment("PATH", …) set above (that only reaches the spawned
         // child). A GUI Android Studio launch (and any daemon it started) has no ~/.cargo/bin on
@@ -120,41 +113,6 @@ fun registerCargoNdk(taskName: String, release: Boolean) =
         commandLine(cmd)
     }
 
-// ------------------------------------------------------------------------------------------------
-// Lint the ANDROID target. `punktfunk-client-android` and every `#[cfg(target_os = "android")]`
-// module elsewhere in the workspace were, until this task existed, **completely unlinted**: ci.yml
-// runs `cargo clippy --workspace` on the HOST, where all of that code is compiled out, and this
-// workflow only ever ran `build`. The gap was found in 2026-08 with five lints sitting in
-// clients/android/native (two of them `unnecessary_cast`, which is exactly the class that decides
-// whether a cast is redundant BY POINTER WIDTH).
-//
-// Both widths are linted, and that is the load-bearing part: arm64-v8a is 64-bit and armeabi-v7a is
-// 32-bit, so a cast that is redundant on one can be required on the other. Linting only the primary
-// ABI would license "fixes" that break the 32-bit build — the shipping ABI for the many 32-bit
-// Google TV / Android TV boxes this client targets. x86_64 is deliberately omitted: it is
-// emulator-only and shares its pointer width with arm64, so it costs a third of the job's lint time
-// for no signal these two do not already carry.
-//
-// `--all-targets` for the same reason ci.yml spells it out: without it the `#[cfg(test)]` modules
-// are never compiled, and un-compiled test code drifts silently.
-fun registerCargoNdkClippy(taskName: String) =
-    tasks.register<Exec>(taskName) {
-        group = "verification"
-        description = "clippy (deny warnings) for punktfunk-client-android on both Android widths"
-        workingDir = repoRoot
-        cargoNdkEnvironment()
-        commandLine(
-            // Absolute cargo path for the same reason as the build task above.
-            "$cargoBin/cargo", "ndk",
-            "-t", "arm64-v8a", "-t", "armeabi-v7a",
-            "--platform", "28",
-            "clippy", "-p", "punktfunk-client-android", "--all-targets",
-            "--", "-D", "warnings",
-        )
-    }
-
-val cargoNdkClippy = registerCargoNdkClippy("cargoNdkClippy")
-
 // Post-link floor check: every undefined symbol in the built .so must exist in the API-28 stubs,
 // else System.loadLibrary fails on devices at the minSdk floor (see the script header for the
 // 0.9.0 incident this guards against). Runs right after its cargo-ndk task; the APK build depends

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/DeviceGyro.kt

@@ -1,170 +0,0 @@
-package io.unom.punktfunk.kit
-
-import android.content.Context
-import android.hardware.Sensor
-import android.hardware.SensorEvent
-import android.hardware.SensorEventListener
-import android.hardware.SensorManager
-import android.os.Build
-import android.os.Handler
-import android.os.HandlerThread
-import android.view.Display
-import android.view.Surface
-import android.view.WindowManager
-
-/**
- * The opt-in phone-gyro mirror ("Gyro from this phone", off by default): while wire pad 0 is a
- * controller with no motion source of its own, THIS device's IMU speaks for it on the rich-input
- * motion plane — for clip-on and third-party pads that ship without a gyro, where the phone body
- * is rigidly attached to (or simply is) the thing in the player's hands. [GamepadFeedback]'s
- * rumble-on-phone mirror with the data flowing the other way.
- *
- * On Android the only motion sources are the capture links (USB DualSense / SC2 — pads with a
- * real IMU, claimed as [GamepadRouter.ExternalPad]s), so the stand-down rule is exactly
- * [GamepadRouter.padHasOwnMotion]: when a capture link holds pad 0, the mirror sends nothing —
- * two motion writers on one wire pad would fight. It also sends nothing while pad 0 has no slot
- * at all (motion never creates a host pad; a controller must have arrived first).
- *
- * Two properties this class enforces itself:
- *  - samples ride a dedicated [HandlerThread] with batching disabled (`maxReportLatencyUs = 0`) —
- *    sensor batching would trade the exact latency gyro aim exists to avoid;
- *  - a stand-down edge (capture link claims pad 0, or [stop]) sends ONE zero-gyro sample, so the
- *    host's virtual pad never keeps integrating an angular velocity this device stopped
- *    producing (the gyro-sweep "stale angular velocity re-sent forever" failure mode).
- *
- * Units are the wire contract, converted by [Gamepad.motionGyroWire] / [Gamepad.motionAccelWire] —
- * the same two functions [PadSensors] uses, so a scale this client ever has to correct is corrected
- * once for every sender rather than once per sender that someone remembers. The one thing the
- * phone adds is a frame remap: sensors report in the device's natural-portrait frame, while
- * the wire wants the controller frame the player sees (x right, y up, z out of the screen), so
- * each sample is rotated by the current display rotation — a phone clipped landscape must yaw
- * when the player yaws, not roll. The matrix is derived and pinned by `DeviceGyroTest`;
- * correctable in one place if on-glass says otherwise.
- */
-class DeviceGyro(
-    context: Context,
-    private val handle: Long,
-    private val router: GamepadRouter,
-) : SensorEventListener {
-
-    private val sensorManager: SensorManager? =
-        context.getSystemService(SensorManager::class.java)
-
-    /** For the live rotation; null on contexts without a display association (then portrait). */
-    private val display: Display? = runCatching {
-        if (Build.VERSION.SDK_INT >= 30) {
-            context.display
-        } else {
-            @Suppress("DEPRECATION")
-            context.getSystemService(WindowManager::class.java)?.defaultDisplay
-        }
-    }.getOrNull()
-
-    private val thread = HandlerThread("pf-phone-gyro")
-
-    /** Latest converted accel, paired with each gyro send (the wire fuses both per sample). */
-    private val lastAccel = intArrayOf(0, Gamepad.MOTION_ACCEL_LSB_PER_G, 0)
-
-    /** Whether the last gyro event actually went to pad 0 — the stand-down zero-send edge. */
-    private var wasWriting = false
-
-    /** Register the listeners; a device without a gyroscope makes this a no-op. */
-    fun start() {
-        val sm = sensorManager ?: return
-        val gyro = sm.getDefaultSensor(Sensor.TYPE_GYROSCOPE) ?: return
-        thread.start()
-        val h = Handler(thread.looper)
-        // ~200 Hz requested (the framework clamps to what the hardware offers), zero report
-        // latency: batching is poison for gyro aim.
-        sm.registerListener(this, gyro, SAMPLING_PERIOD_US, 0, h)
-        sm.getDefaultSensor(Sensor.TYPE_ACCELEROMETER)?.let {
-            sm.registerListener(this, it, SAMPLING_PERIOD_US, 0, h)
-        }
-    }
-
-    /**
-     * Unregister and join the sensor thread, then park the host pad's rotation at zero if this
-     * mirror was the live writer. Call BEFORE the router is released / the handle freed —
-     * teardown-ordered like the feedback threads.
-     */
-    fun stop() {
-        sensorManager?.unregisterListener(this)
-        thread.quitSafely()
-        runCatching { thread.join() }
-        if (wasWriting) {
-            wasWriting = false
-            sendZero()
-        }
-    }
-
-    override fun onSensorChanged(event: SensorEvent) {
-        val rotation = display?.rotation ?: Surface.ROTATION_0
-        when (event.sensor.type) {
-            Sensor.TYPE_ACCELEROMETER -> {
-                val v = remap(rotation, event.values[0], event.values[1], event.values[2])
-                for (i in 0..2) lastAccel[i] = Gamepad.motionAccelWire(v[i])
-            }
-            Sensor.TYPE_GYROSCOPE -> {
-                // The write gate, per sample: pad 0 must exist (motion never creates a pad)
-                // and must not be a capture link's (its own IMU is streaming).
-                val write = router.padPresent(0) && !router.padHasOwnMotion(0)
-                if (!write) {
-                    // Stand-down edge: never leave the last angular velocity latched host-side.
-                    if (wasWriting) {
-                        wasWriting = false
-                        sendZero()
-                    }
-                    return
-                }
-                wasWriting = true
-                val v = remap(rotation, event.values[0], event.values[1], event.values[2])
-                NativeBridge.nativeSendPadMotion(
-                    handle, 0,
-                    Gamepad.motionGyroWire(v[0]),
-                    Gamepad.motionGyroWire(v[1]),
-                    Gamepad.motionGyroWire(v[2]),
-                    lastAccel[0], lastAccel[1], lastAccel[2],
-                )
-            }
-        }
-    }
-
-    override fun onAccuracyChanged(sensor: Sensor?, accuracy: Int) {}
-
-    /** Zero rotation, last-known accel — "at rest", not free-fall. */
-    private fun sendZero() {
-        NativeBridge.nativeSendPadMotion(
-            handle, 0, 0, 0, 0, lastAccel[0], lastAccel[1], lastAccel[2],
-        )
-    }
-
-    companion object {
-        /** Whether this device can source motion at all — gates the settings rows (a TV box
-         *  without an IMU would make the toggle a silent no-op, the rumble mirror's rule). */
-        fun available(context: Context): Boolean =
-            context.getSystemService(SensorManager::class.java)
-                ?.getDefaultSensor(Sensor.TYPE_GYROSCOPE) != null
-
-        /**
-         * ~200 Hz — between the sensor's usual FASTEST (~250-500 Hz) and GAME (~50 Hz), and also
-         * the ceiling the framework grants an app without `HIGH_SAMPLING_RATE_SENSORS` (API 31+),
-         * so asking for more would only be silently capped. Shared with [PadSensors].
-         */
-        internal const val SAMPLING_PERIOD_US = 5000
-
-        /**
-         * Rotate one device-frame vector (rotation rate or acceleration — both transform the
-         * same way under an in-plane rotation) into the controller frame for [rotation]
-         * ([Surface].ROTATION_*). Sensors report in the natural-portrait frame (+x right edge,
-         * +y top, +z out of the screen); the controller frame keeps +z (the screen always faces
-         * the player) and rotates x/y to mean "player's right" and "player's up". ROTATION_90 =
-         * the device physically turned counter-clockwise, top to the player's LEFT.
-         */
-        fun remap(rotation: Int, x: Float, y: Float, z: Float): FloatArray = when (rotation) {
-            Surface.ROTATION_90 -> floatArrayOf(-y, x, z) // top left: right = bottom, up = +x
-            Surface.ROTATION_270 -> floatArrayOf(y, -x, z) // top right: right = top, up = −x
-            Surface.ROTATION_180 -> floatArrayOf(-x, -y, z)
-            else -> floatArrayOf(x, y, z)
-        }
-    }
-}

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/DsCapture.kt

@@ -22,11 +22,9 @@ import android.view.InputDevice
  *
  * Input: parse ([DsDevice.parseState]) → typed mirror on an [GamepadRouter.ExternalPad] (buttons
  * diffed, axes on-change — the exit chord participates like any pad) + the rich plane (touch
- * normalized to the wire's 0..65535 screen space on-change; motion forwarded per report, rescaled
- * into the wire's units by this pad's own calibration — read once per claim, off the claiming
- * thread, with the nominal scaling standing in for the millisecond that read is in flight rather
- * than the UI waiting on a control transfer). The wire slot is claimed when the capture engages,
- * with the first parsed report as the fallback for a claim that found no free index, and freed on
+ * normalized to the wire's 0..65535 screen space on-change; motion forwarded per report in raw
+ * device units, the wire's contract). The wire slot is claimed when the capture engages, with the
+ * first parsed report as the fallback for a claim that found no free index, and freed on
  * unplug/[stop], so indices never leak.
  *
  * Feedback: implements [GamepadFeedback.PadFeedbackSink] — rumble / trigger / lightbar / player
@@ -57,13 +55,6 @@ class DsCapture(
     @Volatile private var model: DsDevice.Model? = null
     @Volatile private var pad: GamepadRouter.ExternalPad? = null
 
-    /** This pad's factory motion scale, read once per capture on [calReader] and handed to the
-     *  link thread, which scales nominally until it lands — see [MotionCalHandoff]. */
-    private val motionCal = MotionCalHandoff()
-
-    /** The thread doing the claim-time calibration read, kept for the teardown wait. */
-    @Volatile private var calReader: Thread? = null
-
     // Typed-mirror diff state (wire units) + rich-plane on-change mirrors. Link thread only.
     private val state = DsDevice.State()
     private var wireButtons = 0
@@ -133,11 +124,6 @@ class DsCapture(
         if (model != null) return false
         val m = DsDevice.modelFor(dev.productId) ?: return false
         if (!usb.start(dev)) return false
-        // Before `model`, which is what lets the link thread into the parse at all: opening the
-        // claim forgets the last pad's calibration, so reports arriving while this pad's own read
-        // (below, off this thread) is in flight fall back to the nominal scaling rather than to
-        // another unit's factory numbers.
-        val claim = motionCal.begin()
         model = m
         for (id in InputDevice.getDeviceIds()) {
             val d = InputDevice.getDevice(id) ?: continue
@@ -149,88 +135,9 @@ class DsCapture(
         Log.i(TAG, "Sony pad captured over USB: PID=0x%04x model=%s".format(dev.productId, m))
         ensureSlot(m)
         onActiveChanged?.invoke(true)
-        readMotionCalAsync(m, claim)
         return true
     }
 
-    /**
-     * Start this claim's calibration read, on its own thread.
-     *
-     * Off the caller's thread because [startUsb] runs on the main one — stream setup, and the
-     * USB-permission broadcast — and the read is a blocking EP0 control transfer: a pad that is
-     * there answers in about a millisecond, but one that is stalling takes the link's whole write
-     * timeout, and the interface must wait for neither. The pad is live throughout, its motion
-     * nominally scaled until this lands ([onReport]), so even a pad that never answers costs
-     * precision rather than the UI or the controller.
-     *
-     * One thread per claim, daemon and named, matching how [HidUsbLink] runs its reader; it is
-     * awaited by [awaitCalRead] before the connection it reads from can be closed.
-     */
-    private fun readMotionCalAsync(m: DsDevice.Model, claim: Int) {
-        val t = Thread({
-            // A read that throws would otherwise leave the capture on the nominal scaling with
-            // nothing in the log to say why — the one outcome that looks identical to a pad whose
-            // calibration is genuinely nominal. Publish the fallback explicitly, and say so.
-            val cal = runCatching { readMotionCal(m) }.getOrElse {
-                Log.w(TAG, "motion calibration read failed — nominal scaling", it)
-                DsDevice.MotionCal.NOMINAL
-            }
-            // Discarded when the claim is already over (unplug, stop, or a re-claim beat us here):
-            // scaling the NEXT pad by this one's factory numbers would be worse than not reading.
-            if (!motionCal.publish(claim, cal)) {
-                Log.i(TAG, "motion calibration arrived after the claim ended — discarded")
-            }
-        }, "pf-ds-cal")
-        calReader = t
-        t.isDaemon = true
-        t.start()
-    }
-
-    /**
-     * Wait for an in-flight calibration read to let go of the USB connection, before a teardown
-     * closes it.
-     *
-     * Not politeness: the read is a control transfer on the very connection [HidUsbLink.stop] is
-     * about to close, and closing a descriptor with a transfer in flight pulls it out from under
-     * the kernel — the same rule the pad-audio borrow follows. Bounded, and in every case but a
-     * pad that has stopped answering the thread is long gone, so this returns immediately. It can
-     * never deadlock: the reading thread waits on nothing this one holds ([MotionCalHandoff] has
-     * its own monitor, and the read itself takes no lock).
-     */
-    private fun awaitCalRead() {
-        val t = calReader ?: return
-        calReader = null
-        if (!t.isAlive) return
-        runCatching { t.join(CAL_JOIN_MS) }
-        if (t.isAlive) Log.w(TAG, "calibration read still in flight at teardown")
-    }
-
-    /**
-     * Read this pad's IMU calibration — the feature report that says how many raw counts this
-     * individual unit puts on a °/s and on a g ([DsDevice.MotionCal]).
-     *
-     * Once, at claim time, and nowhere else: the calibration is fixed for the life of the
-     * connection, so doing it per input report would buy nothing and cost the capture its latency.
-     * A pad that refuses keeps the nominal scaling rather than losing motion altogether.
-     */
-    private fun readMotionCal(m: DsDevice.Model): DsDevice.MotionCal {
-        val blob = usb.getReport(HidUsbLink.REPORT_TYPE_FEATURE, m.calReportId, m.calReportLen)
-        val cal = DsDevice.MotionCal.parse(blob, m.calReportId)
-        // Worth a line either way: this is the number the owed on-glass check reads back — a pad
-        // whose blob was read declares its own resolution, the fallback declares the wire's.
-        if (cal === DsDevice.MotionCal.NOMINAL) {
-            Log.w(
-                TAG,
-                "motion calibration 0x%02x unreadable (%d/%d B) — nominal scaling (%s)".format(
-                    m.calReportId, blob?.size ?: 0, m.calReportLen, cal,
-                ),
-            )
-        } else {
-            Log.i(TAG, "motion calibration 0x%02x: %s".format(m.calReportId, cal))
-        }
-        return cal
-    }
-
     /** Stop the link and free the wire slot (host tears the virtual pad down). Idempotent. */
     fun stop() {
         // Before anything touches the link: the pad-audio renderer borrows this connection's
@@ -250,10 +157,6 @@ class DsCapture(
             resetRichFeedback(m)
         }
         disarmBackstop()
-        // End the claim before waiting on it: a calibration that lands after this publishes
-        // nothing, and then the wait makes sure nothing is still reading the connection below.
-        motionCal.end()
-        awaitCalRead()
         usb.stop()
         val wasActive = model != null
         model = null
@@ -265,10 +168,7 @@ class DsCapture(
 
     private fun onReport(report: ByteArray, len: Int) {
         val m = model ?: return
-        // Nominal scaling until this claim's calibration read lands (see MotionCalHandoff): for
-        // that millisecond the pad behaves as it did before the read existed, which nobody can
-        // feel — unlike a pad whose buttons wait on a control transfer.
-        if (!DsDevice.parseState(m, report, len, state, motionCal.effective)) return
+        if (!DsDevice.parseState(m, report, len, state)) return
         // Normally claimed already, at capture time; this is the retry for a capture that engaged
         // while every wire index was taken.
         val p = pad ?: ensureSlot(m) ?: return // all 16 taken — drop until one frees
@@ -289,9 +189,7 @@ class DsCapture(
     @Synchronized
     private fun ensureSlot(m: DsDevice.Model): GamepadRouter.ExternalPad? {
         pad?.let { return it }
-        // hasGyro: every pad this link captures is a Sony one with an IMU, and its motion goes out
-        // on the rich plane — so a session that cannot carry it is worth saying out loud.
-        val p = router.openExternal(m.pref, hasGyro = true) ?: return null
+        val p = router.openExternal(m.pref) ?: return null
         pad = p
         Log.i(TAG, "captured $m → wire pad ${p.index}")
         // The wire index exists from here on, and the host addresses pad audio by it.
@@ -381,10 +279,6 @@ class DsCapture(
         val wasActive = model != null
         model = null
         releaseSlot()
-        // As in stop(): end the claim so a late calibration publishes nothing, then wait for the
-        // read to let go of the connection the line below closes.
-        motionCal.end()
-        awaitCalRead()
         // Release the transport too: the link only *signals* the drop, so without this an unplug
         // left its connection open, its interfaces claimed and its detach receiver registered.
         usb.stop()
@@ -416,8 +310,8 @@ class DsCapture(
 
     /**
      * The rich plane: touch contacts normalized to the wire's 0..65535 screen space, forwarded
-     * on change per slot; motion forwarded every report (already in wire units — the parse applies
-     * this pad's calibration, and sensor noise makes per-report dedup pointless).
+     * on change per slot; motion forwarded every report (raw device units — the wire is a unit
+     * passthrough into the host's virtual pad, and sensor noise makes per-report dedup pointless).
      */
     private fun mirrorRich(p: GamepadRouter.ExternalPad, m: DsDevice.Model) {
         for (f in 0 until 2) {
@@ -589,9 +483,5 @@ class DsCapture(
         /** How soon to retry a rumble stop whose write was rejected. Short: the motors are running
          *  and the host has already moved on, so nothing else is coming to silence them. */
         const val STOP_RETRY_MS = 100L
-
-        /** Teardown's budget for an in-flight calibration read. Comfortably past the link's own
-         *  EP0 timeout, so it only ever elapses for a pad that has stopped answering entirely. */
-        const val CAL_JOIN_MS = 500L
     }
 }

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/DsDevice.kt

@@ -1,7 +1,5 @@
 package io.unom.punktfunk.kit
 
-import kotlin.math.abs
-
 /**
  * Sony DualSense / DualSense Edge / DualShock 4 **USB** protocol constants: the input-report
  * parser and the output-report builders the capture link ([DsCapture]) needs. Unlike the SC2's
@@ -30,168 +28,14 @@ object DsDevice {
     /**
      * One captured model: its `GamepadPref` wire byte (the virtual pad the host builds — matching
      * the physical one), its output-report size (the descriptor-declared size the firmware
-     * expects: DS5 48 = id + 47, Edge 64 = id + 63, DS4 32 = id + 31), its touchpad extent
+     * expects: DS5 48 = id + 47, Edge 64 = id + 63, DS4 32 = id + 31), and its touchpad extent
      * (`dualsense_proto::DS_TOUCH_W/H`, `dualshock4_proto::DS4_TOUCH_*`) for normalizing touches
-     * onto the wire's 0..65535 space, and the IMU-calibration feature report it answers
-     * ([MotionCal]): DS5/Edge `0x05` (id + 40 B), DS4 over USB `0x02` (id + 36 B).
+     * onto the wire's 0..65535 space.
      */
-    enum class Model(
-        val pref: Int,
-        val outputSize: Int,
-        val touchW: Int,
-        val touchH: Int,
-        val calReportId: Int,
-        val calReportLen: Int,
-    ) {
-        DUALSENSE(Gamepad.PREF_DUALSENSE, 48, 1920, 1080, 0x05, 41),
-        DUALSENSE_EDGE(Gamepad.PREF_DUALSENSEEDGE, 64, 1920, 1080, 0x05, 41),
-        DUALSHOCK4(Gamepad.PREF_DUALSHOCK4, 32, 1920, 942, 0x02, 37),
-    }
-
-    /**
-     * One pad's own IMU calibration: the factory scale factors that turn its raw motion counts
-     * into the wire's fixed units (`punktfunk_core::input::gamepad` — 20 LSB per °/s, 10000 LSB
-     * per g), read out of the calibration feature report the pad serves on EP0.
-     *
-     * **Why the pad's blob and not a constant.** Measured on glass 2026-08-07: a DualSense flat
-     * and face up arrived as 0.811 g where 1.000 was owed, because this path forwarded the raw
-     * i16s verbatim. The nominal ×10000/8192 rescale that first closed that gap ([NOMINAL]) still
-     * leaves that unit's factory bias — about 1 % — on acceleration, and provably cannot fix gyro
-     * at all: the same still-average showed this pad's gyro calibration is nowhere near identity,
-     * and a near-identity one would mean 1024 LSB per °/s, i.e. ±32 °/s full scale, which no
-     * controller has. The scale is per unit; only the pad knows it.
-     *
-     * The arithmetic is `hid-playstation`'s, and the host's contract test
-     * (`crates/pf-inject/tests/motion_contract.rs`, `SonyImuCalibration`) is the same math read
-     * from the other end — it applies it to the blobs our *virtual* pads declare and asserts they
-     * land on the wire constants. Per axis: gyro `raw × speed_2x × 20 / (|plus − bias| +
-     * |minus − bias|)`, accel `(raw − (plus − range/2)) × 20000 / range`, where `range = plus −
-     * minus` spans 2 g.
-     */
-    class MotionCal private constructor(
-        /** Per axis: `speed_2x × 20`, over `|plus − bias| + |minus − bias|`. */
-        private val gyroNumer: LongArray,
-        private val gyroDenom: LongArray,
-        /** Per axis: the raw count the pad reads at 0 g, and the raw span of 2 g. */
-        private val accelBias: LongArray,
-        private val accelRange: LongArray,
-    ) {
-        /** Raw gyro count on [axis] (0 = pitch, 1 = yaw, 2 = roll) → the wire's 20 LSB per °/s. */
-        fun gyroToWire(axis: Int, raw: Int): Int =
-            clampWire(raw.toLong() * gyroNumer[axis] / gyroDenom[axis])
-
-        /** Raw acceleration count on [axis] → the wire's 10000 LSB per g, zero point removed. */
-        fun accelToWire(axis: Int, raw: Int): Int =
-            clampWire((raw - accelBias[axis]) * ACCEL_NUMER / accelRange[axis])
-
-        /**
-         * The derived resolutions, for the capture's one-line claim log — the number that says
-         * whether a pad's blob was actually read (a real DualSense declares ≈16 LSB/°·s and ≈8192
-         * LSB/g; the [NOMINAL] fallback reads back as exactly 20 and 8192).
-         */
-        override fun toString(): String = buildString {
-            append("gyro ")
-            for (i in 0 until 3) {
-                if (i > 0) append('/')
-                append(gyroDenom[i] * WIRE_GYRO_LSB_PER_DEG_S / gyroNumer[i])
-            }
-            append(" LSB/°·s, accel ")
-            for (i in 0 until 3) {
-                if (i > 0) append('/')
-                append(accelRange[i] / 2)
-            }
-            append(" LSB/g at ")
-            append(accelBias.joinToString("/"))
-        }
-
-        /**
-         * Both conversions are a >1 multiplier on every pad measured so far, so a real ±4 g slam
-         * or a fast flick near full scale would otherwise wrap the i16 and read as an impossible
-         * motion in the opposite direction.
-         */
-        private fun clampWire(v: Long): Int = v.coerceIn(-32768L, 32767L).toInt()
-
-        companion object {
-            /** The pads' nominal acceleration resolution — `hid-playstation`'s `DS_ACC_RES_PER_G`. */
-            private const val RAW_ACCEL_LSB_PER_G = 8192L
-            /**
-             * The wire's gyro scale, taken from [Gamepad] rather than restated. These were literal
-             * `20L` / `10000L` until the sensor path hoisted the same numbers into one place; a
-             * second copy of a unit constant is precisely the defect this whole program opened
-             * with, and two of them in one module would be worse than the original.
-             *
-             * `val`, not `const val`, only because the widening to Long is not a compile-time
-             * constant expression. Long here on purpose: the arithmetic below multiplies raw counts
-             * by the calibration's speed term before dividing, which overflows an Int.
-             */
-            private val WIRE_GYRO_LSB_PER_DEG_S = Gamepad.MOTION_GYRO_LSB_PER_DEG_S.toLong()
-            /** `MOTION_ACCEL_LSB_PER_G`, doubled — the declared accel range spans 2 g, not 1. */
-            private val ACCEL_NUMER = 2L * Gamepad.MOTION_ACCEL_LSB_PER_G
-            /** Bytes the layout below reads; the reports themselves are longer (41 / 37). */
-            private const val MIN_LEN = 35
-
-            /**
-             * What an unreadable pad gets: gyro straight through and accel on the nominal 8192
-             * LSB/g. Wrong by that unit's factory bias, and for gyro wrong by however far its
-             * scale sits from the wire's 20 — but a pad whose calibration cannot be read is far
-             * better off slightly mis-scaled than silent, so this never zeroes motion.
-             */
-            val NOMINAL = MotionCal(
-                LongArray(3) { 1 },
-                LongArray(3) { 1 },
-                LongArray(3),
-                LongArray(3) { 2 * RAW_ACCEL_LSB_PER_G },
-            )
-
-            /**
-             * Parse a calibration feature report ([Model.calReportId]) — all little-endian i16:
-             * `[0]` report id, `[1..7)` gyro bias (pitch, yaw, roll), `[7..19)` gyro plus/minus
-             * INTERLEAVED (pitch+, pitch−, yaw+, yaw−, roll+, roll−), `[19..23)` the two speed
-             * words, `[23..35)` accel plus/minus (x+, x−, y+, y−, z+, z−).
-             *
-             * ⚠ Interleaved is the **USB** order. A Bluetooth DualShock 4 groups the three plusses
-             * before the three minuses and consumers switch layout on the transport — this path is
-             * USB-only by construction (see the file header), so do not "generalise" it.
-             *
-             * Falls back to [NOMINAL] for a failed read (null), a truncated or foreign reply, and
-             * per axis for a degenerate declaration — a clone or broken pad that declares zeroes
-             * would otherwise divide by zero (`hid-playstation` guards the same case, for the same
-             * reason).
-             */
-            fun parse(blob: ByteArray?, reportId: Int): MotionCal {
-                if (blob == null || blob.size < MIN_LEN) return NOMINAL
-                if ((blob[0].toInt() and 0xFF) != reportId) return NOMINAL
-                val w = { o: Int ->
-                    ((blob[o + 1].toInt() shl 8) or (blob[o].toInt() and 0xFF)).toShort().toLong()
-                }
-                val speed2x = w(19) + w(21)
-                val gyroNumer = LongArray(3)
-                val gyroDenom = LongArray(3)
-                val accelBias = LongArray(3)
-                val accelRange = LongArray(3)
-                for (i in 0 until 3) {
-                    val bias = w(1 + 2 * i)
-                    val denom = abs(w(7 + 4 * i) - bias) + abs(w(9 + 4 * i) - bias)
-                    if (speed2x > 0 && denom > 0) {
-                        gyroNumer[i] = speed2x * WIRE_GYRO_LSB_PER_DEG_S
-                        gyroDenom[i] = denom
-                    } else {
-                        gyroNumer[i] = 1 // passthrough, as before any calibration existed
-                        gyroDenom[i] = 1
-                    }
-                    val plus = w(23 + 4 * i)
-                    val range = plus - w(25 + 4 * i)
-                    if (range > 0) {
-                        accelBias[i] = plus - range / 2
-                        accelRange[i] = range
-                    } else {
-                        accelBias[i] = 0 // nominal, as NOMINAL above
-                        accelRange[i] = 2 * RAW_ACCEL_LSB_PER_G
-                    }
-                }
-                return MotionCal(gyroNumer, gyroDenom, accelBias, accelRange)
-            }
-        }
+    enum class Model(val pref: Int, val outputSize: Int, val touchW: Int, val touchH: Int) {
+        DUALSENSE(Gamepad.PREF_DUALSENSE, 48, 1920, 1080),
+        DUALSENSE_EDGE(Gamepad.PREF_DUALSENSEEDGE, 64, 1920, 1080),
+        DUALSHOCK4(Gamepad.PREF_DUALSHOCK4, 32, 1920, 942),
     }
 
     /** The captured [Model] for a USB PID, or null for anything we don't capture. */
@@ -206,9 +50,8 @@ object DsDevice {
      * The client-consumed fields of one input report. `buttons` is already the WIRE bitmask
      * (`Gamepad.BTN_*`) — the parse maps device bits straight to the wire, the exact inverse of
      * the host's `DsState::from_gamepad` (BTN_A ↔ cross, BTN_B ↔ circle, BTN_X ↔ square,
-     * BTN_Y ↔ triangle; positional, not glyph-order). Gyro/accel arrive in WIRE units — the wire's
-     * `Motion` is a unit passthrough into the virtual pad's report, so the pad's raw counts are
-     * rescaled during the parse by the [MotionCal] handed to [parseState]. Touch coordinates stay
+     * BTN_Y ↔ triangle; positional, not glyph-order). Gyro/accel stay in raw device units — the
+     * wire's `Motion` is a unit passthrough into the virtual pad's report. Touch coordinates stay
      * device-raw here; [DsCapture] normalizes against the model's extent when forwarding.
      */
     class State {
@@ -216,8 +59,8 @@ object DsDevice {
         var lsX = 0; var lsY = 0 // wire i16, +y = up (device is +y down — inverted in the parse)
         var rsX = 0; var rsY = 0
         var lt = 0; var rt = 0 // 0..255
-        val gyro = IntArray(3) // wire i16: 20 LSB per °/s (pitch/yaw/roll)
-        val accel = IntArray(3) // wire i16: 10000 LSB per g
+        val gyro = IntArray(3) // raw i16 units (pitch/yaw/roll)
+        val accel = IntArray(3)
         val touchActive = BooleanArray(2)
         val touchX = IntArray(2) // raw device coords (0..touchW-1 / 0..touchH-1)
         val touchY = IntArray(2)
@@ -265,25 +108,15 @@ object DsDevice {
      * short read (the pad also emits `0x09`-family getMAC responses etc. on EP0 — those never hit
      * the interrupt endpoint, but be defensive). Motion/touch fields update only when the report
      * is long enough to carry them (it always is on glass — 64-byte interrupt transfers).
-     *
-     * [cal] is this pad's own motion calibration, read once when the capture claims it; the
-     * default is the nominal fallback, which is all a caller without a live pad (the tests) can
-     * have.
      */
-    fun parseState(
-        model: Model,
-        report: ByteArray,
-        len: Int,
-        out: State,
-        cal: MotionCal = MotionCal.NOMINAL,
-    ): Boolean =
+    fun parseState(model: Model, report: ByteArray, len: Int, out: State): Boolean =
         if (model == Model.DUALSHOCK4) {
-            parseDs4(report, len, out, cal)
+            parseDs4(report, len, out)
         } else {
-            parseDs5(model, report, len, out, cal)
+            parseDs5(model, report, len, out)
         }
 
-    private fun parseDs5(model: Model, r: ByteArray, len: Int, out: State, cal: MotionCal): Boolean {
+    private fun parseDs5(model: Model, r: ByteArray, len: Int, out: State): Boolean {
         if (len < 11 || (r[0].toInt() and 0xFF) != DS5_INPUT_ID) return false
         out.lsX = stickX(u8(r, 1))
         out.lsY = stickY(u8(r, 2))
@@ -319,8 +152,8 @@ object DsDevice {
         }
         out.buttons = w
         if (len >= 28) {
-            for (i in 0 until 3) out.gyro[i] = cal.gyroToWire(i, i16(r, 16 + 2 * i))
-            for (i in 0 until 3) out.accel[i] = cal.accelToWire(i, i16(r, 22 + 2 * i))
+            for (i in 0 until 3) out.gyro[i] = i16(r, 16 + 2 * i)
+            for (i in 0 until 3) out.accel[i] = i16(r, 22 + 2 * i)
         }
         if (len >= 41) {
             unpackTouch(r, 33, out, 0)
@@ -329,7 +162,7 @@ object DsDevice {
         return true
     }
 
-    private fun parseDs4(r: ByteArray, len: Int, out: State, cal: MotionCal): Boolean {
+    private fun parseDs4(r: ByteArray, len: Int, out: State): Boolean {
         if (len < 10 || (r[0].toInt() and 0xFF) != DS5_INPUT_ID) return false // DS4 shares id 0x01
         out.lsX = stickX(u8(r, 1))
         out.lsY = stickY(u8(r, 2))
@@ -355,8 +188,8 @@ object DsDevice {
         if (b7 and DS4_TOUCHPAD != 0) w = w or Gamepad.BTN_TOUCHPAD
         out.buttons = w
         if (len >= 25) {
-            for (i in 0 until 3) out.gyro[i] = cal.gyroToWire(i, i16(r, 13 + 2 * i))
-            for (i in 0 until 3) out.accel[i] = cal.accelToWire(i, i16(r, 19 + 2 * i))
+            for (i in 0 until 3) out.gyro[i] = i16(r, 13 + 2 * i)
+            for (i in 0 until 3) out.accel[i] = i16(r, 19 + 2 * i)
         }
         if (len >= 43) {
             unpackTouch(r, 35, out, 0)

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/Gamepad.kt

@@ -3,7 +3,6 @@ package io.unom.punktfunk.kit
 import android.view.InputDevice
 import android.view.KeyEvent
 import android.view.MotionEvent
-import kotlin.math.roundToInt
 
 /**
  * Android gamepad capture → punktfunk/1 gamepad wire (the `input.rs::gamepad` contract; the host
@@ -55,31 +54,6 @@ object Gamepad {
     const val AXIS_LT = 4
     const val AXIS_RT = 5
 
-    // Motion wire units — must equal punktfunk-core `input.rs::gamepad::MOTION_*`. Every motion
-    // sender on this client goes through the two converters below, so a scale that ever has to
-    // change changes in ONE place: the gyro program's first finding was a client sending 40× hot
-    // because a second copy of the number had drifted.
-    const val MOTION_GYRO_LSB_PER_DEG_S = 20
-    const val MOTION_ACCEL_LSB_PER_G = 10_000
-
-    /** Standard gravity, `punktfunk-core`'s `G` — the divisor that turns m/s² into g. */
-    const val GRAVITY = 9.80665f
-
-    /** [MOTION_GYRO_LSB_PER_DEG_S] restated for Android's rad/s sensors: 1 rad/s ⇒ ~1145.9 raw. */
-    const val MOTION_GYRO_LSB_PER_RAD_S = MOTION_GYRO_LSB_PER_DEG_S * 180f / Math.PI.toFloat()
-
-    /** One angular-rate component, Android's rad/s → the wire's signed-16 raw units. */
-    fun motionGyroWire(radPerSec: Float): Int =
-        (radPerSec * MOTION_GYRO_LSB_PER_RAD_S).roundToInt().coerceIn(-32768, 32767)
-
-    /**
-     * One acceleration component, Android's m/s² → the wire's signed-16 raw units. Android reports
-     * specific force (the axis pointing up reads +1 g at rest), which is the DualSense report's own
-     * convention — no sign flip, and a pad lying flat lands on the host's neutral +1 g exactly.
-     */
-    fun motionAccelWire(mPerSecSq: Float): Int =
-        (mPerSecSq / GRAVITY * MOTION_ACCEL_LSB_PER_G).roundToInt().coerceIn(-32768, 32767)
-
     // GamepadPref wire bytes — must equal punktfunk-core `config.rs::GamepadPref::to_u8`.
     const val PREF_AUTO = 0
     const val PREF_XBOX360 = 1

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/GamepadRouter.kt

@@ -7,7 +7,6 @@ import android.os.Looper
 import android.view.InputDevice
 import android.view.KeyEvent
 import android.view.MotionEvent
-import java.util.Collections
 import java.util.concurrent.ConcurrentHashMap
 
 /**
@@ -32,8 +31,7 @@ import java.util.concurrent.ConcurrentHashMap
  *
  * Threading: slot mutation + dispatch run on the main thread (Android input dispatch and the
  * InputManager hot-plug callbacks both land there). [deviceForPad] is read from the feedback poll
- * threads, [padPresent]/[padHasOwnMotion] from the phone-gyro thread and [deviceMotion] from the
- * pad-sensor thread, so the slot table is a [ConcurrentHashMap].
+ * threads, so the slot table is a [ConcurrentHashMap].
  */
 class GamepadRouter(
     context: Context,
@@ -71,18 +69,7 @@ class GamepadRouter(
 ) {
 
     /** One forwarded controller: its stable wire pad index, per-device axis state, and held buttons. */
-    private class Slot(
-        val index: Int,
-        val mapper: Gamepad.AxisMapper,
-        /**
-         * Whether motion sent for this pad can reach the game at all, asked once at open off the
-         * kind it declared ([NativeBridge.nativePadMotionReaches]). False means the host built it a
-         * backend with no motion plane, so [deviceMotion] drops the sample here rather than paying
-         * to send one the host will decode and discard — at a controller's full sensor rate, for
-         * the whole session. The capture-link pads carry the same flag on [ExternalPad].
-         */
-        val motionReaches: Boolean = true,
-    ) {
+    private class Slot(val index: Int, val mapper: Gamepad.AxisMapper) {
         /** Forwarded button bits currently held (Gamepad.BTN_*) — for release-on-close + chord detection. */
         var held = 0
 
@@ -98,33 +85,12 @@ class GamepadRouter(
     private val slots = ConcurrentHashMap<Int, Slot>()
 
     /**
-     * deviceIds whose own gyro [PadSensors] is currently reading — see [setDeviceHasSensorMotion].
-     * Written on the main thread, read from the phone-gyro thread, hence a concurrent set.
-     */
-    private val sensorDevices: MutableSet<Int> =
-        Collections.newSetFromMap(ConcurrentHashMap<Int, Boolean>())
-
-    /**
-     * Invoked (main thread) with the deviceId whenever a slot closes — hot-unplug, a capture link's
-     * [releaseDevice] claim, or session teardown. `StreamScreen` wires this to
-     * `GamepadFeedback.onDeviceRemoved` so a disconnected pad's rumble / lights bindings are
-     * released promptly instead of leaking until the feedback threads stop, and to
-     * [PadSensors.onSlotClosed] so the controller's own sensor listeners come off with it.
+     * Invoked (main thread) with the deviceId whenever a slot closes — hot-unplug or session teardown.
+     * `StreamScreen` wires this to `GamepadFeedback.onDeviceRemoved` so a disconnected pad's rumble /
+     * lights bindings are released promptly instead of leaking until the feedback threads stop.
      */
     var onSlotClosed: ((deviceId: Int) -> Unit)? = null
 
-    /**
-     * Invoked (main thread) with the deviceId whenever a slot opens for a REAL controller — the
-     * hot-plug callback or the first input from a pad the session started without. Not fired for
-     * [openExternal]: a capture link's pad has no [InputDevice] behind it and streams motion from
-     * its own IMU already. `StreamScreen` wires this to [PadSensors.onSlotOpened].
-     *
-     * Slots opened in `init` (every controller already connected) predate any assignment here, so
-     * a listener must sweep [forwardedDevices] once when it starts. Both happen on the main thread
-     * inside one composition block, so nothing can slip between the sweep and the assignment.
-     */
-    var onSlotOpened: ((deviceId: Int) -> Unit)? = null
-
     /**
      * Invoked (main thread) when the emergency-exit chord has been HELD for [EXIT_HOLD_MS] — the caller
      * leaves the stream. `StreamScreen` wires this to the deliberate-quit exit.
@@ -149,17 +115,6 @@ class GamepadRouter(
      */
     var onMicChord: (() -> Unit)? = null
 
-    /**
-     * Invoked (main thread) once per pad when a captured controller WITH a gyro turns out to be in
-     * a session whose virtual pad has no motion plane — its motion is not being sent, because every
-     * sample would be decoded and dropped host-side.
-     *
-     * It exists because the failure is otherwise completely silent: the gyro just does nothing, and
-     * from the couch that is indistinguishable from a broken sensor. The fix is the Controller type
-     * setting, so whatever shows this has to name it. `StreamScreen` wires it to a brief notice.
-     */
-    var onMotionUnreachable: (() -> Unit)? = null
-
     private val mainHandler = Handler(Looper.getMainLooper())
     /** The pending exit-chord hold timer, or null when the chord isn't currently armed. */
     private var pendingExit: Runnable? = null
@@ -365,82 +320,13 @@ class GamepadRouter(
         return null
     }
 
-    /** Whether ANY live slot currently holds wire pad [pad]. Read from the phone-gyro thread. */
-    fun padPresent(pad: Int): Boolean = slots.values.any { it.index == pad }
-
-    /**
-     * Whether wire pad [pad]'s motion already comes from the controller's OWN IMU — either a
-     * capture-link slot ([ExternalPad] — USB DualSense / SC2; synthetic ids are negative
-     * ([EXTERNAL_ID_BASE]), real [InputDevice] ids positive), or a real controller whose gyro
-     * [PadSensors] is reading through the platform sensor framework (a Bluetooth DualSense /
-     * Switch Pro / 8BitDo). The phone-gyro mirror stands down for both: two motion writers on one
-     * wire pad would fight, and the pad's own IMU is the one attached to the player's hands.
-     * Read from the phone-gyro thread (both tables are concurrent).
-     */
-    fun padHasOwnMotion(pad: Int): Boolean =
-        slots.any { (id, slot) -> slot.index == pad && (id < 0 || id in sensorDevices) }
-
-    /**
-     * Declare (or withdraw) that real controller [deviceId] is sourcing its own rotation — see
-     * [padHasOwnMotion]. Called by [PadSensors] as it registers and unregisters listeners, on the
-     * main thread; read from the phone-gyro thread, hence the concurrent set. Keyed by device
-     * rather than by pad index so a controller that changes wire index (a lower one freed up while
-     * it was captured) carries the fact with it.
-     */
-    fun setDeviceHasSensorMotion(deviceId: Int, has: Boolean) {
-        if (has) sensorDevices.add(deviceId) else sensorDevices.remove(deviceId)
-        // This is the first moment we know a Bluetooth pad actually HAS a gyro — `openSlot` only
-        // knows what kind it declared. So it is the honest place to raise the notice when that
-        // gyro has nowhere to go, and the only one that cannot nag about a pad that never had one.
-        if (has && forwarding && slots[deviceId]?.motionReaches == false) {
-            onMotionUnreachable?.invoke()
-        }
-    }
-
-    /**
-     * One motion sample from real controller [deviceId]'s own sensors, on whatever wire index its
-     * slot currently holds — [ExternalPad.motion] for pads the input stack still owns. Silently
-     * drops when the slot is gone (unplugged, or claimed by a capture link between the sensor
-     * callback and here) rather than writing to an index that may already belong to someone else.
-     * Called from [PadSensors]' sensor thread.
-     */
-    fun deviceMotion(deviceId: Int, gyro: IntArray, accel: IntArray) {
-        val slot = slots[deviceId] ?: return
-        if (!forwarding) return
-        // The same gate the USB capture path takes: a backend with no motion plane decodes every
-        // sample and discards it, so sending is pure cost. Notified once per pad by
-        // [setDeviceHasSensorMotion], which is where we first know the controller HAS a gyro to
-        // lose — a pad without one must not produce a warning about motion.
-        if (!slot.motionReaches) return
-        NativeBridge.nativeSendPadMotion(
-            handle, slot.index,
-            gyro[0], gyro[1], gyro[2],
-            accel[0], accel[1], accel[2],
-        )
-    }
-
-    /** Snapshot of the REAL controllers currently forwarded, as deviceIds — the set [PadSensors]
-     *  sweeps at start for the pads that were already connected when the session opened. */
-    fun forwardedDevices(): List<Int> = slots.keys.filter { it >= 0 }
-
     /**
      * A capture-link pad occupying a wire slot without an Android [InputDevice] — the as-is Steam
      * Controller 2 passthrough (USB/BLE claimed directly, invisible to the input stack). Shares
      * the real slots' lifecycle: a stable lowest-free index, Arrival-before-input, held-state
      * flush + Remove on [close], and full participation in the emergency exit chord.
      */
-    inner class ExternalPad internal constructor(
-        private val syntheticId: Int,
-        val index: Int,
-        /**
-         * Whether this pad's motion can reach the game at all, asked once at open (see
-         * [NativeBridge.nativePadMotionReaches]). False means the host built this pad a backend
-         * without a motion plane, so [motion] drops the sample here instead of paying to send one
-         * the host will decode and discard — at a controller's full report rate, for the whole
-         * session.
-         */
-        private val motionReaches: Boolean,
-    ) {
+    inner class ExternalPad internal constructor(private val syntheticId: Int, val index: Int) {
         // Live lookup instead of a captured reference: after [close] (or a router release) the
         // slot is gone from the table and every entry point below degrades to a safe no-op.
         private val slot get() = slots[syntheticId]
@@ -471,7 +357,7 @@ class GamepadRouter(
         /** One motion sample on the rich plane (gyro pitch/yaw/roll + accel, raw device i16
          *  units — the host passes them straight into the virtual pad's report). Per report. */
         fun motion(gyro: IntArray, accel: IntArray) {
-            if (slot != null && forwarding && motionReaches) {
+            if (slot != null && forwarding) {
                 NativeBridge.nativeSendPadMotion(
                     handle, index,
                     gyro[0], gyro[1], gyro[2],
@@ -487,26 +373,15 @@ class GamepadRouter(
     /**
      * Open a slot for a capture-link pad, declaring [pref] as its kind; null when all 16 wire
      * indices are taken. Main thread (like the hot-plug callbacks).
-     *
-     * [hasGyro] says whether this link forwards motion on the RICH plane ([ExternalPad.motion]) —
-     * true for the Sony pads, whose IMU is a headline feature, and false for the Steam Controller 2,
-     * whose motion rides inside the opaque passthrough report that [ExternalPad.hidReport] carries
-     * and which nothing here may second-guess. It gates only the notice: a pad that never sends
-     * motion must not produce a warning about motion.
      */
-    fun openExternal(pref: Int, hasGyro: Boolean = false): ExternalPad? {
+    fun openExternal(pref: Int): ExternalPad? {
         val index = lowestFreeIndex() ?: return null
         // Synthetic ids live below any real InputDevice id (those are positive), so they can't
         // collide and InputDevice.getDevice(id) resolves them to null for the feedback path.
         val syntheticId = EXTERNAL_ID_BASE - index
         if (forwarding) NativeBridge.nativeSendGamepadArrival(handle, pref, index)
-        // Asked once, here, off the kind this pad just DECLARED — not off the session's resolved
-        // backend, which under Automatic answers for whichever pad happened to be active at dial
-        // time. Cheap enough to ask unconditionally; the answer holds for the pad's lifetime.
-        val motionReaches = NativeBridge.nativePadMotionReaches(handle, pref)
-        if (forwarding && hasGyro && !motionReaches) onMotionUnreachable?.invoke()
         slots[syntheticId] = Slot(index, Gamepad.AxisMapper(handle, index))
-        return ExternalPad(syntheticId, index, motionReaches)
+        return ExternalPad(syntheticId, index)
     }
 
     /**
@@ -562,18 +437,8 @@ class GamepadRouter(
         // to that type (a single global choice — matches the handshake's session-default pref).
         val pref = if (setting == Gamepad.PREF_AUTO) Gamepad.prefFor(dev) else setting
         if (forwarding) NativeBridge.nativeSendGamepadArrival(handle, pref, index)
-        // Asked here, off the kind this pad just DECLARED — not off the session's resolved backend,
-        // which under Automatic answers for whichever pad happened to be active at dial time. Held
-        // for the slot's life; the sensor path reads it on every sample.
-        val slot = Slot(
-            index,
-            Gamepad.AxisMapper(handle, index),
-            NativeBridge.nativePadMotionReaches(handle, pref),
-        )
+        val slot = Slot(index, Gamepad.AxisMapper(handle, index))
         slots[dev.id] = slot
-        // After the table holds the slot, so a listener that sends on this device the moment it is
-        // told ([PadSensors]) finds an index to send on rather than dropping its first samples.
-        onSlotOpened?.invoke(dev.id)
         return slot
     }
 

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/HidUsbLink.kt

@@ -442,42 +442,6 @@ class HidUsbLink(
         return n >= 0
     }
 
-    /**
-     * Read one report back OUT of the device — HID `GET_REPORT`, the EP0 mirror of [sendReport].
-     * [type] is [REPORT_TYPE_FEATURE] (or output), [id] the report number, [len] the report's full
-     * declared size INCLUDING its leading id byte, which a numbered report echoes back in byte 0
-     * (hidapi framing). Returns what arrived — truncated if the device answered short — or null
-     * when the device refuses the request or the link is down.
-     *
-     * ⚠ **Once, at claim time; never per input report.** EP0 is independent of the interrupt
-     * endpoints (see [sendReport]), so this is safe alongside the reader thread — but it BLOCKS the
-     * calling thread for up to [WRITE_TIMEOUT_MS], and a blocking control transfer in the report
-     * path would wreck capture latency. The one caller reads a Sony pad's fixed motion calibration
-     * when the capture engages ([DsCapture]).
-     */
-    fun getReport(type: Int, id: Int, len: Int): ByteArray? {
-        if (len <= 0) return null
-        val conn = connection ?: return null
-        val ifId = (activeClaim ?: claims.firstOrNull())?.iface?.id ?: return null
-        val buf = ByteArray(len)
-        val n = runCatching {
-            conn.controlTransfer(
-                0xA1, // device→host, class, interface
-                0x01, // GET_REPORT
-                (type shl 8) or id,
-                ifId,
-                buf,
-                buf.size,
-                WRITE_TIMEOUT_MS,
-            )
-        }.getOrDefault(-1)
-        return when {
-            n >= len -> buf
-            n > 0 -> buf.copyOf(n)
-            else -> null
-        }
-    }
-
     /**
      * Stop the read loop and release the interfaces. Idempotent; does not fire [onClosed].
      *
@@ -505,13 +469,12 @@ class HidUsbLink(
         device = null
     }
 
-    companion object {
-        private const val READ_TIMEOUT_MS = 100L
-        private const val WRITE_TIMEOUT_MS = 250
+    private companion object {
+        const val READ_TIMEOUT_MS = 100L
+        const val WRITE_TIMEOUT_MS = 250
         /** Hard `requestWait` ERRORS (not timeouts) persisting this long = the fd is dead. */
-        private const val ERROR_UNPLUG_MS = 2000L
-        private const val REPORT_TYPE_OUTPUT = 0x02
-        /** HID feature-report type — public for [getReport] callers ([writeRaw] takes a kind). */
+        const val ERROR_UNPLUG_MS = 2000L
+        const val REPORT_TYPE_OUTPUT = 0x02
         const val REPORT_TYPE_FEATURE = 0x03
     }
 }

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/MotionCalHandoff.kt

@@ -1,63 +0,0 @@
-package io.unom.punktfunk.kit
-
-/**
- * The hand-off of one claim's motion calibration, from the thread that reads it off the pad to the
- * link thread that scales every input report with it.
- *
- * [DsCapture] reads a captured Sony pad's calibration feature report **off** the claiming thread —
- * it is a blocking EP0 control transfer and the claim runs on the UI's thread — so the value lands
- * a moment after the capture goes live. Reports in that gap are scaled by
- * [DsDevice.MotionCal.NOMINAL] and forwarded like any other ([effective]): for about a millisecond
- * the pad behaves exactly as it did before the calibration read existed — acceleration a little
- * short, gyro unscaled — which nobody can feel, whereas a pad that ignores its buttons until an
- * EP0 read comes back is very obvious.
- *
- * What the hand-off is actually for is the two things that gap must NOT do, neither of which a
- * plain field gives:
- *
- *  - **Fall back to the previous pad's numbers instead of the nominal ones.** Calibration is per
- *    unit, so the last controller's scale factors are simply wrong for this one — more wrong, in
- *    general, than the nominal constants. [begin] forgets them, which is what makes the gap
- *    nominal rather than inherited.
- *  - **Let a read that outlived its claim publish.** An unplug, a [DsCapture.stop] and a fast
- *    re-claim can all land while a read is in flight; [publish] only accepts a value whose token is
- *    still the live claim's, so a straggler can never scale a pad it never read.
- *
- * Thread-safe: claimed and ended by the claiming thread, published by the reading thread, read by
- * the link thread.
- */
-internal class MotionCalHandoff {
-    /** Handed out by [begin] and burned by [end] — never reused, so a straggler can't match. */
-    private var token = 0
-
-    @Volatile private var cal: DsDevice.MotionCal? = null
-
-    /**
-     * The calibration to scale the next report with: the live claim's own, or the nominal fallback
-     * while its read is still in flight. Never null — a report is always forwarded, never held
-     * back waiting for a control transfer.
-     */
-    val effective: DsDevice.MotionCal get() = cal ?: DsDevice.MotionCal.NOMINAL
-
-    /** Open a claim: forget the previous pad's calibration, and take this claim's token. */
-    @Synchronized
-    fun begin(): Int {
-        cal = null
-        return ++token
-    }
-
-    /** End the live claim. Nothing read under an older token can land after this. */
-    @Synchronized
-    fun end() {
-        cal = null
-        token++
-    }
-
-    /** Publish [value] if [claim] is still the live claim; returns whether it landed. */
-    @Synchronized
-    fun publish(claim: Int, value: DsDevice.MotionCal): Boolean {
-        if (claim != token) return false
-        cal = value
-        return true
-    }
-}

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/NativeBridge.kt

@@ -264,12 +264,12 @@ object NativeBridge {
 
     /**
      * Drain ~1 s of live decode stats for the on-stream HUD, or `null` when no decode thread runs.
-     * Returns 35 doubles (unified stats spec, `design/stats-unification.md`):
+     * Returns 33 doubles (unified stats spec, `design/stats-unification.md`):
      * `[fps, mbps, e2eP50Ms, e2eP95Ms, latValid, skewCorrected, width, height, refreshHz, framesLost,
      * bitDepth, colorPrimaries, colorTransfer, chromaFormatIdc, hostNetP50Ms, decodeP50Ms, hostP50Ms,
      * netP50Ms, lostWindow, skippedWindow, fecWindow, framesWindow, dispValid, displayP50Ms,
      * e2eDispP50Ms, e2eDispP95Ms, paceP50Ms, latchP50Ms, presentsWindow, presenterActive,
-     * feedP50Ms, codecP50Ms, skippedOverflowWindow, audioBufferMs, audioAvOffsetMs]`
+     * feedP50Ms, codecP50Ms, skippedOverflowWindow]`
      * (the flags are 1.0/0.0; indexes 2/3 are the end-to-end capture→decoded headline; 10–13
      * describe the negotiated video feed — bit depth 8/10, CICP primaries/transfer, and the HEVC
      * chroma_format_idc 1=4:2:0 / 3=4:4:4; 14/15 are the stage p50s tiling the headline —
@@ -285,10 +285,7 @@ object NativeBridge {
      * the window's on-glass confirm count, and whether the presenter is active at all; 30/31
      * split `decode` (15) the same way — `feed` = received→queued (hand-off + input-slot wait),
      * `codec` = queued→decoded, the decoder's own time; 32 is the parked-AU overflow subset of
-     * `skipped` (19), i.e. the decoder falling behind rather than benign newest-wins pacing;
-     * 33/34 are the AUDIO plane — the playback ring's live depth in ms and the A/V sync loop's
-     * smoothed offset in ms, positive meaning audio plays BEHIND the picture. Those two are live
-     * gauges, not windowed samples, and the offset reads 0 until the loop has a video reference).
+     * `skipped` (19), i.e. the decoder falling behind rather than benign newest-wins pacing).
      * Poll ~1 Hz; each call resets the measurement window.
      */
     external fun nativeVideoStats(handle: Long): DoubleArray?
@@ -519,23 +516,6 @@ object NativeBridge {
     /** Signal wire pad [pad] (0..15) was unplugged so the host tears its virtual device down. The core stamps the seq + re-sends. */
     external fun nativeSendGamepadRemove(handle: Long, pad: Int)
 
-    /**
-     * Whether motion sent for a pad that declared [declaredPref] (the [Gamepad].PREF_* byte passed
-     * to [nativeSendGamepadArrival]) can actually reach the game, or would be decoded and dropped
-     * by a host backend without a motion plane — the X-Box classes have no gyro in their HID
-     * contract.
-     *
-     * Answered natively, off `punktfunk_core::config::pad_motion_reaches`, rather than
-     * reconstructed here from the session's requested/resolved prefs. The rule is subtler than it
-     * looks (the host builds each pad from its OWN declaration and folds what it cannot build, so
-     * neither the declaration nor the session echo answers it alone) and every way of getting it
-     * wrong is silent, so it lives in one place with one set of tests.
-     *
-     * Ask ONCE when a pad opens, not per sample. `true` when the session handle is dead — "don't
-     * suppress" is the safe answer whenever we cannot tell.
-     */
-    external fun nativePadMotionReaches(handle: Long, declaredPref: Int): Boolean
-
     /**
      * One raw HID input report from a client-captured controller (the as-is Steam Controller 2
      * passthrough), forwarded verbatim on the rich-input plane. [buf] is a DIRECT ByteBuffer whose

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/PadSensors.kt

@@ -1,247 +0,0 @@
-package io.unom.punktfunk.kit
-
-import android.hardware.Sensor
-import android.hardware.SensorEvent
-import android.hardware.SensorEventListener
-import android.os.Build
-import android.os.Handler
-import android.os.HandlerThread
-import android.util.Log
-import android.view.InputDevice
-import java.util.concurrent.ConcurrentHashMap
-
-/**
- * Motion from a controller the Android input stack owns — the Bluetooth pads.
- *
- * Before this, the only motion sources on Android were the capture links: [DsCapture] (a Sony pad
- * claimed over USB, raw HID) and [Sc2Capture] (Steam Controller 2 passthrough). A DualSense, a
- * DualShock 4, a Switch Pro or an 8BitDo paired over BLUETOOTH is neither — it arrives as an
- * ordinary [InputDevice], its buttons and sticks work, and its gyro was silently dead. That is a
- * whole class of controller with no motion at all.
- *
- * Android 12 (API 31) exposes those sensors: [InputDevice.getSensorManager] hands back a
- * [android.hardware.SensorManager] scoped to that one controller, carrying the usual
- * TYPE_GYROSCOPE / TYPE_ACCELEROMETER. This class registers a listener per forwarded controller
- * that has a gyroscope, converts each sample to wire units, and sends it on that pad's wire index
- * through [GamepadRouter.deviceMotion]. Below API 31 nothing is registered and the class is inert —
- * those pads keep working, minus motion, exactly as they did.
- *
- * It follows [DeviceGyro] (the phone-gyro mirror) wherever the two solve the same problem:
- *  - samples ride ONE dedicated [HandlerThread] with batching disabled (`maxReportLatencyUs = 0`)
- *    — sensor batching would trade away the exact latency gyro aim exists to avoid, and the main
- *    thread is where Compose recomposition lives;
- *  - a feed torn down while its wire pad is still alive parks the rotation at zero first, because
- *    the host holds motion as STATE and re-emits it in every virtual-pad report: an angular
- *    velocity left behind reads as a pad rotating forever (the gyro sweep's "stale rate re-sent
- *    forever" finding).
- *
- * One writer per pad, three ways:
- *  1. A USB capture claims the physical device away from the input stack; [DsCapture.startUsb]
- *     calls [GamepadRouter.releaseDevice] at claim time, which closes the slot, which fires
- *     `onSlotClosed`, which lands on [onSlotClosed] here and unregisters. The claim also makes the
- *     controller's [InputDevice] vanish outright, so even a reopened slot would find nothing to
- *     register — but the explicit teardown is what makes the ordering deterministic instead of a
- *     race against the platform's own removal callback.
- *  2. The phone-gyro mirror stands down: registering flips
- *     [GamepadRouter.setDeviceHasSensorMotion], [GamepadRouter.padHasOwnMotion] reports it, and
- *     [DeviceGyro] re-reads that gate on every sample (sending its own zero park on the edge).
- *  3. Exactly one feed exists per deviceId — [onSlotOpened] is idempotent, and it is the only
- *     thing that ever constructs one.
- *
- * Frame: see [gyroToWire] — the mapping is straight through, and NOT yet verified on hardware.
- */
-class PadSensors(private val router: GamepadRouter) {
-
-    /** One controller's live sensor feed: its listener state and the accel it pairs with each
-     *  rotation. Its arrays belong to the sensor thread; [stop] reads them only after the join. */
-    private inner class Feed(private val deviceId: Int) : SensorEventListener {
-        /** Latest converted accel, paired with each gyro send (the wire fuses both per sample).
-         *  Starts at the host's neutral — 1 g on the up axis, NOT [0,0,0], which is free fall. */
-        private val accel = intArrayOf(0, Gamepad.MOTION_ACCEL_LSB_PER_G, 0)
-        private val gyro = IntArray(3)
-
-        /** Whether any rotation has gone out on this pad — gates the park on teardown, so a pad
-         *  that never sent motion is not handed a sample it did not earn. */
-        @Volatile
-        var wroteMotion = false
-            private set
-
-        override fun onSensorChanged(event: SensorEvent) {
-            when (event.sensor.type) {
-                Sensor.TYPE_ACCELEROMETER -> accelToWire(event.values, accel)
-                Sensor.TYPE_GYROSCOPE -> {
-                    gyroToWire(event.values, gyro)
-                    // One line per controller per session, on the first sample that carries both
-                    // planes: it is the cheapest possible version of the frame measurement
-                    // [gyroToWire] asks for. Hold the pad flat and still while a stream starts and
-                    // the accel triple says which slot gravity lands on — the one thing that
-                    // settles whether the straight-through mapping is right.
-                    if (!wroteMotion) {
-                        Log.i(
-                            TAG,
-                            "controller $deviceId first motion sample: " +
-                                "gyro ${gyro.joinToString()} accel ${accel.joinToString()}",
-                        )
-                    }
-                    wroteMotion = true
-                    router.deviceMotion(deviceId, gyro, accel)
-                }
-            }
-        }
-
-        override fun onAccuracyChanged(sensor: Sensor?, accuracy: Int) {}
-
-        /** Zero rotation, last-known accel — "at rest", not free fall. */
-        fun park() {
-            gyro.fill(0)
-            router.deviceMotion(deviceId, gyro, accel)
-        }
-    }
-
-    /** deviceId → live feed. Concurrent: the main thread mutates it while the sensor thread is
-     *  running (hot-plug, a capture link's claim). */
-    private val feeds = ConcurrentHashMap<Int, Feed>()
-
-    private val thread = HandlerThread("pf-pad-sensors")
-    private var handler: Handler? = null
-
-    /**
-     * Start the sensor thread and attach to every controller the router already forwards — the
-     * pads connected before the session opened, which will never fire a hot-plug callback.
-     * Everything after that arrives through [onSlotOpened]. Main thread.
-     */
-    fun start() {
-        if (!supported()) return
-        thread.start()
-        handler = Handler(thread.looper)
-        for (deviceId in router.forwardedDevices()) onSlotOpened(deviceId)
-    }
-
-    /**
-     * A slot opened for real controller [deviceId] — attach if it has a gyroscope of its own.
-     * Idempotent, and a no-op before [start] or on a platform without the API. Main thread, from
-     * [GamepadRouter.onSlotOpened].
-     */
-    fun onSlotOpened(deviceId: Int) {
-        val h = handler ?: return
-        if (feeds.containsKey(deviceId)) return
-        // API 31+ only — getSensorManager does not exist below it. Re-checked here rather than
-        // relying on start()'s gate, so the entry point is safe on its own terms.
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) return
-        val dev = InputDevice.getDevice(deviceId) ?: return
-        // Declared non-null: a controller with no sensors gets an empty manager, not a null one.
-        val sm = dev.sensorManager
-        // A gyroscope is the entry price; the accelerometer alone does not buy a feed. The rotation
-        // is what gyro aim is for, and an accel-only feed would send gravity while pinning rotation
-        // at zero on a pad the phone-gyro mirror is otherwise entitled to speak for — precisely the
-        // two-writers-on-one-pad fight this program has spent its day unpicking. Such a pad stays
-        // on the mirror's terms instead, where at least the accel agrees with the gyro beside it.
-        // Nothing found here is not proof the pad has no IMU. A DualSense's motion arrives on its
-        // own evdev node, and whether InputReader merges that node onto the gamepad InputDevice
-        // (shared descriptor) or leaves it standing alone is the platform's business, not ours —
-        // and a standalone one is exactly what GamepadRouter.isForwardable filters out, so this
-        // would never see it. Android 12's own controller-sensor documentation cites the DualShock
-        // 4 and DualSense, which says the merge happens; it is not something this code can assert.
-        // If a Bluetooth Sony pad ever turns up here with no gyroscope, THAT is the thing to check.
-        val gyroSensor = sm.getDefaultSensor(Sensor.TYPE_GYROSCOPE) ?: return
-        val feed = Feed(deviceId)
-        feeds[deviceId] = feed
-        // ~200 Hz requested, zero report latency: batching is poison for gyro aim, and 200 Hz is
-        // what the framework grants an app without HIGH_SAMPLING_RATE_SENSORS anyway.
-        sm.registerListener(feed, gyroSensor, DeviceGyro.SAMPLING_PERIOD_US, 0, h)
-        sm.getDefaultSensor(Sensor.TYPE_ACCELEROMETER)?.let {
-            sm.registerListener(feed, it, DeviceGyro.SAMPLING_PERIOD_US, 0, h)
-        }
-        // The pad sources its own rotation from here on → the phone-gyro mirror stands down for it.
-        router.setDeviceHasSensorMotion(deviceId, true)
-        Log.i(TAG, "controller $deviceId (${dev.name}) has a gyro — forwarding its motion")
-    }
-
-    /**
-     * The slot for [deviceId] closed — unplug, session teardown, or a capture link claiming the
-     * device. Unregister and hand the pad back to the phone-gyro mirror. Main thread, from
-     * [GamepadRouter.onSlotClosed].
-     *
-     * No park-at-zero here, on purpose: the router removed the slot BEFORE invoking the callback
-     * and has already sent that pad's Remove, so the host tore the virtual pad down and there is no
-     * latched rotation left to clear — while writing to a wire index that is free again would be
-     * addressing whoever claims it next. [stop] is the case where the pad outlives the feed.
-     */
-    fun onSlotClosed(deviceId: Int) {
-        unregister(deviceId)
-        router.setDeviceHasSensorMotion(deviceId, false)
-    }
-
-    /**
-     * Unregister every listener, join the sensor thread, then park at zero each pad that was
-     * rotating. Call BEFORE the router is released and the session handle freed — the same
-     * teardown ordering rule as the feedback poll threads and [DeviceGyro.stop]. The parks come
-     * AFTER the join for two reasons: a sample still in flight would re-latch the rotation just
-     * cleared, and the join is what publishes the sensor thread's writes to this one.
-     */
-    fun stop() {
-        val parked = feeds.keys.toList().mapNotNull { id -> unregister(id)?.let { id to it } }
-        for ((deviceId, _) in parked) router.setDeviceHasSensorMotion(deviceId, false)
-        thread.quitSafely()
-        runCatching { thread.join() }
-        handler = null
-        for ((_, feed) in parked) if (feed.wroteMotion) feed.park()
-    }
-
-    /**
-     * Drop [deviceId]'s listeners, returning the feed that held them (null if there was none).
-     * Safe for a controller that is already gone: the sensor manager is reached through the
-     * [InputDevice], and a vanished device simply leaves nothing to unregister — the platform has
-     * stopped calling the listener either way.
-     */
-    private fun unregister(deviceId: Int): Feed? {
-        val feed = feeds.remove(deviceId) ?: return null
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
-            InputDevice.getDevice(deviceId)?.sensorManager?.unregisterListener(feed)
-        }
-        return feed
-    }
-
-    companion object {
-        private const val TAG = "PadSensors"
-
-        /** Whether this platform can read a controller's own sensors at all (API 31+). */
-        fun supported(): Boolean = Build.VERSION.SDK_INT >= Build.VERSION_CODES.S
-
-        /**
-         * One gyroscope sample (Android: rad/s) → the wire's three signed-16 components, in place.
-         *
-         * The axis frame is straight through, and that is now MEASURED rather than assumed.
-         *
-         * The wire is a unit passthrough into a virtual DualSense report, whose frame was measured
-         * over raw HID on 2026-08-07: slot 0 = Right (pitch), slot 1 = Up (yaw), slot 2 = Backward
-         * toward the player (roll), right-handed. Android hands a controller's own sensors over in
-         * that same frame — which was the documented expectation, but the numbers pass through a
-         * HID driver and InputFlinger's sensor mapper, either of which could have permuted or
-         * negated without saying so.
-         *
-         * Verified 2026-08-07 end to end: a DualSense on Bluetooth to an Android phone, streaming
-         * to a Linux host. This path's own first-sample log read `accel 0, 10000, 0` — exactly 1 g
-         * on slot 1 — and at the far end `hid-playstation` published gravity as +0.991 g on ABS_Y
-         * with every rotation driving its correctly-named axis (yaw→RY, pitch→RX, roll→RZ) and the
-         * signs agreeing with gravity's independent witness on 95 of 100 rotating samples.
-         *
-         * So: no remap. If a future device disagrees, the remap belongs HERE with its own
-         * expectations in `PadSensorsTest` — not spread across callers.
-         */
-        fun gyroToWire(values: FloatArray, out: IntArray) {
-            for (i in 0..2) out[i] = Gamepad.motionGyroWire(values.getOrElse(i) { 0f })
-        }
-
-        /**
-         * One accelerometer sample (Android: m/s², specific force) → the wire's three signed-16
-         * components, in place. Same measured frame as [gyroToWire] and the same straight-through
-         * mapping; the sign needs no flip, because Android and the DualSense report agree that the
-         * axis pointing up reads +1 g at rest (see [Gamepad.motionAccelWire]) — which is precisely
-         * what the on-glass run read back, `accel 0, 10000, 0` with the pad lying flat.
-         */
-        fun accelToWire(values: FloatArray, out: IntArray) {
-            for (i in 0..2) out[i] = Gamepad.motionAccelWire(values.getOrElse(i) { 0f })
-        }
-    }
-}

clients/android/kit/src/test/kotlin/io/unom/punktfunk/kit/DeviceGyroTest.kt

@@ -1,54 +0,0 @@
-package io.unom.punktfunk.kit
-
-import android.view.Surface
-import org.junit.Assert.assertEquals
-import org.junit.Test
-
-/**
- * Pins the phone-gyro mirror's device→controller frame remap and its wire-unit constants
- * ([DeviceGyro]). Pure JVM: [Surface]'s ROTATION_* are compile-time constants and remap is
- * plain math. The matrix is derived (like the wire scale constants) — if on-glass says an axis
- * is wrong, fix [DeviceGyro.remap] AND these expectations together.
- * Run: `./gradlew :kit:testDebugUnitTest`.
- */
-class DeviceGyroTest {
-    /** A distinct value per axis so a swapped or flipped component can't cancel out. */
-    private fun remap(rotation: Int) = DeviceGyro.remap(rotation, 1f, 2f, 3f).toList()
-
-    @Test
-    fun naturalPortraitIsIdentity() = assertEquals(listOf(1f, 2f, 3f), remap(Surface.ROTATION_0))
-
-    @Test
-    fun upsideDownFlipsInPlane() = assertEquals(listOf(-1f, -2f, 3f), remap(Surface.ROTATION_180))
-
-    /** ROTATION_90 = device turned counter-clockwise, top to the player's LEFT:
-     *  player-right = device-bottom (−y), player-up = device-right (+x); z never changes. */
-    @Test
-    fun rotation90TopLeft() = assertEquals(listOf(-2f, 1f, 3f), remap(Surface.ROTATION_90))
-
-    /** ROTATION_270 = top to the player's RIGHT: player-right = +y, player-up = −x. */
-    @Test
-    fun rotation270TopRight() = assertEquals(listOf(2f, -1f, 3f), remap(Surface.ROTATION_270))
-
-    /** Every remap stays a proper (right-handed) rotation: x̂ × ŷ = ẑ after mapping. */
-    @Test
-    fun handednessPreserved() {
-        for (r in listOf(
-            Surface.ROTATION_0, Surface.ROTATION_90, Surface.ROTATION_180, Surface.ROTATION_270,
-        )) {
-            val x = DeviceGyro.remap(r, 1f, 0f, 0f)
-            val y = DeviceGyro.remap(r, 0f, 1f, 0f)
-            assertEquals("left-handed remap at rotation $r", 1f, x[0] * y[1] - x[1] * y[0], 0f)
-        }
-    }
-
-    /** The wire contract, shared with pf-client-core / the Swift client and now with every other
-     *  Android motion sender ([Gamepad.motionGyroWire]): 20 LSB/°·s means 1 rad/s ⇒ ~1145.9 raw;
-     *  1 g ⇒ 10000 raw. */
-    @Test
-    fun wireUnitConstants() {
-        assertEquals(20f * 180f / Math.PI.toFloat(), Gamepad.MOTION_GYRO_LSB_PER_RAD_S, 0f)
-        assertEquals(1145.9156f, Gamepad.MOTION_GYRO_LSB_PER_RAD_S, 0.001f)
-        assertEquals(10_000, Gamepad.MOTION_ACCEL_LSB_PER_G)
-    }
-}

clients/android/kit/src/test/kotlin/io/unom/punktfunk/kit/DsDeviceTest.kt

@@ -151,185 +151,6 @@ class DsDeviceTest {
         assertFalse(DsDevice.parseState(DsDevice.Model.DUALSHOCK4, ds4Report(), 8, s))
     }
 
-    // ---- IMU calibration (the pad's own scale factors) ----
-
-    /**
-     * A calibration feature report in the pads' USB layout: report id, three gyro bias words, six
-     * INTERLEAVED gyro plus/minus words, the two speed words, six accel plus/minus words — all
-     * little-endian i16, exactly what [DsDevice.MotionCal.parse] reads and what
-     * `crates/pf-inject/tests/motion_contract.rs` writes from the other end.
-     */
-    private fun calBlob(
-        id: Int,
-        gyroBias: IntArray,
-        gyroPlus: IntArray,
-        gyroMinus: IntArray,
-        speed: Int,
-        accelPlus: IntArray,
-        accelMinus: IntArray,
-        len: Int = 41,
-    ): ByteArray = ByteArray(len).also { b ->
-        fun put(o: Int, v: Int) {
-            b[o] = (v and 0xFF).toByte()
-            b[o + 1] = ((v shr 8) and 0xFF).toByte()
-        }
-        b[0] = id.toByte()
-        for (i in 0 until 3) {
-            put(1 + 2 * i, gyroBias[i])
-            put(7 + 4 * i, gyroPlus[i])
-            put(9 + 4 * i, gyroMinus[i])
-            put(23 + 4 * i, accelPlus[i])
-            put(25 + 4 * i, accelMinus[i])
-        }
-        put(19, speed)
-        put(21, speed)
-    }
-
-    /**
-     * A realistic DualSense blob: gyro measured at 512 °/s each way over ±8192 counts about a
-     * small factory bias — 16384/1024 = 16 raw LSB per °/s, the ≈±2000 °/s full scale a real pad
-     * has — and accel spanning about ±8192 counts (`DS_ACC_RES_PER_G`) about a per-axis zero point
-     * that is NOT zero. Both are the shape a nominal constant cannot express.
-     */
-    private fun realisticCal(): DsDevice.MotionCal = DsDevice.MotionCal.parse(
-        calBlob(
-            id = 0x05,
-            gyroBias = intArrayOf(10, -6, 3),
-            gyroPlus = intArrayOf(10 + 8192, -6 + 8192, 3 + 8192),
-            gyroMinus = intArrayOf(10 - 8192, -6 - 8192, 3 - 8192),
-            speed = 512, // speed_plus + speed_minus = 1024
-            accelPlus = intArrayOf(8300, 8200, 8000),
-            accelMinus = intArrayOf(-8100, -8192, -8384),
-        ),
-        0x05,
-    )
-
-    @Test
-    fun calibrationRescalesRawCountsOntoTheWireUnits() {
-        val cal = realisticCal()
-        // 100 °/s at this pad's 16 LSB per °/s = 1600 raw → the wire's 20 LSB per °/s = 2000.
-        for (axis in 0 until 3) {
-            assertEquals(2000, cal.gyroToWire(axis, 1600))
-            assertEquals(-2000, cal.gyroToWire(axis, -1600))
-            assertEquals(0, cal.gyroToWire(axis, 0))
-        }
-        // 1 g = the axis's zero point plus half its declared 2 g range → 10000 wire units.
-        val zero = intArrayOf(100, 4, -192) // plus − range/2, per axis
-        val oneG = intArrayOf(8300, 8200, 8000) // = accelPlus
-        for (axis in 0 until 3) {
-            assertEquals(10000, cal.accelToWire(axis, oneG[axis]))
-            assertEquals(0, cal.accelToWire(axis, zero[axis]))
-            assertEquals(-10000, cal.accelToWire(axis, zero[axis] - (oneG[axis] - zero[axis])))
-        }
-        // Both rescales are >1 here, so full-scale raw must clamp rather than wrap the i16.
-        assertEquals(32767, cal.gyroToWire(0, 30000))
-        assertEquals(-32768, cal.gyroToWire(0, -30000))
-        assertEquals(32767, cal.accelToWire(0, 30000))
-        // The capture logs this, and it is the discriminator the owed on-glass check reads: a pad
-        // whose blob was read declares its own resolution, the fallback declares the wire's.
-        assertTrue(cal.toString().startsWith("gyro 16/16/16 LSB/°·s"))
-        assertTrue(DsDevice.MotionCal.NOMINAL.toString().startsWith("gyro 20/20/20 LSB/°·s"))
-    }
-
-    /**
-     * The host's own virtual pads declare `DS_FEATURE_CALIBRATION` (`dualsense_proto.rs`) — a blob
-     * that states the wire's units exactly. Reading it back must therefore be a passthrough: if
-     * this ever stops holding, the client and the host disagree about what a motion sample means.
-     */
-    @Test
-    fun theHostsOwnBlobIsAPassthrough() {
-        val cal = DsDevice.MotionCal.parse(
-            calBlob(
-                id = 0x05,
-                gyroBias = intArrayOf(0, 0, 0),
-                gyroPlus = intArrayOf(10000, 10000, 10000),
-                gyroMinus = intArrayOf(-10000, -10000, -10000),
-                speed = 500,
-                accelPlus = intArrayOf(10000, 10000, 10000),
-                accelMinus = intArrayOf(-10000, -10000, -10000),
-            ),
-            0x05,
-        )
-        for (axis in 0 until 3) {
-            assertEquals(2000, cal.gyroToWire(axis, 2000)) // 100 °/s
-            assertEquals(10000, cal.accelToWire(axis, 10000)) // 1 g
-            assertEquals(-1234, cal.gyroToWire(axis, -1234))
-        }
-    }
-
-    /**
-     * Anything unusable keeps the pre-calibration behaviour — accel on the nominal 8192 LSB/g,
-     * gyro straight through. A pad with no readable calibration is better off slightly mis-scaled
-     * than silent, so nothing here may zero motion.
-     */
-    @Test
-    fun unusableCalibrationFallsBackInsteadOfZeroing() {
-        val degenerate = calBlob(
-            id = 0x02,
-            gyroBias = intArrayOf(0, 0, 0),
-            gyroPlus = intArrayOf(0, 0, 0),
-            gyroMinus = intArrayOf(0, 0, 0),
-            speed = 0,
-            accelPlus = intArrayOf(0, 0, 0),
-            accelMinus = intArrayOf(0, 0, 0),
-            len = 37,
-        )
-        val cals = listOf(
-            DsDevice.MotionCal.NOMINAL,
-            DsDevice.MotionCal.parse(null, 0x05), // the GET_REPORT failed
-            DsDevice.MotionCal.parse(ByteArray(8) { if (it == 0) 0x05 else 0 }, 0x05), // short reply
-            DsDevice.MotionCal.parse(degenerate, 0x02), // a clone pad's zeroes
-            DsDevice.MotionCal.parse(degenerate, 0x05), // someone else's report id
-        )
-        for (cal in cals) {
-            for (axis in 0 until 3) {
-                assertEquals(1234, cal.gyroToWire(axis, 1234)) // passthrough
-                assertEquals(10000, cal.accelToWire(axis, 8192)) // 8192 raw LSB = 1 g
-                assertEquals(-10000, cal.accelToWire(axis, -8192))
-            }
-        }
-    }
-
-    /** The parse applies the calibration at the motion offsets, per model, and defaults to nominal. */
-    @Test
-    fun parseStateAppliesTheCalibration() {
-        val cal = realisticCal()
-        // DS5: gyro at [16..22), accel at [22..28). Pitch = 1600 raw (100 °/s), accel z = 8000 (1 g).
-        val ds5 = ds5Report {
-            it[16] = 0x40; it[17] = 0x06 // 1600
-            it[26] = 0x40; it[27] = 0x1F // 8000
-        }
-        val five = DsDevice.State()
-        assertTrue(DsDevice.parseState(DsDevice.Model.DUALSENSE, ds5, 64, five, cal))
-        assertEquals(2000, five.gyro[0])
-        assertEquals(10000, five.accel[2])
-        // DS4: gyro at [13..19), accel at [19..25). Same numbers, same answers.
-        val ds4 = ds4Report {
-            it[13] = 0x40; it[14] = 0x06
-            it[23] = 0x40; it[24] = 0x1F
-        }
-        val four = DsDevice.State()
-        assertTrue(DsDevice.parseState(DsDevice.Model.DUALSHOCK4, ds4, 64, four, cal))
-        assertEquals(2000, four.gyro[0])
-        assertEquals(10000, four.accel[2])
-        // No calibration argument = the nominal fallback: gyro through, accel ×10000/8192.
-        val nominal = DsDevice.State()
-        assertTrue(DsDevice.parseState(DsDevice.Model.DUALSENSE, ds5, 64, nominal))
-        assertEquals(1600, nominal.gyro[0])
-        assertEquals(8000L * 10000 / 8192, nominal.accel[2].toLong())
-    }
-
-    /** Each model asks for the feature report its firmware actually serves over USB. */
-    @Test
-    fun calibrationReportIdentityPerModel() {
-        assertEquals(0x05, DsDevice.Model.DUALSENSE.calReportId)
-        assertEquals(41, DsDevice.Model.DUALSENSE.calReportLen)
-        assertEquals(0x05, DsDevice.Model.DUALSENSE_EDGE.calReportId)
-        assertEquals(41, DsDevice.Model.DUALSENSE_EDGE.calReportLen)
-        assertEquals(0x02, DsDevice.Model.DUALSHOCK4.calReportId)
-        assertEquals(37, DsDevice.Model.DUALSHOCK4.calReportLen)
-    }
-
     // ---- output builders (offsets = the host parser's: `parse_ds_output` / `parse_ds4_output`) ----
 
     @Test

clients/android/kit/src/test/kotlin/io/unom/punktfunk/kit/MotionCalHandoffTest.kt

@@ -1,152 +0,0 @@
-package io.unom.punktfunk.kit
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertSame
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * The claim/read hand-off that lets [DsCapture] read a pad's motion calibration off the claiming
- * thread. Two things are pinned here, and both are about the gap before the read comes back.
- *
- * What the gap DOES: the pad streams, scaled by the nominal calibration — the behaviour that
- * shipped before the read existed. What it must NOT do: inherit the previous pad's factory numbers
- * (calibration is per unit), or accept a read that outlived its claim, which an unplug, a stop, or
- * a re-claim can all cause.
- */
-class MotionCalHandoffTest {
-    /**
-     * A calibration whose gyro reads [rawLsbPerDegS] raw LSB per °/s and whose accel sits at
-     * [accelZero] raw counts at 0 g, so two of them are told apart by what they DO — identity
-     * alone would let a regression that returns the wrong instance still look right.
-     */
-    private fun cal(rawLsbPerDegS: Int, accelZero: Int = 0): DsDevice.MotionCal {
-        val speed = 500 // speed_plus = speed_minus, so speed_2x = 1000
-        val span = rawLsbPerDegS * 1000 // |plus − bias| + |minus − bias| = span
-        val blob = ByteArray(41)
-        fun put(o: Int, v: Int) {
-            blob[o] = (v and 0xFF).toByte()
-            blob[o + 1] = ((v shr 8) and 0xFF).toByte()
-        }
-        blob[0] = 0x05
-        for (i in 0 until 3) {
-            put(7 + 4 * i, span / 2) // gyro plus
-            put(9 + 4 * i, -span / 2) // gyro minus
-            put(23 + 4 * i, accelZero + 8192) // accel plus / minus: 8192 raw LSB per g
-            put(25 + 4 * i, accelZero - 8192)
-        }
-        put(19, speed)
-        put(21, speed)
-        return DsDevice.MotionCal.parse(blob, 0x05)
-    }
-
-    /** One DS5 input report: cross held, sticks centred, gyro pitch 1600 raw, accel z 8000 raw. */
-    private fun report(): ByteArray = ByteArray(64).also {
-        it[0] = 0x01
-        it[1] = 0x80.toByte(); it[2] = 0x80.toByte(); it[3] = 0x80.toByte(); it[4] = 0x80.toByte()
-        it[8] = (0x08 or 0x20).toByte() // hat neutral | cross
-        it[16] = 0x40; it[17] = 0x06 // gyro pitch = 1600
-        it[26] = 0x40; it[27] = 0x1F // accel z = 8000
-        it[33] = 0x80.toByte(); it[37] = 0x80.toByte() // no touch contacts
-    }
-
-    @Test
-    fun `a claim scales nominally until its read lands`() {
-        val h = MotionCalHandoff()
-        assertSame(DsDevice.MotionCal.NOMINAL, h.effective)
-        val claim = h.begin()
-        assertSame("the read is in flight — scale nominally, do not wait", DsDevice.MotionCal.NOMINAL, h.effective)
-        val read = cal(16)
-        assertTrue(h.publish(claim, read))
-        assertSame(read, h.effective)
-    }
-
-    /**
-     * The whole point of scaling nominally instead of holding reports back: a pad answers its
-     * buttons from the first report, and only its motion changes when the calibration arrives.
-     */
-    @Test
-    fun `a report in the gap is forwarded, nominally scaled, and rescales once the read lands`() {
-        val h = MotionCalHandoff()
-        val claim = h.begin()
-        val r = report()
-
-        val gap = DsDevice.State()
-        assertTrue(
-            "a report must still be parsed while the read is in flight",
-            DsDevice.parseState(DsDevice.Model.DUALSENSE, r, 64, gap, h.effective),
-        )
-        assertEquals("buttons reach the wire immediately", Gamepad.BTN_A, gap.buttons)
-        assertEquals("and so do sticks", 128, gap.lsX)
-        assertEquals("nominal gyro is the raw count", 1600, gap.gyro[0])
-        assertEquals("nominal accel is ×10000/8192", 8000L * 10000 / 8192, gap.accel[2].toLong())
-
-        assertTrue(h.publish(claim, cal(16, accelZero = 100)))
-        val live = DsDevice.State()
-        assertTrue(DsDevice.parseState(DsDevice.Model.DUALSENSE, r, 64, live, h.effective))
-        assertEquals("buttons do not depend on the calibration", gap.buttons, live.buttons)
-        assertEquals("1600 raw at 16 LSB/°·s = 100 °/s = 2000 wire", 2000, live.gyro[0])
-        assertNotEquals("the same raw report must convert differently now", gap.gyro[0], live.gyro[0])
-        assertNotEquals(gap.accel[2], live.accel[2])
-    }
-
-    @Test
-    fun `a read that outlived its claim publishes nothing`() {
-        val h = MotionCalHandoff()
-        val claim = h.begin()
-        h.end() // unplug, or DsCapture.stop, while the read was in flight
-        assertFalse("a straggler may not publish into a dead claim", h.publish(claim, cal(16)))
-        assertSame(DsDevice.MotionCal.NOMINAL, h.effective)
-    }
-
-    @Test
-    fun `a new claim scales nominally rather than inheriting the previous pad's calibration`() {
-        val h = MotionCalHandoff()
-        val first = h.begin()
-        val hot = cal(4, accelZero = 400) // a pad reading 4 raw LSB per °/s, well off nominal
-        assertTrue(h.publish(first, hot))
-        assertSame(hot, h.effective)
-
-        // Re-claimed without an end() in between — the pad was swapped while a read was in flight.
-        val second = h.begin()
-        assertNotEquals(first, second)
-        assertSame(
-            "the next pad starts on the nominal scaling, NOT the last pad's factory numbers",
-            DsDevice.MotionCal.NOMINAL,
-            h.effective,
-        )
-        assertFalse("the first pad's read may not scale the second pad", h.publish(first, hot))
-        assertSame(DsDevice.MotionCal.NOMINAL, h.effective)
-
-        // And that fallback is a real difference, not two names for the same numbers: the inherited
-        // calibration would have turned this pad's motion into something else entirely.
-        val r = report()
-        val nominal = DsDevice.State()
-        val inherited = DsDevice.State()
-        DsDevice.parseState(DsDevice.Model.DUALSENSE, r, 64, nominal, h.effective)
-        DsDevice.parseState(DsDevice.Model.DUALSENSE, r, 64, inherited, hot)
-        assertNotEquals(inherited.gyro[0], nominal.gyro[0])
-        assertNotEquals(inherited.accel[2], nominal.accel[2])
-
-        val slow = cal(32)
-        assertTrue(h.publish(second, slow))
-        assertSame(slow, h.effective)
-    }
-
-    @Test
-    fun `ending a claim twice still refuses every outstanding token`() {
-        val h = MotionCalHandoff()
-        val claim = h.begin()
-        h.end() // DsCapture.stop
-        h.end() // …and the unplug that followed it
-        assertFalse(h.publish(claim, cal(16)))
-        assertSame(DsDevice.MotionCal.NOMINAL, h.effective)
-        val next = h.begin()
-        assertNotEquals(claim, next)
-        val read = cal(16)
-        assertTrue(h.publish(next, read))
-        assertSame(read, h.effective)
-    }
-}

clients/android/kit/src/test/kotlin/io/unom/punktfunk/kit/PadSensorsTest.kt

@@ -1,92 +0,0 @@
-package io.unom.punktfunk.kit
-
-import org.junit.Assert.assertArrayEquals
-import org.junit.Assert.assertEquals
-import org.junit.Test
-
-/**
- * Pins the unit scaling and the axis mapping of the controller-sensor path ([PadSensors]) and the
- * shared converters it goes through ([Gamepad.motionGyroWire] / [Gamepad.motionAccelWire]). Pure
- * JVM — the two `*ToWire` functions take plain float arrays and touch no Android class.
- *
- * The scale is MEASURED FACT (`punktfunk_core::input::gamepad`: 20 LSB/°·s, 10000 LSB/g) and must
- * not drift. The axis mapping is straight through and NOT yet verified against hardware — see
- * [PadSensors.gyroToWire] for the measurement that would settle it. [straightThroughFrame] exists
- * to make a future remap a deliberate, visible edit rather than a quiet one.
- * Run: `./gradlew :kit:testDebugUnitTest`.
- */
-class PadSensorsTest {
-    private fun gyro(x: Float, y: Float, z: Float) =
-        IntArray(3).also { PadSensors.gyroToWire(floatArrayOf(x, y, z), it) }
-
-    private fun accel(x: Float, y: Float, z: Float) =
-        IntArray(3).also { PadSensors.accelToWire(floatArrayOf(x, y, z), it) }
-
-    /** 20 LSB/°·s from Android's rad/s: π rad/s is exactly 180 °/s, so exactly 3600 raw. */
-    @Test
-    fun gyroScaleFromRadiansPerSecond() {
-        assertEquals(3600, gyro(Math.PI.toFloat(), 0f, 0f)[0])
-        assertEquals(-3600, gyro(-Math.PI.toFloat(), 0f, 0f)[0])
-        assertEquals(1146, gyro(1f, 0f, 0f)[0]) // 1 rad/s ⇒ 1145.9156, rounded
-        assertEquals(0, gyro(0f, 0f, 0f)[0])
-    }
-
-    /** 10000 LSB/g from Android's m/s²: standard gravity is exactly 1 g. Android reports specific
-     *  force, so a pad at rest reads +1 g on the axis pointing up — no sign flip anywhere. */
-    @Test
-    fun accelScaleFromMetresPerSecondSquared() {
-        assertEquals(10_000, accel(0f, Gamepad.GRAVITY, 0f)[1])
-        assertEquals(-10_000, accel(0f, -Gamepad.GRAVITY, 0f)[1])
-        assertEquals(0, accel(0f, 0f, 0f)[1])
-    }
-
-    /** A controller lying flat and still lands exactly on the host's neutral for a virtual
-     *  DualSense — 1 g on wire slot 1 (`punktfunk-core` `MOTION_NEUTRAL_ACCEL = [0, 10000, 0]`),
-     *  not the [0,0,0] that means free fall. */
-    @Test
-    fun restingPadIsTheHostNeutral() {
-        assertArrayEquals(intArrayOf(0, 10_000, 0), accel(0f, Gamepad.GRAVITY, 0f))
-    }
-
-    /**
-     * The frame: component i of the sensor sample becomes component i of the wire triple, for both
-     * planes, with no permutation and no negation. UNVERIFIED against hardware — if a Bluetooth
-     * DualSense says otherwise, the remap goes into [PadSensors.gyroToWire] and this test changes
-     * with it. Distinct magnitudes per axis so a swap or a flip cannot cancel out.
-     */
-    @Test
-    fun straightThroughFrame() {
-        assertArrayEquals(intArrayOf(1146, 2292, 3438), gyro(1f, 2f, 3f))
-        assertArrayEquals(
-            intArrayOf(10_000, 20_000, -30_000),
-            accel(Gamepad.GRAVITY, 2f * Gamepad.GRAVITY, -3f * Gamepad.GRAVITY),
-        )
-    }
-
-    /** Both planes clamp to signed 16 bits rather than wrapping — a flick past 1638 °/s or a knock
-     *  past 3.27 g saturates, where a wrap would send a full-speed rotation the other way. */
-    @Test
-    fun clampsToSigned16() {
-        assertArrayEquals(intArrayOf(32767, -32768, 32767), gyro(100f, -100f, 1e9f))
-        assertArrayEquals(intArrayOf(32767, -32768, 32767), accel(1000f, -1000f, 1e9f))
-    }
-
-    /** Rounds to nearest rather than truncating: a truncating converter loses up to a whole LSB
-     *  off every sample, always toward zero, and a gyro whose every sample is biased the same way
-     *  is a gyro that drifts. */
-    @Test
-    fun roundsToNearestNotTowardZero() {
-        assertEquals(1, gyro(0.0006f, 0f, 0f)[0]) // 0.688 raw — truncation would say 0
-        assertEquals(-1, gyro(-0.0006f, 0f, 0f)[0])
-        assertEquals(1, accel(0.0007f, 0f, 0f)[0]) // 0.714 raw
-    }
-
-    /** A sensor that hands back fewer than three components (or none — the framework reuses one
-     *  array across types) contributes zero rather than throwing on the sensor thread. */
-    @Test
-    fun shortSampleIsZeroFilled() {
-        val out = IntArray(3) { 7 }
-        PadSensors.gyroToWire(floatArrayOf(Math.PI.toFloat()), out)
-        assertArrayEquals(intArrayOf(3600, 0, 0), out)
-    }
-}

clients/android/native/src/audio.rs

@@ -20,16 +20,6 @@
 //! (2) is now the SHARED `punktfunk_core::audio::JitterPolicy` at `JitterTuning::AAUDIO`, which also
 //! fixed what this ring was missing: it had a hard cap but nothing that walked the depth back down,
 //! so drift and arrival bursts raised latency permanently and Android settled on its ceiling.
-//!
-//! It is also **A/V synchronised** (`design/audio-latency-overhaul.md`): the decode thread reads the
-//! host capture `pts_ns` every `AudioPacket` has always carried, compares where this frame will
-//! actually play against where the picture it belongs with reached glass
-//! (`decode::DisplayTracker` publishes that), and asks the ring for a depth that closes the gap.
-//! Only ASKS — `JitterPolicy` clamps the request between its own underrun-driven floor and the hard
-//! cap, so continuity outranks sync and a link whose jitter genuinely needs more buffer than the
-//! picture is away keeps its buffer, with the residual reported on the HUD instead of taken out of
-//! the listener's stream. With no video reference (below API 33 there are no render callbacks, so
-//! nothing confirms a present) the target stays `None` and the ring behaves exactly as it did.
 
 use ndk::audio::{
     AudioCallbackResult, AudioContentType, AudioDirection, AudioFormat, AudioPerformanceMode,
@@ -44,14 +34,6 @@ use std::sync::mpsc::{sync_channel, Receiver, SyncSender, TrySendError};
 use std::sync::Arc;
 use std::time::Duration;
 
-/// What one playback open attempt yields: the stream, plus both halves of the PCM hand-off — the
-/// sender the decode thread fills and the receiver that returns drained buffers for refill.
-///
-/// Named rather than written inline because the closure's return type trips
-/// `clippy::type_complexity`, which the Android target is now linted for (`:kit:cargoNdkClippy`)
-/// after years of nothing checking it.
-type OpenedPlayback = ndk::audio::Result<(AudioStream, SyncSender<Vec<f32>>, Receiver<Vec<f32>>)>;
-
 const SAMPLE_RATE: i32 = 48_000;
 /// Decoded-chunk hand-off depth: 64 × 5 ms = 320 ms slack (matches the core's AUDIO_QUEUE).
 const RING_CHUNKS: usize = 64;
@@ -112,45 +94,15 @@ impl AudioDec {
 
 /// Diagnostics — written by the decode thread + the realtime callback, logged periodically. The
 /// audio analogue of the video `fed`/`rendered` counters (we can't "screenshot" sound).
-///
-/// The ring's DEPTH is not here: the A/V sync loop needs the same number in the same units, so it
-/// is published once through [`punktfunk_core::audio::AudioSyncCell`] and read from there by the
-/// log line below. One publisher, one reading — a second copy is a second thing to go stale.
 #[derive(Default)]
 struct Counters {
     opus_decoded: AtomicU64, // Opus packets decoded OK (~200/s at 5 ms frames)
     pcm_written: AtomicU64,  // PCM frames copied out to AAudio (device clock is pulling)
     underruns: AtomicU64,    // callbacks that emitted silence (ring not primed / drained)
+    ring_depth: AtomicU64,   // ring sample count at the last callback
     target_ms: AtomicU64,    // the policy's LIVE target depth (it grows on this device's underruns)
 }
 
-/// Whether the A/V sync loop runs this session. `false` leaves `JitterPolicy`'s sync target at
-/// `None`, which reproduces the pre-overhaul ring behaviour exactly — the point of the hatch.
-///
-/// Two levers because Android has neither of the other clients' launch surfaces. `PUNKTFUNK_NO_AV_SYNC`
-/// keeps the contract the desktop clients document (and works when the client is driven from a
-/// shell), but an app started from the launcher inherits no such environment, so the one a field
-/// tester can actually reach is the sysprop — `adb shell setprop debug.punktfunk.no_av_sync 1`,
-/// no rebuild, exactly like `debug.punktfunk.presenter`. A loop that steers PLAYBACK has to be
-/// bisectable on the device that reports the regression, not only on the bench.
-fn av_sync_enabled() -> bool {
-    if matches!(
-        std::env::var("PUNKTFUNK_NO_AV_SYNC").as_deref(),
-        Ok("1") | Ok("true")
-    ) {
-        return false;
-    }
-    let mut buf = [0u8; 92]; // PROP_VALUE_MAX
-                             // SAFETY: __system_property_get with a valid name + PROP_VALUE_MAX buffer is always safe.
-    let n = unsafe {
-        libc::__system_property_get(
-            c"debug.punktfunk.no_av_sync".as_ptr(),
-            buf.as_mut_ptr().cast(),
-        )
-    };
-    !(n > 0 && matches!(&buf[..n as usize], b"1" | b"true"))
-}
-
 /// Owned by [`crate::session::SessionHandle`]: the live AAudio stream + the decode thread.
 pub struct AudioPlayback {
     _stream: AudioStream, // dropping it stops + closes the AAudio stream
@@ -175,15 +127,15 @@ impl AudioPlayback {
         // Worst transient the ring can hold before the policy trims it.
         let hard_cap_max = tuning.hard_cap_ms as usize * ms;
         let counters = Arc::new(Counters::default());
-        // The A/V sync hand-off: the realtime callback owns the ring (so it publishes the depth and
-        // consumes the target), the decode thread owns the timestamps (so it computes the target).
-        // Two atomics, because the callback must not block on the thread that decodes Opus.
-        let sync: Arc<punktfunk_core::audio::AudioSyncCell> = Arc::default();
 
         // One open attempt at a given sharing mode. Everything the realtime callback captures
         // (channels, ring, prime state) is rebuilt per attempt — `open_stream` consumes the builder
         // AND the callback, so nothing survives a failed try to reuse.
-        let try_open = |sharing: AudioSharingMode| -> OpenedPlayback {
+        let try_open = |sharing: AudioSharingMode| -> ndk::audio::Result<(
+            AudioStream,
+            SyncSender<Vec<f32>>,
+            Receiver<Vec<f32>>,
+        )> {
             let (tx, rx) = sync_channel::<Vec<f32>>(RING_CHUNKS);
             // Recycle free-list: drained PCM buffers go BACK to the decode thread to be refilled, so
             // the realtime callback never frees heap (Android's Scudo allocator has unbounded free()
@@ -194,7 +146,6 @@ impl AudioPlayback {
             // Realtime consumer state, owned by the callback (FnMut) — no lock: AAudio calls it from
             // a single high-priority thread, and the decode thread only touches `tx`/`free_rx`.
             let cb_counters = counters.clone();
-            let cb_sync = sync.clone();
             // Pre-reserve the ring so `extend` never reallocates on the realtime thread. Worst
             // transient before the trim below = the hard cap plus one full channel of 5 ms (480-f32)
             // frames — the punktfunk protocol always sends 5 ms Opus frames (host `audio_thread`); a
@@ -220,13 +171,6 @@ impl AudioPlayback {
                     ring.extend(chunk.drain(..));
                     let _ = free_tx.try_send(chunk);
                 }
-                // A/V sync: take whatever depth the decode thread's sync loop last asked for, and
-                // publish where the ring actually is so it can measure the result. The policy
-                // clamps the request between its own underrun floor and the hard cap — continuity
-                // outranks sync, always (see `JitterPolicy::set_sync_target`). Read AFTER the
-                // drain, so the depth is everything a frame queued right now must wait behind.
-                policy.set_sync_target(cb_sync.target());
-                cb_sync.publish_depth(ring.len());
                 // Jitter buffer: the shared policy decides prime/silence, trims a burst, and —
                 // new here — sheds ONE crossfaded 5 ms frame when the depth average has sat above
                 // target long enough to be drift rather than jitter. Without that shed this ring
@@ -257,6 +201,9 @@ impl AudioPlayback {
                 // No-op while un-primed, so a deliberate priming silence is never counted as an
                 // underrun (which would otherwise drive the adaptive floor up for no reason).
                 policy.note_read(ran_short);
+                cb_counters
+                    .ring_depth
+                    .store(ring.len() as u64, Ordering::Relaxed);
                 cb_counters
                     .target_ms
                     .store(policy.target_ms() as u64, Ordering::Relaxed);
@@ -356,7 +303,7 @@ impl AudioPlayback {
         let sd = shutdown.clone();
         let join = std::thread::Builder::new()
             .name("pf-audio".into())
-            .spawn(move || decode_loop(client, tx, free_rx, sd, counters, channels, sync))
+            .spawn(move || decode_loop(client, tx, free_rx, sd, counters, channels))
             .ok();
 
         Some(AudioPlayback {
@@ -387,7 +334,6 @@ fn decode_loop(
     shutdown: Arc<AtomicBool>,
     counters: Arc<Counters>,
     channels: usize,
-    sync: Arc<punktfunk_core::audio::AudioSyncCell>,
 ) {
     // Fold this Opus→AAudio thread into the client's hot-thread set so the ADPF session the decode
     // thread opens also keeps audio decode on a fast core (registered before the video pump's first
@@ -408,44 +354,9 @@ fn decode_loop(
     let mut window_peak = 0f32; // loudest |sample| since the last log — tells a tone from silence
     let mut gaps = punktfunk_core::audio::AudioGapTracker::new();
     let mut frame_samples = 0usize; // per-channel samples of the last decoded frame — the PLC unit
-
-    // A/V sync (audio latency overhaul). This thread is the only place holding all three
-    // ingredients at once: the packet's host capture `pts_ns`, the ring depth (via the sync cell)
-    // and the video plane's end-to-end figure. `pts_ns` arrived in every `AudioPacket` and was
-    // dropped on the floor here for the plane's whole existence, which is why audio ran at whatever
-    // depth its jitter ring settled at with nothing ever placing it against the picture.
-    let av_sync_enabled = av_sync_enabled();
-    let mut av = punktfunk_core::audio::AvSync::new(channels as u8);
-    let video_e2e = client.video_e2e_shared();
-    let av_offset_out = client.audio_av_offset_shared();
-    let buffer_ms_out = client.audio_buffer_ms_shared();
-    if !av_sync_enabled {
-        log::info!("audio: A/V sync disabled (PUNKTFUNK_NO_AV_SYNC / debug.punktfunk.no_av_sync)");
-    }
     'pump: while !shutdown.load(Ordering::Relaxed) {
         match client.next_audio(Duration::from_millis(5)) {
             Ok(pkt) => {
-                // Place this frame against the picture it belongs with, BEFORE it is queued:
-                // `buffered_ahead` is everything that must still play first, so the depth read here
-                // is exactly what delays it.
-                let depth = sync.depth();
-                // Published unconditionally — the ring's depth is worth seeing even with sync off,
-                // and it is what makes a "the audio delay is way too high" report triageable at all.
-                buffer_ms_out.store((depth / ms.max(1)) as u32, Ordering::Relaxed);
-                if av_sync_enabled {
-                    let ve2e = video_e2e.load(Ordering::Relaxed);
-                    av.observe(punktfunk_core::audio::AvSyncObservation {
-                        pts_ns: pkt.pts_ns,
-                        now_local_ns: punktfunk_core::client::now_realtime_ns(),
-                        clock_offset_ns: client.clock_offset_now_ns(),
-                        buffered_ahead: depth,
-                        // 0 = nothing confirmed on the glass yet (no render callback below API 33,
-                        // or the stream has not presented a frame); no reference, no correction.
-                        video_e2e_ns: (ve2e > 0).then_some(ve2e),
-                    });
-                    sync.set_target(av.desired_depth(depth));
-                    av_offset_out.store(av.offset_ms() as i64, Ordering::Relaxed);
-                }
                 // Conceal lost packets (a seq gap) with libopus PLC before decoding the one that
                 // arrived: empty input synthesizes `frame_samples` of interpolation per missing
                 // packet — an inaudible fade instead of the click a hard gap makes in the ring.
@@ -493,17 +404,12 @@ fn decode_loop(
                             Err(TrySendError::Disconnected(_)) => break,
                         }
                         if count % 600 == 0 {
-                            // `av_ms` is the sync loop's smoothed placement error (+ = audio behind
-                            // the picture); 0 with sync off, or before it has a video reference.
-                            // Logged next to the depth because a deep ring on a jittery link is
-                            // correct and only the offset separates that from audio held late.
                             log::info!(
-                                "audio: opus={count} pcm_frames={} underruns={} buffer_ms={} target_ms={} av_ms={} peak={window_peak:.3}",
+                                "audio: opus={count} pcm_frames={} underruns={} buffer_ms={} target_ms={} peak={window_peak:.3}",
                                 counters.pcm_written.load(Ordering::Relaxed),
                                 counters.underruns.load(Ordering::Relaxed),
-                                (depth / ms.max(1)) as u64,
+                                counters.ring_depth.load(Ordering::Relaxed) / ms.max(1) as u64,
                                 counters.target_ms.load(Ordering::Relaxed),
-                                av.offset_ms(),
                             );
                             window_peak = 0.0;
                         }

clients/android/native/src/decode/async_loop.rs

@@ -204,15 +204,7 @@ pub(super) fn run_async(
     // SurfaceFlinger's render timestamp. `render_cb` is the callback's leaked Arc refcount,
     // reclaimed after the codec is dropped below.
     let meter = Arc::new(PresentMeter::new());
-    // The tracker also publishes each confirmed present's end-to-end into the shared cell the audio
-    // plane steers its jitter ring by (`design/audio-latency-overhaul.md`) — video is the master,
-    // and this is the only point that knows when a frame actually reached glass.
-    let tracker = DisplayTracker::new(
-        stats.clone(),
-        clock_offset.clone(),
-        client.video_e2e_shared(),
-        meter.clone(),
-    );
+    let tracker = DisplayTracker::new(stats.clone(), clock_offset.clone(), meter.clone());
     let render_cb = install_render_callback(&codec, &tracker);
 
     // The timeline presenter (see `presenter.rs`): newest-wins / smoothing store, one-in-flight

clients/android/native/src/decode/display.rs

@@ -5,7 +5,7 @@ use ndk::media::media_codec::MediaCodec;
 use ndk::native_window::NativeWindow;
 use std::collections::VecDeque;
 use std::ffi::c_void;
-use std::sync::atomic::{AtomicI64, AtomicU64, Ordering};
+use std::sync::atomic::{AtomicI64, Ordering};
 use std::sync::{Arc, Mutex};
 
 use super::latency::now_realtime_ns;
@@ -35,16 +35,6 @@ pub(super) struct DisplayTracker {
     /// loaded per callback so mid-stream re-syncs apply. Holding the handle (not the client)
     /// keeps the leaked render-callback refcount from pinning the whole session alive.
     clock_offset: Arc<AtomicI64>,
-    /// Where the AUDIO plane reads the video leg it has to land with (ns) — `displayed +
-    /// clock_offset − pts`, published on every confirmed present. Written here, read by
-    /// [`crate::audio`]'s sync loop; the two planes never touch each other directly (the presenter
-    /// must not know about audio, and the audio thread cannot see the glass).
-    ///
-    /// Published RAW. The HUD shaves the OS present floor off its shown display / end-to-end
-    /// numbers (`StatsOverlay.osFloorMs` — metrics report what Punktfunk controls), but sound has
-    /// to reach the ear when the light reaches the eye, and a floor-shaved reference would place
-    /// audio a whole latch period early on every device. Presentation policy, not physics.
-    video_e2e: Arc<AtomicU64>,
     /// Always-on latch/display accumulator for the presenter's 1 Hz `pf-present` line —
     /// independent of the HUD gate, so a HUD-off A/B stays measurable from logcat.
     meter: Arc<super::presenter::PresentMeter>,
@@ -58,13 +48,11 @@ impl DisplayTracker {
     pub(super) fn new(
         stats: Arc<crate::stats::VideoStats>,
         clock_offset: Arc<AtomicI64>,
-        video_e2e: Arc<AtomicU64>,
         meter: Arc<super::presenter::PresentMeter>,
     ) -> Arc<DisplayTracker> {
         Arc::new(DisplayTracker {
             stats,
             clock_offset,
-            video_e2e,
             meter,
             rendered: Mutex::new(VecDeque::new()),
         })
@@ -117,14 +105,7 @@ pub(super) fn install_render_callback(
         }
         let sym = libc::dlsym(lib, c"AMediaCodec_setOnFrameRenderedCallback".as_ptr());
         if sym.is_null() {
-            // No confirmed present ⇒ no `display` stage AND no reference for the audio plane's A/V
-            // sync, which then stays inert and leaves the ring exactly as it was. The release
-            // instant is NOT substituted: releases target a future vsync, so it runs a whole latch
-            // period (8-21 ms measured) ahead of glass — well outside the loop's deadband, i.e. it
-            // would place audio early on every frame while looking like it was working.
-            log::info!(
-                "decode: no render callback on this API level (<33) — no display stage, no A/V sync"
-            );
+            log::info!("decode: no render callback on this API level (<33) — no display stage");
             return None;
         }
         std::mem::transmute::<*mut c_void, SetOnFrameRenderedFn>(sym)
@@ -164,10 +145,8 @@ pub(super) unsafe fn release_render_callback(ud: *const DisplayTracker) {
 /// between the frame rendering and the (batchable) callback delivery — to subtract against the
 /// receipt/decode stamps and the host capture pts. Records the HUD's `displayed` point:
 /// `end-to-end` = capture→displayed (skew-corrected) and `display` = decoded→displayed
-/// (single-clock local) — and publishes that end-to-end figure for the audio plane to align
-/// against, which is the only place in the client that knows when a frame truly reached glass.
-/// Panic-free by construction (poison-proof lock, saturating math) — an unwind out of an
-/// `extern "C"` fn would abort the process.
+/// (single-clock local). Panic-free by construction (poison-proof lock, saturating math) — an
+/// unwind out of an `extern "C"` fn would abort the process.
 unsafe extern "C" fn on_frame_rendered(
     _codec: *mut ndk_sys::AMediaCodec,
     userdata: *mut c_void,
@@ -207,28 +186,13 @@ unsafe extern "C" fn on_frame_rendered(
     let latch_us = paired.and_then(|(_, r)| clamp(displayed_ns - r));
     // Always-on half: the presenter's pf-present line reads these with the HUD off.
     t.meter.note_latch(latch_us);
-    // The glass-to-glass figure, computed ABOVE the HUD gate: the audio plane steers its ring by it
-    // (see `video_e2e`), and a sync loop that only worked while the overlay was up would be off on
-    // the exact devices that report latency — on a Deck-class report the overlay is precisely what
-    // the field cannot reach. The cost is one relaxed load and some integer arithmetic per confirmed
-    // present (≤ the panel rate); the stats LOCK stays behind the gate, which is what that
-    // early-return was really protecting.
+    if !t.stats.enabled() {
+        return; // HUD hidden — skip the skew math + the stats lock
+    }
     let e2e_ns =
         displayed_ns + t.clock_offset.load(Ordering::Relaxed) as i128 - pts_us as i128 * 1000;
-    // Same (0, 10 s) clamp as every other e2e sample — a vendor's first render callbacks can carry
-    // a garbage `system_nano`, and here that would step the audio ring rather than just a p95.
-    let e2e_valid = e2e_ns > 0 && e2e_ns < 10_000_000_000;
-    if e2e_valid {
-        t.video_e2e.store(e2e_ns as u64, Ordering::Relaxed);
-    }
-    if !t.stats.enabled() {
-        return; // HUD hidden — skip the stats lock
-    }
-    t.stats.note_displayed(
-        e2e_valid.then_some((e2e_ns / 1000) as u64),
-        display_us,
-        latch_us,
-    );
+    let e2e_us = (e2e_ns > 0 && e2e_ns < 10_000_000_000).then_some((e2e_ns / 1000) as u64);
+    t.stats.note_displayed(e2e_us, display_us, latch_us);
 }
 
 /// React to an output-format change by signalling the stream's HDR dataspace on the Surface (SDR

clients/android/native/src/decode/sync_loop.rs

@@ -185,12 +185,9 @@ pub(super) fn run_sync(
     // render = true are parked in the tracker; the OnFrameRendered callback pairs them with
     // SurfaceFlinger's render timestamp. `render_cb` is the callback's leaked Arc refcount,
     // reclaimed after the codec is dropped below.
-    // The `video_e2e` cell is the audio plane's alignment reference (see `DisplayTracker`): this
-    // legacy loop feeds it too, so A/V sync works with "Low-latency mode" off as well.
     let tracker = DisplayTracker::new(
         stats.clone(),
         clock_offset.clone(),
-        client.video_e2e_shared(),
         std::sync::Arc::new(super::presenter::PresentMeter::new()),
     );
     let render_cb = install_render_callback(&codec, &tracker);

clients/android/native/src/decode/vsync.rs

@@ -33,21 +33,8 @@ pub(super) fn now_monotonic_ns() -> i64 {
     };
     // SAFETY: `clock_gettime` with a valid out-pointer is an always-safe syscall.
     unsafe { libc::clock_gettime(libc::CLOCK_MONOTONIC, &mut ts) };
-    // Explicit widening: `timespec`'s fields are 32-bit on armv7 (`time_t`/`c_long`) and 64-bit on
-    // arm64, so these casts are REQUIRED on one shipping ABI and redundant on the other.
-    //
-    // `:kit:cargoNdkClippy` lints both widths, so it sees the redundant half and flags it; taking
-    // its advice would break the 32-bit build, which is the ABI for the many 32-bit Google TV /
-    // Android TV boxes this client targets. `i64::from`/`.into()` do not escape it either — they
-    // just trade `unnecessary_cast` for `useless_conversion` on the 64-bit side. So the cast stays
-    // and the lint is answered here rather than in whichever build breaks first.
-    #[allow(
-        clippy::unnecessary_cast,
-        reason = "required on 32-bit ABIs; redundant only on 64-bit"
-    )]
-    {
-        ts.tv_sec as i64 * 1_000_000_000 + ts.tv_nsec as i64
-    }
+    // Explicit widening: timespec's fields are 32-bit on armv7 (time_t/c_long).
+    ts.tv_sec as i64 * 1_000_000_000 + ts.tv_nsec as i64
 }
 
 /// One upcoming frame timeline (API 33+ payload): when SurfaceFlinger expects to present the

clients/android/native/src/mic.rs

@@ -26,15 +26,6 @@ use std::sync::mpsc::{sync_channel, Receiver, RecvTimeoutError, SyncSender, TryS
 use std::sync::Arc;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
-/// What one capture open attempt yields: the stream, plus both halves of the PCM hand-off — the
-/// receiver the encode worker drains and the sender that returns emptied buffers for reuse. Note
-/// the pair is the mirror image of [`crate::audio::OpenedPlayback`]'s: here the callback produces
-/// and the worker consumes.
-///
-/// Named rather than written inline for the same reason as that one — `clippy::type_complexity`,
-/// now that the Android target is actually linted (`:kit:cargoNdkClippy`).
-type OpenedCapture = ndk::audio::Result<(AudioStream, Receiver<Vec<f32>>, SyncSender<Vec<f32>>)>;
-
 const CHANNELS: usize = 1;
 const SAMPLE_RATE: i32 = 48_000;
 /// 10 ms per channel @ 48 kHz — half the desktop clients' 20 ms frame, trading a little Opus
@@ -93,7 +84,13 @@ impl MicCapture {
 
         // One open attempt at a given sharing mode (same pattern as [`crate::audio`]: `open_stream`
         // consumes the builder AND the callback, so each try rebuilds the channels it captures).
-        let try_open = |sharing: AudioSharingMode, voice: bool| -> OpenedCapture {
+        let try_open = |sharing: AudioSharingMode,
+                        voice: bool|
+         -> ndk::audio::Result<(
+            AudioStream,
+            Receiver<Vec<f32>>,
+            SyncSender<Vec<f32>>,
+        )> {
             let (tx, rx) = sync_channel::<Vec<f32>>(RING_CHUNKS);
             // Recycle free-list, mirroring the playback path: the realtime capture callback must
             // not touch the allocator (Android's Scudo has unbounded malloc/free tail latency — an

clients/android/native/src/pad_audio.rs

@@ -408,8 +408,8 @@ pub(crate) unsafe fn self_test(fd: i32, seconds: i32, hz: i32) -> i32 {
             frame.fill(0);
             // Channels 2 and 3 are the voice coils; the speaker pair stays silent so a pass is
             // unambiguously FELT rather than merely audible.
-            for slot in frame.iter_mut().take(channels).skip(2) {
-                *slot = sample;
+            for c in 2..channels {
+                frame[c] = sample;
             }
         }
         if let Err(e) = playback.write_interleaved(&chunk) {

clients/android/native/src/session/input.rs

@@ -361,40 +361,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeSendGamepad
     );
 }
 
-/// `NativeBridge.nativePadMotionReaches(handle, declaredPref)` — whether motion sent for a pad that
-/// declared `declaredPref` (the `GamepadPref` wire byte it passed to `nativeSendGamepadArrival`) can
-/// actually reach the game, or would be decoded and dropped by a host backend with no motion plane.
-///
-/// The whole question is answered here rather than in Kotlin so the reasoning lives in exactly one
-/// place — [`punktfunk_core::config::pad_motion_reaches`], which carries the argument and the tests.
-/// A third transcription of it would be a third thing to get subtly wrong, and every way of getting
-/// it wrong is silent: too strict kills a working gyro, too lax keeps ~250 Hz of samples flowing
-/// into a host that drops every one.
-///
-/// A `0` handle answers `true` — "don't suppress" is the safe answer when we cannot tell, matching
-/// the `Auto` rule inside the predicate itself.
-#[no_mangle]
-pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativePadMotionReaches(
-    _env: JNIEnv,
-    _this: JObject,
-    handle: jlong,
-    declared_pref: jint,
-) -> jboolean {
-    if handle == 0 {
-        return 1;
-    }
-    // SAFETY: live handle per the nativeConnect/nativeClose contract; both fields are plain Copy
-    // values read behind `&self`.
-    let h = unsafe { &*(handle as *const SessionHandle) };
-    let declared =
-        punktfunk_core::config::GamepadPref::from_u8(declared_pref.clamp(0, u8::MAX as jint) as u8);
-    u8::from(punktfunk_core::config::pad_motion_reaches(
-        declared,
-        h.client.requested_gamepad,
-        h.client.resolved_gamepad,
-    ))
-}
-
 /// `NativeBridge.nativeSendGamepadRemove(handle, pad)` — signal that wire pad index `pad` was
 /// unplugged so the host tears its virtual device down. `pad` (rides `flags`) is the only field; the
 /// core stamps the per-pad seq (in the snapshot seq space, so a reordered snapshot can't resurrect the

clients/android/native/src/session/planes.rs

@@ -177,12 +177,12 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopVideo(
 }
 
 /// `NativeBridge.nativeVideoStats(handle): DoubleArray?` — drain ~1 s of decode stats for the HUD
-/// (unified stats spec, `design/stats-unification.md`). Returns 35 doubles
+/// (unified stats spec, `design/stats-unification.md`). Returns 33 doubles
 /// `[fps, mbps, e2eP50Ms, e2eP95Ms, latValid, skewCorrected, width, height, refreshHz, framesLost,
 /// bitDepth, colorPrimaries, colorTransfer, chromaFormatIdc, hostNetP50Ms, decodeP50Ms, hostP50Ms,
 /// netP50Ms, lostWindow, skippedWindow, fecWindow, framesWindow, dispValid, displayP50Ms,
 /// e2eDispP50Ms, e2eDispP95Ms, paceP50Ms, latchP50Ms, presentsWindow, presenterActive,
-/// feedP50Ms, codecP50Ms, skippedOverflowWindow, audioBufferMs, audioAvOffsetMs]`
+/// feedP50Ms, codecP50Ms, skippedOverflowWindow]`
 /// (the flags are 1.0/0.0; indexes 0–21 match the previous 22-double layout — 0–13 the original
 /// 14-double one with the latency pair re-based to the end-to-end capture→decoded headline, 14/15
 /// the stage p50s tiling it: `host+network` = capture→received, `decode` = received→decoded; 16/17
@@ -203,10 +203,7 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopVideo(
 /// received→queued (hand-off + input-slot wait) at 30 and `codec` = queued→decoded (codec-pure,
 /// from the AU's last piece) at 31, both 0.0 when no sample landed (sync loop); 32 is the
 /// parked-AU overflow subset of the window's `skipped` at 19 (decoder fell behind, vs benign
-/// newest-wins pacing); 33/34 are the AUDIO plane's latency — the playback ring's live depth in ms
-/// and the A/V sync loop's smoothed offset in ms (positive = audio behind the picture) — both live
-/// gauges rather than windowed samples, like the cumulative drop total at 9), or `null` when no
-/// decode thread is running.
+/// newest-wins pacing)), or `null` when no decode thread is running.
 /// Poll ~1 Hz from the UI; each call
 /// resets the measurement window. Not android-gated — pure `jni` + connector reads, so it links on
 /// the host build too (Kotlin only ever calls it on device).
@@ -230,7 +227,7 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeVideoStats(
             .drain(h.client.frames_dropped(), h.client.fec_recovered_shards());
         let mode = h.client.mode();
         let color = h.client.color;
-        let buf: [f64; 35] = [
+        let buf: [f64; 33] = [
             snap.fps,
             snap.mbps,
             snap.e2e_p50_ms,
@@ -284,15 +281,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeVideoStats(
             snap.feed_p50_ms,
             snap.codec_p50_ms,
             snap.skipped_overflow as f64,
-            // The audio plane's own latency (`design/audio-latency-overhaul.md`): how much decoded
-            // audio is queued ahead of the speaker, and where the A/V sync loop measures that
-            // PUTS it relative to the picture (+ = audio behind). Both, because a deep ring on a
-            // jittery link is correct behaviour and only the offset tells that apart from audio
-            // simply held late. Live gauges written by the audio thread — before this the whole
-            // plane published nothing any surface could render, so a "the audio delay is way too
-            // high" report had no instrument behind it at all.
-            h.client.audio_buffer_ms() as f64,
-            h.client.audio_av_offset_ms() as f64,
         ];
         let arr = match env.new_double_array(buf.len() as jsize) {
             Ok(a) => a,

clients/apple/Config/Info.plist

@@ -19,14 +19,6 @@
 	<array>
 		<string>_punktfunk._udp</string>
 	</array>
-	<!-- NOTE: there is deliberately NO NSAppTransportSecurity dict here. ATS stays fully ON.
-	     The host is self-signed at a user-supplied address, which default ATS can never accept
-	     (it exempts only .local, unqualified names, and RFC1918/link-local literals — notably NOT
-	     Tailscale's 100.64/10 CGNAT range), so the management API talks over MgmtTransport
-	     (Network.framework), which is outside the URL loading system and pins the host by
-	     SHA-256 fingerprint instead. That leaves cover-art CDN fetches as the app's only
-	     URLSession traffic, and they keep the full ATS policy — which is the whole reason not to
-	     reach for NSAllowsArbitraryLoads here. See MgmtTransport.swift. -->
 	<!-- Background keep-alive (opt-in, iOS/iPadOS): the ONLY sanctioned way to keep the long-lived
 	     QUIC socket + pump-thread set alive while backgrounded is the audio background mode, backed
 	     by the session's real, audible remote audio (AVAudioEngine keeps rendering). Video decode is

clients/apple/Package.resolved

@@ -1,13 +0,0 @@
-{
-  "pins" : [
-    {
-      "identity" : "glur",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/joogps/Glur.git",
-      "state" : {
-        "revision" : "ba4f05d3c9a608ec773b9305f2af6089390de68a"
-      }
-    }
-  ],
-  "version" : 2
-}

clients/apple/Package.swift

@@ -16,17 +16,6 @@ let package = Package(
         .library(name: "PunktfunkShared", targets: ["PunktfunkShared"]),
         .executable(name: "PunktfunkClient", targets: ["PunktfunkClient"]),
     ],
-    dependencies: [
-        // Progressive (gradient) backdrop blur for the form screens' trays — a real blur with no
-        // material tint stage (see GamepadTrayBlur). Pinned by REVISION, not `from:`: the
-        // GlurBackdrop product exists only on main — no release carries it (the newest tag,
-        // `1.1`, predates it, and is not three-component semver anyway, so version-based
-        // resolution stops at 1.0.4). The revision is main's head at adoption time; a revision
-        // pin stays reproducible when the branch moves.
-        .package(
-            url: "https://github.com/joogps/Glur.git",
-            revision: "ba4f05d3c9a608ec773b9305f2af6089390de68a"),
-    ],
     targets: [
         .binaryTarget(name: "PunktfunkCore", path: "PunktfunkCore.xcframework"),
         // No dependencies by design — an extension process links this alone.
@@ -62,12 +51,7 @@ let package = Package(
         // (The tvOS slide-transition package is referenced by the Xcode PROJECT only —
         // its manifest breaks SwiftPM whole-graph validation on macOS, and only the
         // Punktfunk-tvOS target links it; the #if os(tvOS) import never compiles here.)
-        .executableTarget(
-            name: "PunktfunkClient",
-            dependencies: [
-                "PunktfunkKit",
-                .product(name: "GlurBackdrop", package: "Glur"),
-            ]),
+        .executableTarget(name: "PunktfunkClient", dependencies: ["PunktfunkKit"]),
         // PunktfunkCore is a direct dep too so the wire tests can name the C ABI's
         // `PunktfunkInputEvent` / `PUNKTFUNK_INPUT_KIND_*` when asserting the gamepad byte layout.
         .testTarget(

clients/apple/Punktfunk.xcodeproj/project.pbxproj

@@ -11,12 +11,6 @@
 		BB0000000000000000000005 /* PunktfunkKit in Frameworks */ = {isa = PBXBuildFile; productRef = BB0000000000000000000006 /* PunktfunkKit */; };
 		CC0000000000000000000005 /* PunktfunkKit in Frameworks */ = {isa = PBXBuildFile; productRef = CC0000000000000000000006 /* PunktfunkKit */; };
 		DD0000000000000000000003 /* SwiftUINavigationTransitions in Frameworks */ = {isa = PBXBuildFile; productRef = DD0000000000000000000002 /* SwiftUINavigationTransitions */; };
-		EE0000000000000000000012 /* Glur in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000002 /* Glur */; };
-		EE0000000000000000000013 /* GlurBackdrop in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000003 /* GlurBackdrop */; };
-		EE0000000000000000000014 /* Glur in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000004 /* Glur */; };
-		EE0000000000000000000015 /* GlurBackdrop in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000005 /* GlurBackdrop */; };
-		EE0000000000000000000016 /* Glur in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000006 /* Glur */; };
-		EE0000000000000000000017 /* GlurBackdrop in Frameworks */ = {isa = PBXBuildFile; productRef = EE0000000000000000000007 /* GlurBackdrop */; };
 		E295569A300948B9009F939C /* WidgetKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E2955699300948B9009F939C /* WidgetKit.framework */; };
 		E295569C300948B9009F939C /* SwiftUI.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E295569B300948B9009F939C /* SwiftUI.framework */; };
 		E29556A9300948BA009F939C /* PunktfunkWidgetsExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = E2955697300948B9009F939C /* PunktfunkWidgetsExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
@@ -94,8 +88,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				AA0000000000000000000005 /* PunktfunkKit in Frameworks */,
-				EE0000000000000000000012 /* Glur in Frameworks */,
-				EE0000000000000000000013 /* GlurBackdrop in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -104,8 +96,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				BB0000000000000000000005 /* PunktfunkKit in Frameworks */,
-				EE0000000000000000000014 /* Glur in Frameworks */,
-				EE0000000000000000000015 /* GlurBackdrop in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -115,8 +105,6 @@
 			files = (
 				CC0000000000000000000005 /* PunktfunkKit in Frameworks */,
 				DD0000000000000000000003 /* SwiftUINavigationTransitions in Frameworks */,
-				EE0000000000000000000016 /* Glur in Frameworks */,
-				EE0000000000000000000017 /* GlurBackdrop in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -187,8 +175,6 @@
 			name = Punktfunk;
 			packageProductDependencies = (
 				AA0000000000000000000006 /* PunktfunkKit */,
-				EE0000000000000000000002 /* Glur */,
-				EE0000000000000000000003 /* GlurBackdrop */,
 			);
 			productName = Punktfunk;
 			productReference = AA0000000000000000000001 /* Punktfunk.app */;
@@ -215,8 +201,6 @@
 			name = "Punktfunk-iOS";
 			packageProductDependencies = (
 				BB0000000000000000000006 /* PunktfunkKit */,
-				EE0000000000000000000004 /* Glur */,
-				EE0000000000000000000005 /* GlurBackdrop */,
 			);
 			productName = "Punktfunk-iOS";
 			productReference = BB0000000000000000000001 /* Punktfunk-iOS.app */;
@@ -242,8 +226,6 @@
 			packageProductDependencies = (
 				CC0000000000000000000006 /* PunktfunkKit */,
 				DD0000000000000000000002 /* SwiftUINavigationTransitions */,
-				EE0000000000000000000006 /* Glur */,
-				EE0000000000000000000007 /* GlurBackdrop */,
 			);
 			productName = "Punktfunk-tvOS";
 			productReference = CC0000000000000000000001 /* Punktfunk-tvOS.app */;
@@ -301,7 +283,6 @@
 			packageReferences = (
 				AA000000000000000000000F /* XCLocalSwiftPackageReference "." */,
 				DD0000000000000000000001 /* XCRemoteSwiftPackageReference "swiftui-navigation-transitions" */,
-				EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */,
 			);
 			preferredProjectObjectVersion = 77;
 			productRefGroup = AA0000000000000000000008 /* Products */;
@@ -867,14 +848,6 @@
 				minimumVersion = 0.18.0;
 			};
 		};
-		EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/joogps/Glur.git";
-			requirement = {
-				kind = revision;
-				revision = ba4f05d3c9a608ec773b9305f2af6089390de68a;
-			};
-		};
 /* End XCRemoteSwiftPackageReference section */
 
 /* Begin XCSwiftPackageProductDependency section */
@@ -895,36 +868,6 @@
 			package = DD0000000000000000000001 /* XCRemoteSwiftPackageReference "swiftui-navigation-transitions" */;
 			productName = SwiftUINavigationTransitions;
 		};
-		EE0000000000000000000002 /* Glur */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = Glur;
-		};
-		EE0000000000000000000003 /* GlurBackdrop */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = GlurBackdrop;
-		};
-		EE0000000000000000000004 /* Glur */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = Glur;
-		};
-		EE0000000000000000000005 /* GlurBackdrop */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = GlurBackdrop;
-		};
-		EE0000000000000000000006 /* Glur */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = Glur;
-		};
-		EE0000000000000000000007 /* GlurBackdrop */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = EE0000000000000000000001 /* XCRemoteSwiftPackageReference "Glur" */;
-			productName = GlurBackdrop;
-		};
 		E2CAFE000000000000000002 /* PunktfunkShared */ = {
 			isa = XCSwiftPackageProductDependency;
 			productName = PunktfunkShared;

clients/apple/Punktfunk.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -1,14 +1,6 @@
 {
-  "originHash" : "bb1ce9bc6042f166bd0aad78a15081e673781d3a90fa52fd8ec8a08875878ef6",
+  "originHash" : "5d17a752eb57d190a90cbd663718ff44034b24fe0ae1baafea7677db2d49da6f",
   "pins" : [
-    {
-      "identity" : "glur",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/joogps/Glur.git",
-      "state" : {
-        "revision" : "ba4f05d3c9a608ec773b9305f2af6089390de68a"
-      }
-    },
     {
       "identity" : "objc-runtime-tools",
       "kind" : "remoteSourceControl",

clients/apple/PunktfunkWidgets/LibraryWidget.swift

@@ -1,202 +0,0 @@
-// Configurable Home-Screen / Lock-Screen library widget (kind "PunktfunkLibrary"). The user picks
-// a saved host in the widget's configuration (long-press → Edit Widget — the picker is
-// `HostEntity`'s query over the shared App-Group store, running in this extension process); a tap
-// deep-links into that host's game library via `punktfunk://browse/<uuid>` — the app's onOpenURL
-// routes it to the same library presentation every internal surface drives. No session starts
-// until a title is picked there.
-//
-// Unconfigured, it follows the most recently connected host (the same order the hosts widget
-// leads with). A configured host that no longer exists shows the empty state rather than silently
-// following a different host — a widget that says "Studio" must never open someone else's library.
-//
-// Timeline is a single `.never` entry — the app pushes reloads on store changes (HostStore →
-// WidgetCenter.reloadTimelines), exactly like the hosts widget.
-
-import AppIntents
-import SwiftUI
-import WidgetKit
-
-import PunktfunkShared
-
-// MARK: - Configuration intent
-
-/// The widget's per-instance configuration. Executes in the EXTENSION process — which is why
-/// `HostEntity` and its query live in PunktfunkShared, not the app.
-struct LibraryWidgetConfigIntent: WidgetConfigurationIntent {
-    static let title: LocalizedStringResource = "Choose Host"
-    static let description = IntentDescription("Pick whose game library this widget opens.")
-
-    @Parameter(title: "Host", description: "Leave empty to follow your most recent host.")
-    var host: HostEntity?
-}
-
-// MARK: - Timeline
-
-struct LibraryEntry: TimelineEntry {
-    let date: Date
-    /// The resolved target: the configured host if it still exists, the most recent one when
-    /// unconfigured, nil when there's nothing to open (empty store, or a removed configured host).
-    let host: StoredHost?
-}
-
-struct LibraryProvider: AppIntentTimelineProvider {
-    func placeholder(in context: Context) -> LibraryEntry {
-        LibraryEntry(date: .now, host: nil)
-    }
-
-    func snapshot(for configuration: LibraryWidgetConfigIntent, in context: Context) async
-        -> LibraryEntry {
-        LibraryEntry(date: .now, host: Self.resolve(configuration.host))
-    }
-
-    func timeline(for configuration: LibraryWidgetConfigIntent, in context: Context) async
-        -> Timeline<LibraryEntry> {
-        // Single entry, never auto-refresh: the app reloads this timeline on every store change.
-        Timeline(entries: [LibraryEntry(date: .now, host: Self.resolve(configuration.host))],
-                 policy: .never)
-    }
-
-    /// The configured host by id — nil (NOT a fallback) when it's gone; most-recent when nothing
-    /// was configured.
-    static func resolve(_ configured: HostEntity?) -> StoredHost? {
-        let hosts = HostsProvider.loadHosts() // shared-suite JSON, most-recent first
-        guard let configured else { return hosts.first }
-        return hosts.first { $0.id == configured.id }
-    }
-}
-
-// MARK: - Widget
-
-struct LibraryWidget: Widget {
-    var body: some WidgetConfiguration {
-        AppIntentConfiguration(
-            kind: "PunktfunkLibrary", intent: LibraryWidgetConfigIntent.self,
-            provider: LibraryProvider()
-        ) { entry in
-            LibraryWidgetView(entry: entry)
-                .containerBackground(.fill.tertiary, for: .widget)
-        }
-        .configurationDisplayName("Game Library")
-        .description("Jump straight into a host's game library.")
-        .supportedFamilies([.systemSmall, .accessoryCircular, .accessoryRectangular])
-    }
-}
-
-// MARK: - Views
-
-/// Deep link that opens a stored host's library.
-private func browseURL(_ host: StoredHost) -> URL {
-    DeepLink.browse(host: host.id).url
-}
-
-struct LibraryWidgetView: View {
-    @Environment(\.widgetFamily) private var family
-    let entry: LibraryEntry
-
-    var body: some View {
-        switch family {
-        case .accessoryCircular:
-            CircularLibraryView(host: entry.host)
-        case .accessoryRectangular:
-            RectangularLibraryView(host: entry.host)
-        default: // systemSmall + fallback
-            SmallLibraryView(host: entry.host)
-        }
-    }
-}
-
-private struct SmallLibraryView: View {
-    let host: StoredHost?
-    var body: some View {
-        if let host {
-            VStack(alignment: .leading, spacing: 6) {
-                Image(systemName: "square.grid.2x2.fill")
-                    .font(.title2)
-                    .foregroundStyle(Color.brand)
-                Spacer(minLength: 0)
-                Text(host.displayName)
-                    .font(.headline)
-                    .lineLimit(2)
-                Text("Game Library")
-                    .font(.caption2)
-                    .foregroundStyle(.secondary)
-            }
-            .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
-            .widgetURL(browseURL(host))
-        } else {
-            EmptyLibraryView()
-        }
-    }
-}
-
-private struct CircularLibraryView: View {
-    let host: StoredHost?
-    var body: some View {
-        ZStack {
-            AccessoryWidgetBackground()
-            Image(systemName: "square.grid.2x2.fill")
-        }
-        .widgetURL(host.map(browseURL))
-    }
-}
-
-private struct RectangularLibraryView: View {
-    let host: StoredHost?
-    var body: some View {
-        HStack {
-            Image(systemName: "square.grid.2x2.fill")
-            VStack(alignment: .leading) {
-                Text(host?.displayName ?? "Punktfunk")
-                    .lineLimit(1)
-                Text("Library")
-                    .font(.caption2)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .widgetURL(host.map(browseURL))
-    }
-}
-
-private struct EmptyLibraryView: View {
-    var body: some View {
-        VStack(spacing: 6) {
-            Image(systemName: "square.grid.2x2")
-                .font(.title2)
-                .foregroundStyle(.secondary)
-            Text("Open Punktfunk to pick a host.")
-                .font(.caption)
-                .multilineTextAlignment(.center)
-                .foregroundStyle(.secondary)
-        }
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
-    }
-}
-
-// MARK: - Previews (Xcode canvas)
-//
-// Same pattern as the hosts widget: `#Preview(as:widget:timeline:)` feeds sample entries directly,
-// so the canvas works without a paired device or saved hosts. The small preview's second entry
-// shows the empty state one timeline click away.
-
-private let previewHost = StoredHost(
-    name: "Studio", address: "192.168.1.20",
-    lastConnected: .now.addingTimeInterval(-40 * 60))
-
-#Preview("Small", as: .systemSmall) {
-    LibraryWidget()
-} timeline: {
-    LibraryEntry(date: .now, host: previewHost)
-    LibraryEntry(date: .now, host: nil)
-}
-
-#Preview("Lock Screen circular", as: .accessoryCircular) {
-    LibraryWidget()
-} timeline: {
-    LibraryEntry(date: .now, host: previewHost)
-}
-
-#Preview("Lock Screen rectangular", as: .accessoryRectangular) {
-    LibraryWidget()
-} timeline: {
-    LibraryEntry(date: .now, host: previewHost)
-}

clients/apple/PunktfunkWidgets/PunktfunkWidgetBundle.swift

@@ -15,7 +15,6 @@ import WidgetKit
 struct PunktfunkWidgetBundle: WidgetBundle {
     var body: some Widget {
         HostsWidget()
-        LibraryWidget()
         PunktfunkSessionLiveActivity()
     }
 }

clients/apple/Sources/PunktfunkClient/ContentView.swift

@@ -56,12 +56,6 @@ struct ContentView: View {
     /// Owns the Live Activity for the running session (Lock Screen / Dynamic Island). Driven from
     /// the session model's published state below; iPhone/iPad only.
     @State private var liveActivity = SessionActivityController()
-    /// The window's bottom safe-area inset (the home-indicator strip), reported by
-    /// DisplayBottomInsetProbe from UIKit's own callbacks and published as
-    /// `\.displayBottomInset` for the screens that pin a legend to the display's corner. Held
-    /// HERE and read through the environment because asking UIKit for it during a body severs
-    /// the asking view's updates on device (see the probe).
-    @State private var displayBottomInset: CGFloat = 0
     #endif
     @State private var pairingTarget: StoredHost?
     /// A fresh `pair=required`/unknown host the user tapped: drives the choice between no-PIN
@@ -105,10 +99,6 @@ struct ContentView: View {
     // with no (extended) controller attached tvOS falls back to HomeView as before.
     @ObservedObject private var gamepadManager = GamepadManager.shared
     @AppStorage(DefaultsKey.gamepadUIEnabled) private var gamepadUIEnabled = true
-    /// When the switch above takes over — "connected" (default) or "always". See
-    /// `GamepadUIEnvironment`.
-    @AppStorage(DefaultsKey.gamepadUIMode) private var gamepadUIMode =
-        GamepadUIEnvironment.modeWhenConnected
     /// Auto-wake on connect (Settings → General). On (default): a dial to an offline saved host
     /// fires Wake-on-LAN up front and falls into the "Waking…" wait if the dial fails. Off: connects
     /// go straight through with no wake. The explicit "Wake Host" action is unaffected either way.
@@ -121,27 +111,9 @@ struct ContentView: View {
     /// scenePhase drives the keep-alive: use THIS, not the willResignActive observers — resign-active
     /// also fires for Control Center / app-switcher peeks, where the disconnect timer must not start.
     @Environment(\.scenePhase) private var scenePhase
-    #if os(iOS)
-    @Environment(\.horizontalSizeClass) private var hSizeClass
-    @Environment(\.verticalSizeClass) private var vSizeClass
-    #endif
-
-    /// The gamepad UI's form-metric tier for this window, published from HERE — the app's root.
-    /// A screen that applies `gamepadPaletteInk` itself sits ABOVE its own copy of the environment,
-    /// so its `@Environment` resolves against its parent; publishing at the root is what makes
-    /// every one of them (including the ones presented as sheets and covers, which inherit the
-    /// environment) read its own window's tier instead of the bare default.
-    private var gamepadMetrics: GamepadFormMetrics {
-        #if os(iOS)
-        .forWindow(h: hSizeClass, v: vSizeClass)
-        #else
-        .platformDefault
-        #endif
-    }
     private var gamepadUIActive: Bool {
         GamepadUIEnvironment.isActive(
-            gamepadConnected: gamepadManager.active != nil, enabledSetting: gamepadUIEnabled,
-            mode: gamepadUIMode)
+            gamepadConnected: gamepadManager.active != nil, enabledSetting: gamepadUIEnabled)
     }
 
     // The body is split in two — `driven` (the screen plus its lifecycle drivers and sheets) and
@@ -204,36 +176,6 @@ struct ContentView: View {
     }
 
     private var driven: some View {
-        drivenBase
-            .environment(\.gamepadMetrics, gamepadMetrics)
-            #if os(iOS)
-            .environment(\.displayBottomInset, displayBottomInset)
-            // The probe is UIKit's, not any screen's: mounted once here as a background so the
-            // legend-pinning screens can READ the inset from the environment without ever asking
-            // UIKit during their own body (which severs their updates — see the probe).
-            .background {
-                DisplayBottomInsetProbe { displayBottomInset = $0 }
-            }
-            #endif
-            #if os(iOS) || os(macOS)
-            // The console's own modal, over WHICHEVER screen is up. Not attached to `home`, which
-            // renders only while `model.connection == nil`: a connection exists through the
-            // pair-required and approval handshakes, which is precisely when these prompts fire.
-            // It sits above the connect takeover too — the delegated-approval wait is raised
-            // DURING a dial and owns the only Cancel for it. (The takeover draws nothing in that
-            // state: `connectingOverlayName` is nil while `awaitingApproval` is set, so the two
-            // never poll the pad at once.)
-            .overlay {
-                if let prompt = consolePrompt {
-                    GamepadPromptView(prompt: prompt)
-                        .gamepadPaletteInk()
-                        .transition(.opacity)
-                }
-            }
-            #endif
-    }
-
-    private var drivenBase: some View {
         Group {
             // The stream view's structural identity MUST be stable across the
             // awaiting-trust → streaming transition: recreating it restarts the pump,
@@ -421,21 +363,8 @@ struct ContentView: View {
         // (the "Pair with PIN instead" path disconnects first — the host's accept loop
         // is sequential, a pairing connection would queue behind the live session).
         #if !os(tvOS)
-        // macOS presents BOTH pairing UIs from here, picking by mode (the console UI's screen is
-        // gamepad-navigable; PairSheet's Form is not). iOS hides this sheet in gamepad mode
-        // instead — there the pair screen is one of the shell's in-place layers, exactly like
-        // settings and add-host (see `touchPairingTarget`).
-        .sheet(item: touchPairingTarget) { host in
-            #if os(macOS)
-            if gamepadUIActive {
-                GamepadPairView(host: host, onPaired: { handlePaired(host, fingerprint: $0) })
-                    .frame(width: 660, height: 620)
-            } else {
-                PairSheet(host: host) { fingerprint in handlePaired(host, fingerprint: fingerprint) }
-            }
-            #else
+        .sheet(item: $pairingTarget) { host in
             PairSheet(host: host) { fingerprint in handlePaired(host, fingerprint: fingerprint) }
-            #endif
         }
         .sheet(item: $speedTestTarget) { host in
             SpeedTestSheet(host: host)
@@ -455,13 +384,7 @@ struct ContentView: View {
             .frame(minWidth: 940, minHeight: 620)
         }
         #else
-        // iOS: the cover is the TOUCH UI's presentation only. In gamepad mode the library is one
-        // of GamepadHomeView's in-place layers (the console shell — no bottom-up cover), so the
-        // proxy hides the target from the cover while that mode owns it; every writer (Y on a
-        // tile, `returnToLibrary`) keeps writing the same `libraryTarget` either way, and a
-        // controller arriving or leaving mid-browse hands the open library to whichever
-        // presentation the new mode owns.
-        .fullScreenCover(item: touchLibraryTarget) { host in
+        .fullScreenCover(item: $libraryTarget) { host in
             NavigationStack {
                 LibraryView(store: store, host: host, onLaunch: { launchTitle(host, $0) })
             }
@@ -475,141 +398,22 @@ struct ContentView: View {
     // budget (inline, they tip SwiftUI's per-expression limit — see the split sections idiom).
 
     private var deepLinkNoticePresented: Binding<Bool> {
-        Binding(
-            get: { deepLinkNotice != nil && !consolePromptShowing },
-            set: { if !$0 { deepLinkNotice = nil } })
-    }
-
-    /// True while the console prompt owns the modal state (see `consolePrompt`). Always false on
-    /// tvOS, whose alerts the focus engine drives natively.
-    private var consolePromptShowing: Bool {
-        #if os(iOS) || os(macOS)
-        consolePrompt != nil
-        #else
-        false
-        #endif
-    }
-
-    #if os(iOS) || os(macOS)
-    /// The modal state the console UI should present ITSELF, as a pad-navigable prompt, instead of
-    /// letting a system alert take it. `.alert`/`.confirmationDialog` are UIKit/AppKit surfaces a
-    /// controller cannot navigate, and these are not incidental prompts: "Pairing required" is the
-    /// FIRST thing an unpaired host shows, "Connection failed" strands the console UI behind a
-    /// modal only a finger can dismiss, and "Waiting for approval" owns the only Cancel for a
-    /// connect that may never complete. One at a time, most-urgent first — a system alert stack
-    /// would layer these, but a console shows one screen.
-    ///
-    /// Gated on not STREAMING, not on `model.connection == nil`: a connection object exists well
-    /// before a stream does, through exactly the handshakes these prompts belong to. Streaming is
-    /// the one case that must stay with the system alert — there the pad belongs to
-    /// `GamepadCapture` and is being forwarded to the host.
-    private var consolePrompt: GamepadPrompt? {
-        guard gamepadUIActive, model.phase != .streaming else { return nil }
-        if let req = approvalChoice {
-            return GamepadPrompt(
-                id: "pairing-required",
-                title: "Pairing required",
-                message: "\(req.host.displayName) requires pairing. Request access and approve "
-                    + "this device in the host's web console (port 47992 → Pairing) — no PIN "
-                    + "needed. Or pair with the 4-digit PIN it can display.",
-                actions: [
-                    // The follow-on presentation is deferred a tick exactly as the system dialog
-                    // does it, so this prompt is fully torn down before the next screen mounts —
-                    // two controller pollers overlapping for a frame is how one A press reaches
-                    // both.
-                    GamepadPromptAction(id: "request", title: "Request Access", isPrimary: true) {
-                        approvalChoice = nil
-                        DispatchQueue.main.async { requestAccess(req) }
-                    },
-                    GamepadPromptAction(id: "pin", title: "Pair with PIN…") {
-                        approvalChoice = nil
-                        DispatchQueue.main.async { pairingTarget = req.host }
-                    },
-                    GamepadPromptAction(id: "cancel", title: "Cancel", isCancel: true) {
-                        approvalChoice = nil
-                    },
-                ])
-        }
-        if let req = awaitingApproval {
-            return GamepadPrompt(
-                id: "awaiting-approval",
-                title: "Waiting for approval",
-                message: "Approve \u{201C}\(localDeviceName)\u{201D} in \(req.host.displayName)'s "
-                    + "web console (port 47992 → Pairing). This device connects automatically "
-                    + "once you approve it — no need to reconnect.",
-                actions: [
-                    GamepadPromptAction(id: "cancel", title: "Cancel", isCancel: true) {
-                        awaitingApproval = nil
-                        model.disconnect()
-                    },
-                ],
-                busy: true)
-        }
-        if connectionErrorReady {
-            return GamepadPrompt(
-                id: "connection-failed",
-                title: "Connection failed",
-                message: model.errorMessage ?? "",
-                actions: [
-                    GamepadPromptAction(id: "ok", title: "OK", isCancel: true) {
-                        model.errorMessage = nil
-                    },
-                ])
-        }
-        if let notice = deepLinkNotice {
-            return GamepadPrompt(
-                id: "cant-open",
-                title: "Can't open",
-                message: notice,
-                actions: [
-                    GamepadPromptAction(id: "ok", title: "OK", isCancel: true) {
-                        deepLinkNotice = nil
-                    },
-                ])
-        }
-        return nil
-    }
-    #endif
-
-    /// The iOS library cover's item: `libraryTarget`, hidden while the gamepad shell presents
-    /// the library in place (see the cover's comment).
-    private var touchLibraryTarget: Binding<StoredHost?> {
-        Binding(
-            get: { gamepadUIActive ? nil : libraryTarget },
-            set: { libraryTarget = $0 })
-    }
-
-    /// The pairing sheet's item. On iOS it hides while the gamepad shell presents the pair screen
-    /// in place — the same proxy the library uses, and for the same reason: every writer keeps
-    /// writing `pairingTarget`, and whichever presentation the current mode owns picks it up.
-    /// macOS has no shell, so the sheet stays and switches its CONTENT by mode instead.
-    private var touchPairingTarget: Binding<StoredHost?> {
-        #if os(macOS)
-        Binding(get: { pairingTarget }, set: { pairingTarget = $0 })
-        #else
-        Binding(
-            get: { gamepadUIActive ? nil : pairingTarget },
-            set: { pairingTarget = $0 })
-        #endif
+        Binding(get: { deepLinkNotice != nil }, set: { if !$0 { deepLinkNotice = nil } })
     }
 
     private var approvalChoicePresented: Binding<Bool> {
-        Binding(
-            get: { approvalChoice != nil && !consolePromptShowing },
-            set: { if !$0 { approvalChoice = nil } })
+        Binding(get: { approvalChoice != nil }, set: { if !$0 { approvalChoice = nil } })
     }
 
     private var awaitingApprovalPresented: Binding<Bool> {
-        Binding(
-            get: { awaitingApproval != nil && !consolePromptShowing },
-            set: { if !$0 { awaitingApproval = nil } })
+        Binding(get: { awaitingApproval != nil }, set: { if !$0 { awaitingApproval = nil } })
     }
 
-    /// Whether the "Connection failed" state is ready to be shown at all — shared by the system
-    /// alert and the console prompt so the two can never disagree about the macOS deferral below.
-    private var connectionErrorReady: Bool {
-        guard model.errorMessage != nil else { return false }
-        #if os(macOS)
+    private var connectionErrorPresented: Binding<Bool> {
+        Binding(
+            get: {
+                guard model.errorMessage != nil else { return false }
+                #if os(macOS)
                 // Defer the alert while a forced-fullscreen exit is still pending: a sheet
                 // attached to a fullscreen window makes AppKit drop `-toggleFullScreen:`, so
                 // presenting it now strands the window fullscreen on the home screen after a
@@ -618,14 +422,10 @@ struct ContentView: View {
                 // once the window leaves fullscreen and `isFullscreen` flips, the alert shows
                 // over the windowed home UI. Not gated when fullscreen is the user's own manual
                 // choice (opt-out setting) — nothing is auto-exiting there to conflict with.
-        if fullscreenForSession && isFullscreen { return false }
-        #endif
-        return true
-    }
-
-    private var connectionErrorPresented: Binding<Bool> {
-        Binding(
-            get: { connectionErrorReady && !consolePromptShowing },
+                if fullscreenForSession && isFullscreen { return false }
+                #endif
+                return true
+            },
             set: { if !$0 { model.errorMessage = nil } })
     }
 
@@ -668,20 +468,10 @@ struct ContentView: View {
                 ?? "That link is malformed and was ignored."
             return
         }
-        switch link.route {
-        case .connect:
-            break
-        case .browse:
-            // The reserved library route, now real: open the host's game library without starting
-            // a session. `launch=`/`profile=` are meaningless on a browse (nothing streams until a
-            // title is picked, and that connect resolves its own profile) — ignored, not refused,
-            // per the unknown-parameter rule.
-            openLibrary(from: link)
-            return
-        case .wake:
-            // Still reserved: saying so beats silently connecting instead. (Shortcuts users have
-            // the Wake Host intent, which never round-trips through a URL.)
-            deepLinkNotice = "Punktfunk links can't do “wake” yet."
+        guard link.route == .connect else {
+            // `wake` and `browse` are reserved in the grammar and parse today; this build routes
+            // neither, and saying so beats silently connecting instead.
+            deepLinkNotice = "Punktfunk links can't do “\(link.route.rawValue)” yet."
             return
         }
         // Resolve the one-off profile BEFORE anything happens: an unknown or ambiguous reference
@@ -735,38 +525,6 @@ struct ContentView: View {
         }
     }
 
-    /// `punktfunk://browse/<host-ref>` — jump into a host's game library. Drives the SAME
-    /// `libraryTarget` every internal surface writes, so the link lands in whichever presentation
-    /// the current mode owns: the gamepad console's in-place library screen, the touch cover, the
-    /// macOS sheet, or tvOS's cover. Connect's posture minus the connect itself: a pin conflict
-    /// refuses, a live session is never preempted, and an unsaved host can't be browsed — the
-    /// library fetch rides the paired mTLS identity, so there is nothing to show before the host
-    /// is saved (the notice says what to do instead).
-    private func openLibrary(from link: DeepLink) {
-        switch link.resolveHost(in: store.hosts) {
-        case .known(let host):
-            guard !link.pinConflict(with: host) else {
-                deepLinkNotice = "That link's fingerprint doesn't match the identity saved for "
-                    + "\(host.displayName). It's out of date, or it isn't pointing where it says."
-                return
-            }
-            guard model.phase == .idle else {
-                let current = model.activeHost?.displayName ?? "a host"
-                deepLinkNotice = "Already streaming \(current). End that session first."
-                return
-            }
-            libraryTarget = host
-        case .unknown(let address, _, let name, _):
-            deepLinkNotice = "\(name ?? address) isn't saved on this device yet. "
-                + "Add it with the + button first — a library can only be browsed on a saved host."
-        case .ambiguous:
-            deepLinkNotice = "More than one saved host is called “\(link.hostRef)”. "
-                + "Rename one, or link to it by its address."
-        case .unresolvable:
-            deepLinkNotice = "That host isn't saved on this device."
-        }
-    }
-
     private var home: some View {
         // The full-screen connect takeover rides over BOTH home UIs (and the pre-connect window is
         // still `home`, so it covers the whole dial → wake → online → connect sequence): instant
@@ -799,11 +557,8 @@ struct ContentView: View {
             if gamepadUIActive {
                 GamepadHomeView(
                     store: store, model: model, discovery: discovery,
-                    libraryTarget: $libraryTarget, pairingTarget: $pairingTarget,
-                    onPaired: handlePaired, waker: waker,
-                    connect: { connect($0, profile: $1) }, connectDiscovered: connectDiscovered,
-                    launchTitle: launchTitle,
-                    promptActive: consolePromptShowing)
+                    libraryTarget: $libraryTarget, waker: waker,
+                    connect: { connect($0, profile: $1) }, connectDiscovered: connectDiscovered)
             } else {
                 HomeView(
                     store: store, model: model, discovery: discovery,
@@ -818,11 +573,8 @@ struct ContentView: View {
             if gamepadUIActive {
                 GamepadHomeView(
                     store: store, model: model, discovery: discovery,
-                    libraryTarget: $libraryTarget, pairingTarget: $pairingTarget,
-                    onPaired: handlePaired, waker: waker,
-                    connect: { connect($0, profile: $1) }, connectDiscovered: connectDiscovered,
-                    launchTitle: launchTitle,
-                    promptActive: consolePromptShowing)
+                    libraryTarget: $libraryTarget, waker: waker,
+                    connect: { connect($0, profile: $1) }, connectDiscovered: connectDiscovered)
                 // On tvOS pairing/library normally present from HomeView's navigationDestinations
                 // — which aren't mounted while the gamepad launcher is up. Give the launcher its
                 // own presenters (exactly one of the two homes is mounted at a time, so these can
@@ -1012,15 +764,6 @@ struct ContentView: View {
                 // other in the seconds where they overlap.
                 .overlay(alignment: .bottom) {
                     VStack(spacing: 8) {
-                        // A forwarded pad has a gyro this session's virtual controller cannot
-                        // carry. Shown briefly at every stats tier and with the overlay off: the
-                        // failure is otherwise completely silent — the gyro just does nothing —
-                        // and the fix is a setting, so the hint has to name it. Every platform,
-                        // including tvOS, where a DualSense is an ordinary way to play.
-                        if captureEnabled, model.motionUnreachableKind != nil {
-                            MotionUnreachableBadge()
-                                .transition(.opacity.combined(with: .scale(scale: 0.9)))
-                        }
                         #if !os(tvOS)
                         // Shown for as long as the mic is muted, at every stats tier and with the
                         // overlay off — see MicMutedBadge. tvOS has no microphone to mute.
@@ -1133,7 +876,6 @@ struct ContentView: View {
     private var shortcutHintText: String {
         "Hold the remote's Back button — or L1+R1+Start+Select on a controller — to disconnect"
         + " · Touch surface moves the pointer · press clicks · Play/Pause right-clicks"
-        + " · Hold Play/Pause, or Select+X on a controller, for statistics"
     }
     private static let shortcutHintFont: CGFloat = 22 // read from the couch
     #endif

clients/apple/Sources/PunktfunkClient/Home/ConnectOverlay.swift

@@ -83,11 +83,6 @@ struct ConnectOverlay: View {
         }
     }
 
-    /// The overlay's text/glyph colour: the palette's ink in the console takeover — over a pale
-    /// aurora, literal white was the one console surface that stayed white-on-white — and white
-    /// in the touch modal, whose branch is deliberately forced dark over a black scrim.
-    private var overlayFG: Color { gamepadUI ? ink.fg : .white }
-
     @ViewBuilder private func content(_ phase: Phase) -> some View {
         // The takeover carries larger type than the compact modal.
         let titleSize: CGFloat = gamepadUI ? 24 : 19
@@ -95,24 +90,21 @@ struct ConnectOverlay: View {
         VStack(spacing: gamepadUI ? 16 : 14) {
             switch phase {
             case .connecting(let name):
-                ProgressView().controlSize(.large).tint(overlayFG)
+                ProgressView().controlSize(.large).tint(.white)
                 Text("Connecting to \(name)")
-                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(overlayFG)
+                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(.white)
                     .multilineTextAlignment(.center)
                 Text("Establishing a secure connection…")
-                    .font(.geist(bodySize, relativeTo: .caption))
-                    .foregroundStyle(overlayFG.opacity(0.6))
+                    .font(.geist(bodySize, relativeTo: .caption)).foregroundStyle(.white.opacity(0.6))
                 Button("Cancel") { onCancelConnect() }.buttonStyle(.bordered).padding(.top, 6)
             case .waking(let w) where w.timedOut:
                 Image(systemName: "moon.zzz.fill")
-                    .font(.system(size: gamepadUI ? 40 : 34))
-                    .foregroundStyle(overlayFG.opacity(0.9))
+                    .font(.system(size: gamepadUI ? 40 : 34)).foregroundStyle(.white.opacity(0.9))
                 Text("\(w.hostName) didn't wake")
-                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(overlayFG)
+                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(.white)
                     .multilineTextAlignment(.center)
                 Text("It may still be booting, or it's powered off / off this network.")
-                    .font(.geist(bodySize, relativeTo: .caption))
-                    .foregroundStyle(overlayFG.opacity(0.6))
+                    .font(.geist(bodySize, relativeTo: .caption)).foregroundStyle(.white.opacity(0.6))
                     .multilineTextAlignment(.center)
                 HStack(spacing: 12) {
                     Button("Cancel") { waker.cancel() }.buttonStyle(.bordered)
@@ -120,13 +112,12 @@ struct ConnectOverlay: View {
                 }
                 .padding(.top, 6)
             case .waking(let w):
-                ProgressView().controlSize(.large).tint(overlayFG)
+                ProgressView().controlSize(.large).tint(.white)
                 Text("Waking \(w.hostName)…")
-                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(overlayFG)
+                    .font(.geist(titleSize, .bold, relativeTo: .title3)).foregroundStyle(.white)
                     .multilineTextAlignment(.center)
                 Text("Waiting for it to come online · \(w.seconds)s")
-                    .font(.geistFixed(bodySize)).foregroundStyle(overlayFG.opacity(0.6))
-                    .monospacedDigit()
+                    .font(.geistFixed(bodySize)).foregroundStyle(.white.opacity(0.6)).monospacedDigit()
                 // A wake-only wait (no dial after) offers "Stop Waiting"; a wake-&-connect is "Cancel".
                 Button(w.connectsAfter ? "Cancel" : "Stop Waiting") { waker.cancel() }
                     .buttonStyle(.bordered).padding(.top, 6)

clients/apple/Sources/PunktfunkClient/Home/GamepadAddHostView.swift

@@ -13,18 +13,8 @@ import SwiftUI
 
 struct GamepadAddHostView: View {
     @Environment(\.gamepadInk) private var ink
-    @Environment(\.gamepadMetrics) private var metrics
-    @Environment(\.displayBottomInset) private var displayBottomInset
     @Environment(\.dismiss) private var dismiss
-    @Environment(\.gamepadHostedInShell) private var hostedInShell
     let onAdd: (StoredHost) -> Void
-    /// How the in-place shell (iOS) closes this screen; nil (the macOS sheet, the tvOS cover)
-    /// falls back to the environment dismiss. Declared AFTER `onAdd` so the existing trailing-
-    /// closure call sites keep binding to it, not to this.
-    var close: (() -> Void)?
-    /// Whether this screen owns the controller — false while the shell is mid-transition or the
-    /// connect takeover is up (see GamepadSettingsView's twin).
-    var controllerActive = true
 
     #if os(iOS)
     /// `.compact` in a landscape phone window — tighter chrome so the keyboard tray still fits.
@@ -46,51 +36,44 @@ struct GamepadAddHostView: View {
             items: rows,
             focusID: $focusID,
             onActivate: { activate(id: $0.id) },
-            onBack: { performClose() },
-            isActive: controllerActive && editing == nil
+            onBack: { dismiss() },
+            isActive: editing == nil
         ) { row, focused in
             rowView(row, focused: focused)
-                .frame(maxWidth: metrics.rowMaxWidth)
+                .frame(maxWidth: GamepadFormMetrics.rowMaxWidth)
                 .padding(.horizontal, 24)
         }
         .frame(maxWidth: .infinity)
         .safeAreaInset(edge: .top, spacing: 0) {
-            VStack(alignment: .leading, spacing: gamepadHeaderSpacing(compact: compact)) {
-                // Leading, like every gamepad heading — and no close chrome (B is the exit).
+            VStack(spacing: 4) {
                 Text("Add Host")
                     .font(.geist(gamepadTitleSize(compact: compact), .bold, relativeTo: .title))
                     .foregroundStyle(ink.fg)
                 if !compact {
                     Text("Hosts on this network appear automatically — add one by address "
                         + "for everything else.")
-                        .font(.geist(metrics.detailFont, relativeTo: .caption))
+                        .font(.geist(GamepadFormMetrics.detailFont, relativeTo: .caption))
                         .foregroundStyle(ink.fg(0.55))
-                        .multilineTextAlignment(.leading)
-                        .frame(maxWidth: metrics.rowMaxWidth * 0.72, alignment: .leading)
+                        .multilineTextAlignment(.center)
+                        .frame(maxWidth: GamepadFormMetrics.rowMaxWidth * 0.72)
                 }
             }
-            .padding(.horizontal, 24)
             .padding(.top, gamepadTitleTopPadding(compact: compact))
-            .padding(.bottom, gamepadTitleBottomPadding(compact: compact))
-            .frame(maxWidth: .infinity, alignment: .leading)
-            .background { GamepadTrayBlur(edge: .top) }
+            .padding(.bottom, compact ? 4 : 8)
+            .frame(maxWidth: .infinity)
+            .overlay(alignment: .topTrailing) { closeButton.padding(.top, 20).padding(.trailing, 20) }
+            .background { GamepadTrayScrim(edge: .top) }
         }
         .safeAreaInset(edge: .bottom, spacing: 0) {
             bottomTray
                 // Equal distance from the left and bottom edges for the legend pill (see GamepadHomeView).
                 .padding(.horizontal, compact ? 12 : 18)
-                .padding(
-                    .bottom,
-                    gamepadLegendBottomPadding(
-                        compact ? 12 : 18, tier: metrics.tier, displayBottom: displayBottomInset))
+                .padding(.bottom, compact ? 12 : 18)
                 .padding(.top, compact ? 6 : 10)
-                .background { GamepadTrayBlur(edge: .bottom) }
+                .background { GamepadTrayScrim(edge: .bottom) }
         }
         // No aurora — the same clean Liquid-Glass-over-dark base as the gamepad settings screen.
-        // Hosted in the shell, the field is the shell's (see GamepadSettingsView's twin).
-        .background {
-            if !hostedInShell { GamepadFormBackground() }
-        }
+        .background { GamepadFormBackground() }
         // Publish the palette's ink to this screen (text, glass, accent, scrims) — a
         // pale palette flips all of them, and no leaf should have to read the setting.
         .gamepadPaletteInk()
@@ -98,18 +81,6 @@ struct GamepadAddHostView: View {
         .onChange(of: port) { _, value in
             if value.count > 5 { port = String(value.prefix(5)) }
         }
-        #if !os(tvOS)
-        // The visible close ✕ is gone (a gamepad UI exits with B) — this keeps a hardware
-        // keyboard's Esc and the macOS sheet's cancel working without chrome.
-        .background {
-            Button("Cancel") { performClose() }
-                .keyboardShortcut(.cancelAction)
-                .buttonStyle(.plain)
-                .frame(width: 0, height: 0)
-                .opacity(0)
-                .accessibilityHidden(true)
-        }
-        #endif
         #if os(tvOS)
         // tvOS types with the SYSTEM fullscreen keyboard (TVTextEntry) instead of the custom
         // tray — the remote and the pad both drive it natively. Same `editing` state as the
@@ -153,38 +124,39 @@ struct GamepadAddHostView: View {
                     // binding on appear — new identity forces a rewire to the new field.
                     .id(editing)
                 GamepadHintBar(hints: [
-                    // "Type" names what A does to the key under the keyboard's cursor. There is
-                    // no tap equivalent — a touch user types by tapping the keycap itself — so
-                    // this one cell stays a label.
                     .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Type"),
-                    .init(
-                        glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Delete",
-                        action: { backspace(editing) }),
-                    .init(
-                        glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done",
-                        action: { closeKeyboard() }),
+                    .init(glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Delete"),
+                    .init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done"),
                 ])
                 .frame(maxWidth: .infinity, alignment: .leading)
             }
             .transition(.move(edge: .bottom).combined(with: .opacity))
         } else {
             GamepadHintBar(hints: [
-                .init(
-                    glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Select",
-                    action: { if let focusID { activate(id: focusID) } }),
-                .init(
-                    glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Cancel",
-                    action: { performClose() }),
+                .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Select"),
+                .init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Cancel"),
             ])
             .frame(maxWidth: .infinity, alignment: .leading)
         }
         #endif
     }
 
-    /// Close this screen through whichever mechanism presents it: the shell's layer pop on iOS,
-    /// the environment dismiss under a macOS sheet / tvOS cover.
-    private func performClose() {
-        if let close { close() } else { dismiss() }
+    /// Touch/click fallback for closing — the controller path is B, a hardware keyboard's Esc
+    /// rides the cancel action.
+    private var closeButton: some View {
+        Button { dismiss() } label: {
+            Image(systemName: "xmark")
+                .font(.system(size: GamepadFormMetrics.closeFont, weight: .semibold))
+                .foregroundStyle(ink.fg)
+                .frame(width: GamepadFormMetrics.closeSide, height: GamepadFormMetrics.closeSide)
+                .glassBackground(Circle(), interactive: true)
+                .contentShape(Circle())
+        }
+        .buttonStyle(.plain)
+        #if !os(tvOS)
+        .keyboardShortcut(.cancelAction) // unavailable on tvOS (Menu is the cancel there)
+        #endif
+        .accessibilityLabel("Cancel")
     }
 
     // MARK: - Rows
@@ -207,7 +179,7 @@ struct GamepadAddHostView: View {
     }
 
     private func rowView(_ row: Row, focused: Bool) -> some View {
-        let m = metrics
+        let m = GamepadFormMetrics.self
         return HStack(spacing: 14) {
             if row.isAction {
                 Label("Add Host", systemImage: "plus.circle.fill")
@@ -265,7 +237,7 @@ struct GamepadAddHostView: View {
                 name: name.trimmingCharacters(in: .whitespaces),
                 address: address.trimmingCharacters(in: .whitespaces),
                 port: UInt16(port) ?? 9777))
-            performClose()
+            dismiss()
         default:
             openKeyboard(id)
         }
@@ -284,15 +256,6 @@ struct GamepadAddHostView: View {
         withAnimation(.spring(response: 0.32, dampingFraction: 0.86)) { editing = nil }
     }
 
-    /// The legend's Delete cell (iOS/macOS). Applied to the field's binding rather than routed
-    /// into `GamepadKeyboard`: the keyboard's X does exactly this to the same binding, and
-    /// reaching into its state to trigger it would need a whole callback channel for one edit.
-    private func backspace(_ id: String) {
-        let binding = editingBinding(id)
-        guard !binding.wrappedValue.isEmpty else { return }
-        binding.wrappedValue.removeLast()
-    }
-
     private func editingBinding(_ id: String) -> Binding<String> {
         switch id {
         case "name": return $name

clients/apple/Sources/PunktfunkClient/Home/GamepadCarousel.swift

@@ -55,14 +55,7 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
     /// otherwise poll the SAME controller at once — driving both. The parent sets this false while
     /// something is presented on top so only the front-most carousel consumes the gamepad.
     var isActive: Bool = true
-    /// Whether the cards are worth showing off yet — the entrance holds until this is true. The
-    /// library passes "the first covers have their artwork" (see LibraryCoverflowView); anything
-    /// whose cards are ready the moment they mount leaves it alone.
-    var contentReady: Bool = true
-    /// Builds one card. The `CardEntrance` handed along is the card's share of the strip's
-    /// arrival, and the caller MUST apply it (`.modifier(entrance)`) *underneath* its own
-    /// `.scrollTransition` — see `CardEntrance` for why that placement is load-bearing.
-    @ViewBuilder let card: (Item, CardEntrance) -> Card
+    @ViewBuilder let card: (Item) -> Card
 
     @State private var input = GamepadMenuInput(manager: .shared)
     @State private var haptics = MenuHaptics(manager: .shared)
@@ -90,26 +83,6 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
     /// confirm and end-stop events (moves trigger on `cursor`).
     @State private var activateTick = 0
     @State private var boundaryTick = 0
-    /// The strip's entrance, as ONE timeline: 0 = every card still away, 1 = every card landed
-    /// (see `CardEntrance`, which slices its own window out of this). Animated exactly once per
-    /// mount — a strip that re-played its entrance every time a screen popped off the top of it
-    /// would be noise, and the shell's push/pop carries that motion already. So it plays when a
-    /// screen is entered: the launcher when the gamepad UI comes up, the coverflow each time the
-    /// library opens (its layer mounts fresh).
-    ///
-    /// One animated Double rather than a Bool behind per-card `.animation(_:value:)` modifiers,
-    /// because those modifiers wrap the caller's card — INCLUDING its `.scrollTransition` — and a
-    /// delayed spring flipping while the scroll view was still settling captured the transition's
-    /// own per-frame phase updates, stranding the centred card in a half-receded state until the
-    /// next scroll re-drove it. Nothing here wraps the card in an animation at all.
-    @State private var entranceProgress: Double = 0
-    /// Which card the entrance fans out from — the cursor as it stood when the strip was armed,
-    /// so a restored selection assembles around where the eye already is instead of sweeping in
-    /// from the left.
-    @State private var entranceAnchor = 0
-    /// The entrance has been scheduled; it plays exactly once per mount.
-    @State private var entranceArmed = false
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion
 
     /// Read-back from a touch drag is honoured only once the gamepad has been quiet this long
     /// (longer than a move animation, so overlapping held-stick moves never let it through).
@@ -121,27 +94,24 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
             ScrollViewReader { proxy in
                 ScrollView(.horizontal) {
                     HStack(spacing: spacing) {
-                        // Enumerated for the entrance stagger only — identity stays `item.id`,
-                        // which is what `.scrollTargetLayout()` and `scrollPosition` key on.
-                        ForEach(Array(items.enumerated()), id: \.element.id) { idx, item in
+                        ForEach(items) { item in
                             #if os(tvOS)
                             // A focusable Button per card: the focus engine does the navigating
                             // (remote swipes and pad dpad alike), select activates. The bare style
                             // below keeps the tile's own look — the `.scrollTransition` center pop
                             // is the focus treatment, since focus and center track each other.
                             Button { activate(item) } label: {
-                                card(item, entrance(idx))
+                                card(item)
                                     .frame(width: itemWidth)
                             }
                             .buttonStyle(ConsoleBareButtonStyle())
                             .focused($focusedID, equals: item.id)
                             .id(item.id)
                             #else
-                            card(item, entrance(idx))
+                            card(item)
                                 .frame(width: itemWidth)
                                 .contentShape(Rectangle())
                                 .onTapGesture { tap(item) }
-                                .id(item.id) // explicit scroll-target identity for scrollPosition
                             #endif
                         }
                     }
@@ -191,24 +161,11 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
         .sensoryFeedback(.selection, trigger: cursor)
         .sensoryFeedback(.impact(weight: .medium), trigger: activateTick)
         .sensoryFeedback(.impact(flexibility: .rigid, intensity: 0.7), trigger: boundaryTick)
-        #if os(iOS) || os(macOS)
-        // A hardware keyboard drives the same cursor as the pad — arrows step, Return activates,
-        // Esc backs out (iPad on a Magic Keyboard, couch Mac). tvOS routes arrows through the
-        // focus engine instead, which owns navigation there.
-        .gamepadKeyNavigation(
-            active: isActive,
-            onMove: { move($0) },
-            onConfirm: { activate() },
-            onBack: onBack)
-        #endif
         .onAppear {
             reconcile()
             wire()
             if isActive { input.start() }
-            armEntrance()
         }
-        // The cards became worth showing (the library's covers got their art) — play now.
-        .onChange(of: contentReady) { _, _ in armEntrance() }
         .onDisappear {
             input.stop()
             haptics.stop()
@@ -243,55 +200,9 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
         .onChange(of: items.map(\.id)) { _, _ in
             reconcile()
             wire()
-            // A strip that mounted empty (its content arrived after) still gets its entrance.
-            armEntrance()
         }
     }
 
-    // MARK: - Entrance
-
-    /// Run the entrance, once, as soon as the strip is mounted AND its cards are worth showing.
-    ///
-    /// Deferred one runloop turn ON PURPOSE: a state change made inside `onAppear` lands in the
-    /// same transaction as the view's insertion, where SwiftUI runs with animations disabled — so
-    /// the cards would simply BE there. Note the failure mode is benign either way: progress
-    /// reaching 1 without animating leaves every card at exact identity, never stranded.
-    private func armEntrance() {
-        guard !entranceArmed, contentReady, !items.isEmpty else { return }
-        entranceArmed = true
-        // After `reconcile`, so the fan-out anchors on the seeded/restored cursor.
-        entranceAnchor = cursor
-        // Not just the next runloop turn (a change made inside `onAppear` lands in the
-        // insertion's transaction, where animations are disabled) but a couple of frames: the
-        // GeometryReader's first pass can report no width at all, so the strip has to lay out
-        // for real and the scroll view has to centre itself on the cursor before this starts.
-        // Cards are invisible until then (progress 0 ⇒ opacity 0), so the wait never shows.
-        DispatchQueue.main.asyncAfter(deadline: .now() + 0.05) {
-            // Linear on purpose: the master timeline is a clock, and each card eases its OWN
-            // slice of it (see `CardEntrance`) — a spring here would warp every card's curve.
-            withAnimation(
-                reduceMotion ? .easeOut(duration: 0.28) : .linear(duration: CardEntrance.total)
-            ) {
-                entranceProgress = 1
-            }
-        }
-    }
-
-    /// The card's share of the strip's entrance: it swings in on the drum, the anchored card
-    /// landing first and its neighbours fanning outward to either side.
-    private func entrance(_ idx: Int) -> CardEntrance {
-        // Capped so a several-hundred-title library never queues a card behind a visibly long
-        // wait — everything past the cap lands together, well off-screen anyway.
-        let delay = min(CardEntrance.maxDelay, Double(abs(idx - entranceAnchor)) * 0.07)
-        return CardEntrance(
-            progress: entranceProgress,
-            start: delay / CardEntrance.total,
-            // Never zero: the anchor is the card the eye is ON, so it must swing like the rest —
-            // giving it "no rotation" left the one card you actually watch merely sliding up.
-            side: idx < entranceAnchor ? -1 : 1,
-            reduceMotion: reduceMotion)
-    }
-
     // MARK: - Input wiring
 
     private func wire() {
@@ -435,105 +346,4 @@ struct GamepadCarousel<Item: Identifiable, Card: View>: View where Item.ID: Hash
         withAnimation(.spring(response: 0.34, dampingFraction: 0.7).delay(0.1)) { bumpOffset = 0 }
     }
 }
-
-/// How a card arrives when its strip does: turned away on the drum, small, low and invisible —
-/// then it swings flat, grows and rises into place on a spring soft enough to overshoot. Cards to
-/// the left of the anchor hinge on their trailing edge and cards to its right on their leading
-/// one, so the strip FANS OPEN from the cursor rather than sweeping past it; the anchor card
-/// itself only grows, since it is already facing you. Each card carries its own delay (see
-/// `entrance(_:)`) — that stagger is what makes the strip read as one gesture instead of a
-/// simultaneous flash, and it is the same hinge language the coverflow's own recede speaks, so the
-/// arrival and the scrolling feel like one object.
-///
-/// ⚠️ APPLY THIS UNDERNEATH THE CARD'S OWN `.scrollTransition`, never around it. A scroll
-/// transition derives its phase from the geometry of the view it wraps, so an entrance layered
-/// on the OUTSIDE moves the very thing the transition is measuring: every card read as far from
-/// centre for the whole travel, its phase pinned at fully-receded, and the centred card only
-/// collapsed into its focused look as the entrance ended — arriving as a jump. Underneath, the
-/// transition measures a card that never moves and simply composes its own scale/rotation on top.
-///
-/// ⚠️ NO `rotation3DEffect` HERE, however much the drum language invites one. It was the cause of
-/// the strip's "flash as the cards settle": a real 3D transform renders the card through an
-/// offscreen layer, and a card carries translucent glass, which resolves differently in there —
-/// so every card sat at the wrong fill for as long as the master animation ran and then snapped
-/// to its true one in a SINGLE frame the moment SwiftUI dropped that layer.
-///
-/// Measured on an iPad Pro 13": the centred tile held #4a3d87 for twelve frames in which nothing
-/// moved, then stepped to #423970 (−23 blue) in one. It is the ANIMATION ending, not the motion:
-/// stretching the timeline from 1.02 s to 2.82 s moved the step from 0.70 s to 2.50 s after the
-/// launcher appeared — the same 0.32 s before the end both times. Removing the rotation removed
-/// the step outright; `compositingGroup()` above or below the transforms did nothing.
-///
-/// So the turn is PROJECTED instead: `cos(angle)` as a horizontal squeeze is exactly the
-/// orthographic projection of a Y-axis rotation, hinged on the edge the card fans from. Affine,
-/// so no offscreen pass and no layer to drop — and it reads as the same gesture, losing only the
-/// perspective trapezoid, which at these card sizes was never what sold the motion.
-///
-/// Transforms only — nothing here touches layout, so the scroll view's snapping and the tvOS
-/// focus engine are untouched either. Reduce Motion drops every bit of travel for a plain,
-/// unstaggered cross-fade.
-struct CardEntrance: ViewModifier, Animatable {
-    /// How long ONE card takes to travel, and the most any card waits before it starts.
-    static let perCard: Double = 0.6
-    static let maxDelay: Double = 0.42
-    /// The master timeline the carousel animates 0 → 1.
-    static var total: Double { perCard + maxDelay }
-
-    /// The interpolated master progress. `Animatable` is the whole point: SwiftUI hands this
-    /// modifier a fresh value every frame and re-runs `body`, so the card's transforms are a pure
-    /// FUNCTION of the clock. No `.animation` modifier wraps the card, so nothing here can catch
-    /// the caller's `.scrollTransition` mid-scroll and strand it.
-    var progress: Double
-    /// Where this card's window opens on that timeline, 0…1.
-    let start: Double
-    /// Which way the card swings in: -1 hinged on its trailing edge (it sits left of the anchor),
-    /// +1 hinged on its leading edge (right of it). Never 0 — every card turns, including the
-    /// centred one.
-    let side: Double
-    let reduceMotion: Bool
-
-    var animatableData: Double {
-        get { progress }
-        set { progress = newValue }
-    }
-
-    func body(content: Content) -> some View {
-        // This card's own 0…1, sliced out of the master clock.
-        let span = Self.perCard / Self.total
-        let raw = min(max((progress - start) / span, 0), 1)
-        // The travel eases out with a whisker of overshoot, so a card settles rather than stops.
-        let travel = Self.easeOutBack(raw)
-        // The fade is FAR quicker than the travel — it finishes in the first third of the window.
-        // Sharing one curve meant the card spent its whole swing at near-zero opacity and only
-        // the last few degrees ever showed, which is why this read as a small slide.
-        let fade = Self.easeOut(min(raw / 0.34, 1))
-        // Deep turn, well down, well shrunk — the card is genuinely edge-on and travelling. The
-        // sign matches the coverflow's own recede (right of centre turns negative about its
-        // leading edge), so the arrival deepens the turn the card wears at rest and unwinds into
-        // it instead of swinging the opposite way.
-        let away = reduceMotion ? 0 : 1 - travel
-        // The turn, projected rather than rendered in 3D — see the type's note on the flash.
-        // `cos` of the angle IS the orthographic projection of a Y-axis rotation, and hinging it
-        // on the edge the card fans from restores the direction that the rotation's sign carried
-        // (cos is even, so the sign alone would read the same both ways).
-        let turn = cos(Angle.degrees(64 * away).radians)
-        return content
-            .opacity(reduceMotion ? raw : fade)
-            .scaleEffect(1 - 0.26 * away)
-            .scaleEffect(x: turn, y: 1, anchor: side < 0 ? .trailing : .leading)
-            .offset(y: 34 * away)
-    }
-
-    /// `1 - (1-t)³`, with a small overshoot past 1 before it settles.
-    private static func easeOutBack(_ t: Double) -> Double {
-        let c1 = 1.2, c3 = c1 + 1
-        let u = t - 1
-        return 1 + c3 * u * u * u + c1 * u * u
-    }
-
-    private static func easeOut(_ t: Double) -> Double {
-        let u = 1 - t
-        return 1 - u * u * u
-    }
-}
 #endif

clients/apple/Sources/PunktfunkClient/Home/GamepadChrome.swift

@@ -5,330 +5,82 @@
 // iOS/iPadOS, macOS (the couch Mac-mini case), and tvOS — where the same screens are driven by
 // the native focus engine instead of the controller poll (see GamepadCarousel/GamepadMenuList).
 
-import Glur
-import GlurBackdrop
 import PunktfunkKit
 import SwiftUI
 #if os(iOS) || os(macOS) || os(tvOS)
 import GameController
 
-/// The glyph a button wears in a legend: the ACTIVE controller's own (Xbox "A", DualSense ✕, …)
-/// via `sfSymbolsName` while one is attached, else the glyph of the last pad this device ever saw
-/// (`GamepadManager.lastKnownKind` → `GamepadGlyphs`), else the caller's generic fallback.
-///
-/// The middle rung is the whole point. `active` is nil whenever the pad sleeps, disconnects or
-/// runs flat — and permanently under `gamepadUIMode == "always"`, which puts the console UI up
-/// with no pad by design — and the fallbacks are letter glyphs, so a DualSense user's ✕/◯ legends
-/// used to turn into A/B the moment the controller dozed off. The remembered kind keeps the
-/// legends speaking the pad the user actually owns. The `fallback` still covers the genuinely
-/// unknown case: a fresh install that has never seen a controller, and any button outside the six
-/// `GamepadButtonRole` names.
-///
+/// The active controller's real glyph for a button (Xbox "A", DualSense ✕, …) via
+/// `sfSymbolsName`; a generic fallback before a controller profile resolves.
 /// @MainActor: GamepadManager is main-actor-bound (inside a View body this was implicit).
 @MainActor
 func buttonGlyph(
     _ button: KeyPath<GCExtendedGamepad, GCControllerButtonInput>, fallback: String
 ) -> String {
-    let manager = GamepadManager.shared
-    if let live = manager.active?.controller.extendedGamepad?[keyPath: button].sfSymbolsName {
-        return live
-    }
-    guard let role = GamepadButtonRole(keyPath: button) else { return fallback }
-    return GamepadGlyphs.symbol(role, for: manager.lastKnownKind)
+    GamepadManager.shared.active?.controller.extendedGamepad?[keyPath: button].sfSymbolsName
+        ?? fallback
 }
 
 /// Top padding for a gamepad screen's pinned title. macOS gets extra clearance — the launcher
 /// title sits right under the window titlebar and the settings/add-host sheets have no titlebar
-/// at all. The other values follow the console shell's rhythm (title top = 18 design units,
-/// k-floored to 10 for a landscape phone): the title needs air to the screen edge or the whole
-/// header reads pressed against the bezel, which the tab strip's extra band made obvious.
+/// at all, so the iOS value hugs the top edge there.
 func gamepadTitleTopPadding(compact: Bool) -> CGFloat {
     #if os(macOS)
     26
-    #elseif os(tvOS)
-    24
     #else
-    compact ? 18 : 28
-    #endif
-}
-
-/// Padding under a gamepad screen's pinned header block (title, and the tab strip where there is
-/// one) before the content: the console leaves ~14 units of air under its tab pills, and without
-/// it the first row sits shoulder-to-shoulder with the header.
-func gamepadTitleBottomPadding(compact: Bool) -> CGFloat {
-    #if os(tvOS)
-    16
-    #else
-    compact ? 8 : 12
-    #endif
-}
-
-/// Spacing between a header's stacked elements (title over tab strip / subtitle).
-func gamepadHeaderSpacing(compact: Bool) -> CGFloat {
-    #if os(tvOS)
-    13
-    #else
-    compact ? 6 : 10
+    compact ? 4 : 10
     #endif
 }
 
 /// Point size for a gamepad screen's pinned title: TV-large on tvOS (read from the couch), the
-/// in-hand compact-aware sizes elsewhere. Sized as a proper screen heading — the field verdict
-/// on the smaller first cut was "way too small" once the title moved off-centre.
+/// in-hand compact-aware sizes elsewhere.
 func gamepadTitleSize(compact: Bool) -> CGFloat {
     #if os(tvOS)
     44
     #else
-    compact ? 24 : 34
+    compact ? 20 : 30
     #endif
 }
 
 /// Metrics shared by the gamepad form screens' glass rows (GamepadSettingsView,
-/// GamepadAddHostView) — one set of numbers so the screens read as the same surface, at the size
-/// the screen they are on calls for.
-///
-/// Three tiers, not two. The phone numbers used to serve every non-TV device, so an iPad Pro drew
-/// a settings list at iPhone scale in the middle of a 13" display — the field verdict was that the
-/// sizing "does not adapt to larger screens". `pad` sits between the in-hand and 10-foot sets.
-///
-/// Chosen from the SIZE CLASSES rather than the device idiom, so an iPad running a narrow Stage
-/// Manager or Split View window correctly gets the in-hand numbers — the window is what the user
-/// is reading, not the panel it sits on.
-struct GamepadFormMetrics {
-    /// Which set this is, for the few things that are a KIND of layout rather than a number.
-    enum Tier { case phone, pad, tv }
-
-    let tier: Tier
-    let headerFont: CGFloat
-    let labelFont: CGFloat
-    let valueFont: CGFloat
-    let iconFont: CGFloat
-    let iconWidth: CGFloat
-    let chevronFont: CGFloat
-    let rowHPad: CGFloat
-    let rowVPad: CGFloat
-    let rowCorner: CGFloat
-    let rowMaxWidth: CGFloat
-    let detailFont: CGFloat
-    /// The option band's (GamepadOptionBand) fixed stage inside a choice row.
-    let bandWidth: CGFloat
-    /// The settings screen's section-tab pills.
-    let tabFont: CGFloat
-    /// The pinned controls legend (GamepadHintBar).
-    let hintGlyphFont: CGFloat
-    let hintTextFont: CGFloat
-    let hintPad: CGFloat
-
-    /// In-hand: a phone, or any window narrow enough to read like one.
-    static let phone = GamepadFormMetrics(
-        tier: .phone,
-        headerFont: 12, labelFont: 16, valueFont: 15, iconFont: 17, iconWidth: 28,
-        chevronFont: 12, rowHPad: 16, rowVPad: 13, rowCorner: 14, rowMaxWidth: 620,
-        detailFont: 13, bandWidth: 240,
-        tabFont: 13, hintGlyphFont: 19, hintTextFont: 14, hintPad: 13)
-
-    /// A tablet-sized window — an arm's length away rather than in the palm.
-    static let pad = GamepadFormMetrics(
-        tier: .pad,
-        headerFont: 14, labelFont: 20, valueFont: 19, iconFont: 21, iconWidth: 34,
-        chevronFont: 14, rowHPad: 20, rowVPad: 16, rowCorner: 16, rowMaxWidth: 820,
-        detailFont: 16, bandWidth: 320,
-        tabFont: 16, hintGlyphFont: 23, hintTextFont: 17, hintPad: 15)
-
-    /// 10-foot.
-    static let tv = GamepadFormMetrics(
-        tier: .tv,
-        headerFont: 17, labelFont: 23, valueFont: 21, iconFont: 24, iconWidth: 40,
-        chevronFont: 16, rowHPad: 24, rowVPad: 19, rowCorner: 18, rowMaxWidth: 920,
-        detailFont: 19, bandWidth: 380,
-        tabFont: 17, hintGlyphFont: 27, hintTextFont: 20, hintPad: 18)
-
-    /// What a screen gets before anything publishes a tier — and the only tier tvOS and macOS ever
-    /// use (an Apple TV is always 10-foot; a Mac window is read at desk distance).
-    static var platformDefault: GamepadFormMetrics {
-        #if os(tvOS)
-        tv
-        #else
-        phone
-        #endif
-    }
-
-    #if os(iOS)
-    /// The tier a window's size classes call for. REGULAR on both axes is the tablet case.
-    static func forWindow(
-        h: UserInterfaceSizeClass?, v: UserInterfaceSizeClass?
-    ) -> GamepadFormMetrics {
-        h == .regular && v == .regular ? .pad : .phone
-    }
+/// GamepadAddHostView) — one set of numbers so the two screens read as the same surface,
+/// sized for the couch on tvOS and for the hand elsewhere.
+enum GamepadFormMetrics {
+    #if os(tvOS)
+    static let headerFont: CGFloat = 17
+    static let labelFont: CGFloat = 23
+    static let valueFont: CGFloat = 21
+    static let iconFont: CGFloat = 24
+    static let iconWidth: CGFloat = 40
+    static let chevronFont: CGFloat = 16
+    static let rowHPad: CGFloat = 24
+    static let rowVPad: CGFloat = 19
+    static let rowCorner: CGFloat = 18
+    static let rowMaxWidth: CGFloat = 920
+    static let detailFont: CGFloat = 19
+    static let closeFont: CGFloat = 20
+    static let closeSide: CGFloat = 48
+    #else
+    static let headerFont: CGFloat = 12
+    static let labelFont: CGFloat = 16
+    static let valueFont: CGFloat = 15
+    static let iconFont: CGFloat = 17
+    static let iconWidth: CGFloat = 28
+    static let chevronFont: CGFloat = 12
+    static let rowHPad: CGFloat = 16
+    static let rowVPad: CGFloat = 13
+    static let rowCorner: CGFloat = 14
+    static let rowMaxWidth: CGFloat = 620
+    static let detailFont: CGFloat = 13
+    static let closeFont: CGFloat = 14
+    static let closeSide: CGFloat = 34
     #endif
 }
 
-private struct GamepadMetricsKey: EnvironmentKey {
-    static let defaultValue = GamepadFormMetrics.platformDefault
-}
-
-extension EnvironmentValues {
-    /// The form metrics for the screen currently drawing. Published from ContentView — the app
-    /// ROOT — rather than only from `gamepadPaletteInk`, because a screen that applies that
-    /// modifier itself sits ABOVE its own copy: its `@Environment` resolves against its parent, so
-    /// it would read the bare default instead of its own window's tier.
-    var gamepadMetrics: GamepadFormMetrics {
-        get { self[GamepadMetricsKey.self] }
-        set { self[GamepadMetricsKey.self] = newValue }
-    }
-}
-
-private struct DisplayBottomInsetKey: EnvironmentKey {
-    static let defaultValue: CGFloat = 0
-}
-
-extension EnvironmentValues {
-    /// The display's bottom safe-area inset — the home-indicator strip — measured by
-    /// `DisplayBottomInsetProbe` and published from ContentView. 0 until UIKit's first callback
-    /// lands (the legend keeps its plain margin for that first frame) and always 0 on
-    /// macOS/tvOS, where nothing publishes it.
-    var displayBottomInset: CGFloat {
-        get { self[DisplayBottomInsetKey.self] }
-        set { self[DisplayBottomInsetKey.self] = newValue }
-    }
-}
-
-#if os(iOS)
-/// Reports the hosting window's bottom safe-area inset from UIKit's OWN callbacks — never
-/// during a SwiftUI render.
-///
-/// This number has a history of wrong spellings, each failing silently:
-///   - a `GeometryReader` carrying `.ignoresSafeArea()` — a proxy reports NO insets for an edge it
-///     has been told to ignore, so that spelling can only ever answer 0;
-///   - `.ignoresSafeArea(.container, edges: .bottom)` on `safeAreaInset` CONTENT, which does not
-///     move content the inset mechanism itself placed; and
-///   - asking UIKit for the key window (`UIApplication.shared.connectedScenes…`) DURING body,
-///     which answered correctly and then KILLED the calling view: on an iPad (never the
-///     simulator) the walk re-enters UIKit layout mid-render and the view's update graph is
-///     silently severed — every later `@State` write lands in storage without ever re-running
-///     `body` again, which is how Settings and Add Host stopped opening while their triggers
-///     kept firing. No AttributeGraph warning, no log line; found by bisecting builds on glass.
-/// So: UIKit tells THIS view when the window or its insets change, on UIKit's schedule, and the
-/// answer hops out of the current update before anyone in SwiftUI reads it.
-struct DisplayBottomInsetProbe: UIViewRepresentable {
-    let onChange: (CGFloat) -> Void
-
-    func makeUIView(context: Context) -> ProbeView {
-        let view = ProbeView()
-        view.onChange = onChange
-        // Mounted as a full-size `.background`; it must never eat a touch meant for the UI.
-        view.isUserInteractionEnabled = false
-        return view
-    }
-
-    func updateUIView(_ view: ProbeView, context: Context) {
-        view.onChange = onChange
-    }
-
-    final class ProbeView: UIView {
-        var onChange: ((CGFloat) -> Void)?
-        private var last: CGFloat?
-
-        override func didMoveToWindow() {
-            super.didMoveToWindow()
-            report()
-        }
-
-        override func safeAreaInsetsDidChange() {
-            super.safeAreaInsetsDidChange()
-            report()
-        }
-
-        // Rotation reshuffles the window's insets without necessarily touching this view's own.
-        override func layoutSubviews() {
-            super.layoutSubviews()
-            report()
-        }
-
-        private func report() {
-            // The WINDOW's inset, not this view's: the probe sits inside the safe area, so its
-            // own inset is 0 — the number the legend needs is the strip the window reserves.
-            guard let bottom = window?.safeAreaInsets.bottom, bottom != last else { return }
-            last = bottom
-            let onChange = onChange
-            // Out of the current UIKit/SwiftUI update before any state write.
-            DispatchQueue.main.async { onChange?(bottom) }
-        }
-    }
-}
-#endif
-
-/// The bottom padding that puts a pinned legend the same distance from the bottom of the DISPLAY
-/// as it sits from the leading edge — so it lands on the diagonal of the display's rounded corner,
-/// which is what the corner asks for.
-///
-/// A `safeAreaInset` places its content INSIDE the safe area, so a plain margin stacks on top of
-/// the device's own bottom inset and the pill ends up two to three times further from the bottom
-/// than from the left. On a tablet this therefore goes NEGATIVE, pulling the pill back down
-/// through the home-indicator strip; the pill is left-aligned and an iPad's indicator is a short
-/// bar in the middle, so the two never meet.
-///
-/// Phones keep the plain margin. Their inset is the taller indicator bar and their legend runs
-/// most of the width, so sitting it that low would cross the indicator rather than tuck beside it.
-///
-/// `displayBottom` is `\.displayBottomInset` — measured by `DisplayBottomInsetProbe`, NEVER asked
-/// of UIKit here: this runs during body, and a key-window walk mid-render severs the calling
-/// view's updates (see the probe's comment). Pure arithmetic only.
-func gamepadLegendBottomPadding(
-    _ margin: CGFloat, tier: GamepadFormMetrics.Tier, displayBottom: CGFloat
-) -> CGFloat {
-    guard tier == .pad else { return margin }
-    // Floored at -inset: at worst the pill sits flush with the physical edge, never past it.
-    return max(-displayBottom, margin - displayBottom)
-}
-
-/// The tray gradient blur, back — as a real progressive BACKDROP blur this time.
-///
-/// GamepadTrayScrim did this with `.ultraThinMaterial`, and a material by definition lifts and
-/// tints whatever it blurs: it read grey over the aurora, and washed with the palette's ground it
-/// read coloured, which is why 2590238b deleted it. Glur's `GlurView` blurs the backdrop through
-/// a gradient with NO material stage on top, so the rows soften as they slide under the pinned
-/// title and legend and nothing carries a colour. It is the library's PRIVATE-API product
-/// (`GlurBackdrop`) — the public `.glur()` modifier is a shader on a view's own content and
-/// silently no-ops over platform-backed views like ScrollView, so it cannot reach a backdrop at
-/// all. Hit testing is disabled inside GlurView; the band never eats a touch.
-///
-/// Mounted exactly where the scrim was: `.background` of each form screen's safe-area tray.
-struct GamepadTrayBlur: View {
-    let edge: VerticalEdge
-
-    var body: some View {
-        // offset 0 puts the ramp's LITERAL ZERO exactly at the band's content edge, so nothing
-        // in the open field is touched — which is why, unlike the scrim, this band takes NO
-        // content-side overhang. The scrim's -44/-72 runway existed because a material carries
-        // body at every alpha and had to dissolve OUTSIDE the tray; carrying those numbers over
-        // here blurred fully-visible rows at rest (field verdict on the first cut). Full
-        // strength lands at 60% of the band, so the tray's own text always sits on the strong
-        // region while the ramp still reads as a gradient, not an edge.
-        GlurView(
-            radius: 14, offset: 0, interpolation: 0.6,
-            direction: edge == .top ? .up : .down)
-            // Full-bleed by LAYOUT, not `.ignoresSafeArea()`: safe-area expansion resolves a
-            // beat after insertion (outside any geometry group and outside this view's own
-            // transaction), which reads as a visible pop. 80 pt clears every inset on every
-            // device, and backgrounds never clip — the overhang simply draws.
-            .padding(edge == .top ? .top : .bottom, -80)
-            .padding(.horizontal, -80)
-            // And the shape must NEVER animate: mounted inside a pushed shell layer, any late
-            // geometry would ride the push's transaction and visibly grow into place. The
-            // layer's own fade/slide still carries the band; only its SHAPE is pinned.
-            .transaction { $0.animation = nil }
-    }
-}
-
 /// One glyph + label cell in a hint bar.
 struct GamepadHint: Identifiable {
     let glyph: String
     let text: String
-    /// What tapping/clicking this cell does — the same thing its button does. Optional because a
-    /// few legend cells NAME an input rather than an action ("↔ Adjust" is the stick itself;
-    /// there is no single thing a tap on it could mean), and those stay inert labels.
-    var action: (() -> Void)? = nil
     var id: String { glyph + text }
 }
 
@@ -338,75 +90,39 @@ struct GamepadHint: Identifiable {
 /// the backdrop instead of dissolving into it.
 struct GamepadHintBar: View {
     @Environment(\.gamepadInk) private var ink
-    /// Sized with the screen it pins to — a legend at phone scale on a 13" iPad is the same
-    /// mismatch the form rows had (see GamepadFormMetrics).
-    @Environment(\.gamepadMetrics) private var metrics
     let hints: [GamepadHint]
 
+    // 10-foot legend on tvOS, in-hand sizes elsewhere.
+    #if os(tvOS)
+    private static let glyphFont: CGFloat = 27
+    private static let textFont: CGFloat = 20
+    private static let pad: CGFloat = 18
+    #else
+    private static let glyphFont: CGFloat = 19
+    private static let textFont: CGFloat = 14
+    private static let pad: CGFloat = 13
+    #endif
+
     var body: some View {
         HStack(spacing: 18) {
             ForEach(hints) { hint in
-                cell(hint)
+                HStack(spacing: 7) {
+                    Image(systemName: hint.glyph)
+                        .font(.system(size: Self.glyphFont))
+                        .foregroundStyle(ink.fg)
+                    Text(hint.text)
+                }
+                .fixedSize() // keep glyph + label together; never truncate a hint mid-word
             }
         }
-        .font(.geist(metrics.hintTextFont, .semibold, relativeTo: .subheadline))
+        .font(.geist(Self.textFont, .semibold, relativeTo: .subheadline))
         .foregroundStyle(ink.fg(0.85))
-        .padding(metrics.hintPad)
+        .padding(Self.pad)
         .consoleGlass(Capsule())
-        // The hairline is DECORATION and sits on top of the cells, so it must never take a touch.
-        // Spelled out rather than left to defaults, because a swallowed touch in this bar is
-        // invisible — the legend simply stops doing anything.
-        .overlay(Capsule().strokeBorder(ink.fg(0.12), lineWidth: 1).allowsHitTesting(false))
-    }
-
-    /// A cell is a button where it has somewhere to go, and a plain label otherwise (see the type
-    /// comment for why tvOS is always the latter).
-    @ViewBuilder private func cell(_ hint: GamepadHint) -> some View {
-        #if os(tvOS)
-        label(hint)
-        #else
-        if let action = hint.action {
-            Button(action: action) { label(hint) }
-                .buttonStyle(HintCellStyle())
-                .accessibilityLabel(hint.text)
-        } else {
-            label(hint)
-        }
-        #endif
-    }
-
-    private func label(_ hint: GamepadHint) -> some View {
-        HStack(spacing: 7) {
-            Image(systemName: hint.glyph)
-                .font(.system(size: metrics.hintGlyphFont))
-                .foregroundStyle(ink.fg)
-            Text(hint.text)
-        }
-        .fixedSize() // keep glyph + label together; never truncate a hint mid-word
-        // The tappable area covers the gap between glyph and label, not just their painted
-        // pixels — a legend cell is small enough already.
-        .contentShape(Rectangle())
+        .overlay(Capsule().strokeBorder(ink.fg(0.12), lineWidth: 1))
     }
 }
 
-#if !os(tvOS)
-/// Press feedback for a legend cell. Deliberately quiet — the bar is chrome, and a cell that lit
-/// up like a primary button would pull the eye off the content it describes.
-///
-/// `contentShape` sits BELOW the scale so the hit region stays the unscaled layout bounds: a press
-/// animation that shrinks the artwork must never move the target out from under a resting finger,
-/// or the touch-up lands outside and SwiftUI discards the tap.
-private struct HintCellStyle: ButtonStyle {
-    func makeBody(configuration: Configuration) -> some View {
-        configuration.label
-            .opacity(configuration.isPressed ? 0.55 : 1)
-            .scaleEffect(configuration.isPressed ? 0.94 : 1)
-            .animation(.smooth(duration: 0.14), value: configuration.isPressed)
-            .contentShape(Rectangle())
-    }
-}
-#endif
-
 /// The console backdrop: a living aurora drifting slowly over black so it reads as ambience behind
 /// the cards, never as content. On iOS 18 / macOS 15+ it's an animated `MeshGradient` — a continuous
 /// silk of colour whose control points wander on slow, out-of-phase sinusoids — finished with an
@@ -431,21 +147,8 @@ private struct HintCellStyle: ButtonStyle {
 /// header). Honors Reduce Motion by freezing the field at a fixed phase.
 struct GamepadScreenBackground: View {
     @Environment(\.gamepadInk) private var ink
-    /// How far toward the form screens' quiet the field sits: 0 = the launcher's full aurora,
-    /// 1 = calm, fractional mid-chase. Continuous (not a Bool) so the in-place shell can CHASE
-    /// it during a push/pop — the console does the same with its `bg_mix` — and every
-    /// calm-dependent factor below rides an `.opacity` modifier, which animates reliably where
-    /// re-built gradient stops do not.
-    var calmMix: Double
-
-    /// The Bool spelling every non-shell call site uses (see the type comment for `calm`).
-    init(calm: Bool = false) {
-        calmMix = calm ? 1 : 0
-    }
-
-    init(calmMix: Double) {
-        self.calmMix = calmMix
-    }
+    /// Quiet the field for a form screen (see the type comment).
+    var calm = false
 
     @Environment(\.accessibilityReduceMotion) private var reduceMotion
     @AppStorage(DefaultsKey.uiPalette) private var paletteID = "violet"
@@ -480,29 +183,22 @@ struct GamepadScreenBackground: View {
             colorField(at: t, palette: palette)
                 // ±8° over ~5 min — the whole field very slowly warms and cools.
                 .hueRotation(.degrees(sin(t * 0.021) * 8))
-                // Calm = col·0.6 + ground·0.4. Over the OPAQUE ground beneath, `.opacity` already
-                // lerps toward it, so this layer alone IS the whole calm mix.
-                .opacity(1 - 0.4 * calmMix)
-            // A further plusLighter wash of the ground, which lets a DARK palette's bright pools
-            // come down to meet its ground rather than merely fading toward it.
-            //
-            // Suppressed on a pale palette (the factor goes to 0), because there it was destroying
-            // the setting: a pale ground is near-white, so ADDING 0.4 of it on top of a field
-            // already mixed 0.4 toward that same ground saturated the form screens to flat white —
-            // the field ask was "in bright mode the sub-screens are basically just white". Written
-            // as a factor rather than an `if` so the layer stays mounted and the calm chase keeps
-            // animating instead of popping when a screen is pushed.
-            Self.color(palette.ground)
-                .opacity(0.4 * calmMix * (palette.light ? 0 : 1))
-                .blendMode(.plusLighter)
+                // Calm = col·0.6 + ground·0.4: over the ground, `.opacity` IS the multiply…
+                .opacity(calm ? 0.6 : 1)
+            if calm {
+                // …and a plusLighter wash of the palette's own ground IS the add. Chosen so the
+                // ground lands exactly where it was and the bright pools come down to meet it.
+                Self.color(palette.ground)
+                    .opacity(0.4)
+                    .blendMode(.plusLighter)
+            }
             // Cinematic vignette: the edges settle toward the scrim so the cards sit in the
             // pooled light. Soft (extends past the frame) so the corners deepen rather than
             // crush. Halved under calm: a launcher's cards sit in the pooled centre, but a form
             // screen's rows run out toward the edges, where crushing them just eats the list.
             EllipticalGradient(
-                colors: [.clear, scrim.opacity(0.42 * strength)],
+                colors: [.clear, scrim.opacity((calm ? 0.21 : 0.42) * strength)],
                 center: .center, startRadiusFraction: 0.25, endRadiusFraction: 1.15)
-                .opacity(1 - 0.5 * calmMix)
             // Legibility grounding for the pinned title (top) and hint pill (bottom). This one
             // works on the field itself (it's the backdrop's bottom layer — nothing behind it to
             // blur), so it stays a gradient, just a light one.
@@ -629,6 +325,40 @@ private struct LegacyBlobField: View {
     }
 }
 
+/// A blur gradient behind a pinned tray (a screen title, the hints/detail bar, the keyboard tray):
+/// scrollable rows pass beneath those insets, so without this the tray text and the row underneath
+/// render interleaved. Pure blur — a dark material faded out by a gradient mask, no dark tint — so
+/// the tray's text sits on a softly blurred backdrop that dissolves into the rows.
+struct GamepadTrayScrim: View {
+    let edge: VerticalEdge
+    @Environment(\.gamepadInk) private var ink
+
+    var body: some View {
+        let fromEdge: UnitPoint = edge == .top ? .top : .bottom
+        let toContent: UnitPoint = edge == .top ? .bottom : .top
+        Rectangle()
+            .fill(.ultraThinMaterial)
+            // Force the frost to match the PALETTE, not the system appearance: the tray exists
+            // to keep the pinned title legible, so it has to frost dark under white ink and
+            // light under dark ink.
+            .environment(\.colorScheme, ink.isLight ? .light : .dark)
+            // Fade the whole blur out toward the content so it dissolves rather than ending on a line.
+            .mask {
+                LinearGradient(
+                    stops: [
+                        .init(color: .black, location: 0),
+                        .init(color: .black.opacity(0.9), location: 0.5),
+                        .init(color: .clear, location: 1),
+                    ],
+                    startPoint: fromEdge, endPoint: toContent)
+            }
+            // Grow past the tray so the fade-to-clear happens OUTSIDE its bounds — the tray's own
+            // text always sits on the strong part, rows blur out before they reach it.
+            .padding(edge == .top ? .bottom : .top, -32)
+            .ignoresSafeArea()
+    }
+}
+
 /// The backdrop for the gamepad UI's form screens (settings, add-host). It used to be a STILL pair
 /// of glows over a deep indigo base — deliberately not near-black, because Liquid Glass refracts
 /// whatever sits behind it and over black the rows turn invisible. It is now the launcher's own

clients/apple/Sources/PunktfunkClient/Home/GamepadHomeView.swift

@@ -65,37 +65,15 @@ private struct HomeTile: Identifiable {
 
 struct GamepadHomeView: View {
     @Environment(\.gamepadInk) private var ink
-    /// Published by ContentView at the app ROOT, so this reads its own window's tier — this screen
-    /// applies `gamepadPaletteInk` itself and so sits above its own copy of the environment.
-    @Environment(\.gamepadMetrics) private var metrics
-    /// The home-indicator strip's height, measured by DisplayBottomInsetProbe and published from
-    /// ContentView — an environment READ is safe in body; asking UIKit for it here is not (see
-    /// the probe's comment: a key-window walk mid-render severed this very view's updates).
-    @Environment(\.displayBottomInset) private var displayBottomInset
     @ObservedObject var store: HostStore
     @ObservedObject var model: SessionModel
     @ObservedObject var discovery: HostDiscovery
     @Binding var libraryTarget: StoredHost?
-    /// The host awaiting a PIN ceremony, if any. Owned by ContentView (a connect attempt sets it,
-    /// as does the trust card's "Pair with PIN instead"), presented here as a shell screen —
-    /// PairSheet's `Form` is unreachable with a controller on iOS/macOS, which made pairing the
-    /// one thing a console-UI user simply could not do. See GamepadPairView.
-    @Binding var pairingTarget: StoredHost?
-    /// Pin the verified fingerprint and connect — ContentView's `handlePaired`.
-    let onPaired: (StoredHost, Data) -> Void
     /// Wake-and-wait driver — gates the carousel while its overlay is up, and the carousel's
     /// activate routes an offline+wakeable host through it (see ContentView.startSession).
     @ObservedObject var waker: HostWaker
     let connect: (StoredHost, ProfileSelection) -> Void
     let connectDiscovered: (DiscoveredHost) -> Void
-    /// Launch a library title on a host — the in-place library layer's activate path (iOS; the
-    /// cover/sheet presentations wire ContentView's `launchTitle` into LibraryView themselves).
-    let launchTitle: (StoredHost, String) -> Void
-    /// A console prompt (GamepadPromptView) is up over the home — it polls the same controller, so
-    /// this screen must stand down for as long as it is. Same handoff contract as the connect
-    /// takeover and the shell's own layers; without it the carousel keeps scrolling underneath the
-    /// modal and a single A press reaches both.
-    var promptActive = false
 
     /// The profile catalog — pinned host+profile combos render as their own tiles here, which is
     /// how a controller picks a profile: one focus-and-press instead of a menu (design §5.4).
@@ -115,56 +93,29 @@ struct GamepadHomeView: View {
     private let compact = false // no size classes on macOS; the window minimum keeps room
     #endif
     @ObservedObject private var gamepads = GamepadManager.shared
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion
     @State private var selection: GamepadHomeTarget?
     @State private var showSettings = false
     @State private var showAddHost = false
-    /// The console's input drop: true for the transition's 0.26 s, during which NO layer polls
-    /// the controller — a double-tapped A can't push two screens, and the held button that
-    /// caused the change is long released before the next poller starts (whose own
-    /// `needsSnapshot` seed swallows it if not).
-    @State private var transitioning = false
-    /// Guards the gate's release against an interrupted transition: only the newest hold clears.
-    @State private var transitionEpoch = 0
 
     var body: some View {
-        // The in-place shell (see GamepadShell.swift): the launcher is the base layer, the
-        // current sub-screen a transparent layer over it, both over ONE persistent backdrop
-        // that never unmounts — a push slides the screen up out of a fade while the launcher
-        // recedes underneath, the console's own choreography. On macOS/tvOS `topScreen` is
-        // constantly nil and this ZStack degenerates to the plain launcher, presented over by
-        // the sheets/covers below exactly as before.
-        ZStack {
-            homeLayer
-                .opacity(covered ? 0 : 1)
-                .scaleEffect(covered ? GamepadShellMotion.underScale : 1)
-                // The covers used to swallow touch; the recessed layer must too.
-                .allowsHitTesting(!covered)
-            #if os(iOS)
-            if let screen = topScreen {
-                screenLayer(screen)
-                    // Settle the screen's internal layout before the insertion animates, so
-                    // descendants never lerp from a half-resolved first frame. (Not sufficient
-                    // for the tray blurs on its own — safe-area expansion resolves outside a
-                    // geometry group; GamepadTrayScrim pins its own geometry too.)
-                    .geometryGroup()
-                    .zIndex(1)
-                    .id(screen.id)
-                    .transition(.gamepadScreen(slide: GamepadShellMotion.slide(compact: compact)))
-            }
-            #endif
+        GeometryReader { geo in
+            hero(for: geo.size)
         }
-        // Value-keyed rather than `withAnimation` at the triggers: pushes originate outside
-        // this view too (`model.returnToLibrary` writes `libraryTarget`), and keying on the
-        // derived id catches every writer. Reduce Motion snaps.
-        .animation(reduceMotion ? nil : GamepadShellMotion.screen, value: topScreenID)
-        // ONE living field for every layer, still a `.background` (the layout rule in this
-        // file's header). Its calm is CHASED between the launcher's aurora and the form
-        // screens' quiet, never crossfaded per screen — the console's `bg_mix`.
-        .background {
-            GamepadScreenBackground(calmMix: calmTarget)
-                .animation(reduceMotion ? nil : GamepadShellMotion.calm, value: calmTarget)
+        // Pinned inside the safe area, out of the carousel's vertical budget — never clipped.
+        .safeAreaInset(edge: .top, spacing: 0) {
+            titleBar
+                .padding(.top, gamepadTitleTopPadding(compact: compact))
+                .padding(.bottom, compact ? 4 : 8)
         }
+        .safeAreaInset(edge: .bottom, alignment: .leading, spacing: 0) {
+            GamepadHintBar(hints: hints)
+                // Equal distance from the left and bottom edges — the pill's corner inset was the
+                // real asymmetry (leading 22 vs bottom 10), not its internal padding.
+                .padding(.leading, compact ? 12 : 18)
+                .padding(.bottom, compact ? 12 : 18)
+                .padding(.top, compact ? 4 : 8)
+        }
+        .background { GamepadScreenBackground() }
         // Publish the palette's ink to this screen (text, glass, accent, scrims) — a
         // pale palette flips all of them, and no leaf should have to read the setting.
         .gamepadPaletteInk()
@@ -178,17 +129,6 @@ struct GamepadHomeView: View {
                 try? await Task.sleep(for: .seconds(10))
             }
         }
-        #if os(iOS)
-        .onChange(of: topScreenID) { _, _ in
-            transitionEpoch += 1
-            let epoch = transitionEpoch
-            transitioning = true
-            let hold = reduceMotion ? 0.05 : GamepadShellMotion.duration + 0.02
-            DispatchQueue.main.asyncAfter(deadline: .now() + hold) {
-                if epoch == transitionEpoch { transitioning = false }
-            }
-        }
-        #endif
         // The remote's Play/Pause mirrors the pad's X (Settings): the focus engine never surfaces
         // X, and historically tvOS maps a pad's X to this same press — the poll and this command
         // double-firing just sets the same Bool twice.
@@ -196,9 +136,8 @@ struct GamepadHomeView: View {
         .onPlayPauseCommand { showSettings = true }
         #endif
         // The settings / add-host screens take over the controller (the carousel's `isActive`
-        // gate above). macOS has no fullScreenCover — they are generously sized sheets over the
-        // dimmed launcher; tvOS keeps its focus-engine covers. iOS needs nothing here: the
-        // shell's layers above ARE the presentation.
+        // gate above). iOS presents them full screen — the immersive console feel; macOS has no
+        // fullScreenCover, so they become generously sized sheets over the dimmed launcher.
         #if os(macOS)
         .sheet(isPresented: $showSettings) {
             GamepadSettingsView(store: store)
@@ -209,7 +148,7 @@ struct GamepadHomeView: View {
                 .frame(width: 660, height: 620)
         }
         .frame(minWidth: 640, minHeight: 420)
-        #elseif os(tvOS)
+        #else
         .fullScreenCover(isPresented: $showSettings) { GamepadSettingsView(store: store) }
         .fullScreenCover(isPresented: $showAddHost) {
             GamepadAddHostView { store.add($0) }
@@ -217,135 +156,6 @@ struct GamepadHomeView: View {
         #endif
     }
 
-    // MARK: - The shell's layers (see GamepadShell.swift)
-
-    /// The launcher itself — everything the pre-shell body was, minus the backdrop (hoisted to
-    /// the shell) and the presentation modifiers (below).
-    private var homeLayer: some View {
-        GeometryReader { geo in
-            hero(for: geo.size)
-        }
-        // Pinned inside the safe area, out of the carousel's vertical budget — never clipped.
-        .safeAreaInset(edge: .top, spacing: 0) {
-            titleBar
-                .padding(.top, gamepadTitleTopPadding(compact: compact))
-                .padding(.bottom, gamepadTitleBottomPadding(compact: compact))
-        }
-        .safeAreaInset(edge: .bottom, alignment: .leading, spacing: 0) {
-            legend
-        }
-    }
-
-    /// The pinned controls legend, sitting the SAME distance from the leading and bottom edges of
-    /// the DISPLAY — see `gamepadLegendBottomPadding` for why the bottom number is not simply the
-    /// margin, and why measuring the inset (rather than trying to opt out of it) is what finally
-    /// worked.
-    private var legend: some View {
-        GamepadHintBar(hints: hints)
-            .padding(.leading, legendMargin)
-            .padding(
-                .bottom,
-                gamepadLegendBottomPadding(
-                    legendMargin, tier: metrics.tier, displayBottom: displayBottomInset))
-            .padding(.top, compact ? 4 : 8)
-    }
-
-    /// The legend pill's distance from the screen's leading and bottom edges.
-    private var legendMargin: CGFloat { compact ? 12 : 18 }
-
-    #if os(iOS)
-    /// The screen the shell shows over the launcher — derived from the same triggers every
-    /// platform sets, so `returnToLibrary`, the tiles, X and Y all keep writing what they wrote.
-    private var topScreen: GamepadScreen? {
-        // Pairing leads: it is a ceremony blocking a connect the user already asked for, and it
-        // can be raised from ON TOP of the library (launching a title on an unpaired host), where
-        // it has to win. Backing out of it reveals whatever it interrupted.
-        if let host = pairingTarget { return .pair(host) }
-        if showSettings { return .settings }
-        if showAddHost { return .addHost }
-        if let host = libraryTarget { return .library(host) }
-        return nil
-    }
-
-    @ViewBuilder private func screenLayer(_ screen: GamepadScreen) -> some View {
-        // The layer owns the controller only once the push settles and nothing rides over the
-        // shell (the connect/wake takeover is an overlay in ContentView, above these layers).
-        let active = !transitioning && waker.waking == nil && model.phase != .connecting
-        Group {
-            switch screen {
-            case .settings:
-                GamepadSettingsView(
-                    store: store,
-                    close: { if !transitioning { showSettings = false } },
-                    controllerActive: active)
-            case .addHost:
-                GamepadAddHostView(
-                    onAdd: { store.add($0) },
-                    close: { if !transitioning { showAddHost = false } },
-                    controllerActive: active)
-            case .pair(let host):
-                GamepadPairView(
-                    host: host,
-                    onPaired: { onPaired(host, $0) },
-                    close: { if !transitioning { pairingTarget = nil } },
-                    controllerActive: active)
-            case .library(let host):
-                GamepadLibraryScreen(
-                    store: store, host: host,
-                    onLaunch: { launchTitle(host, $0) },
-                    close: { if !transitioning { libraryTarget = nil } },
-                    controllerActive: active)
-            }
-        }
-        .environment(\.gamepadHostedInShell, true)
-    }
-    #endif
-
-    private var covered: Bool {
-        #if os(iOS)
-        topScreen != nil
-        #else
-        false
-        #endif
-    }
-
-    private var topScreenID: String? {
-        #if os(iOS)
-        topScreen?.id
-        #else
-        nil
-        #endif
-    }
-
-    /// The backdrop's calm target: 1 under a form screen, 0 under the launcher/library. The
-    /// macOS sheets / tvOS covers mount their own calmed field, so the launcher behind them
-    /// keeps its aurora — exactly what shipped.
-    private var calmTarget: Double {
-        #if os(iOS)
-        topScreen?.isForm == true ? 1 : 0
-        #else
-        0
-        #endif
-    }
-
-    /// Stop consuming the controller while another screen (or the connect/wake takeover) is on
-    /// top — otherwise the launcher navigates behind it (invisibly on iPhone, visibly on iPad),
-    /// and a second A during a dial would launch a concurrent connect. `.connecting` covers the
-    /// takeover's Connecting phase; `waker.waking` its Waking phase. On iOS the shell adds the
-    /// transition's input drop, during which NOBODY polls.
-    private var homeOwnsController: Bool {
-        #if os(iOS)
-        topScreen == nil && !transitioning && !promptActive
-            && waker.waking == nil && model.phase != .connecting
-        #else
-        // `pairingTarget` too: macOS presents the pair screen as a sheet and tvOS as a cover, and
-        // either way the launcher underneath must stop consuming the pad — the pair screen's own
-        // list is polling the same controller.
-        libraryTarget == nil && pairingTarget == nil && !showSettings && !showAddHost
-            && !promptActive && waker.waking == nil && model.phase != .connecting
-        #endif
-    }
-
     // MARK: - Hero (carousel + detail), sized to fit the space between the pinned title and hints
 
     @ViewBuilder private func hero(for size: CGSize) -> some View {
@@ -371,27 +181,32 @@ struct GamepadHomeView: View {
     // MARK: - Chrome
 
     private var titleBar: some View {
-        // Leading title (a console heading, not a floating label — field ask), chip trailing.
-        // The old hidden-mirror trick existed only to keep a CENTRED title clear of the chip;
-        // a leading title needs none of it — the flexible frame keeps the two apart, and the
-        // title shrinks a little before it would ever truncate.
+        // The chip used to be a trailing `.overlay`, which reserves no width: on a portrait phone
+        // it sat directly on top of the centred title ("Select a Host" ran straight into the pad
+        // name). Laying it out as a row with a hidden mirror on the leading side keeps the title
+        // optically centred AND clear of the chip at every width; the title shrinks a little
+        // before it would ever truncate.
         HStack(spacing: 12) {
+            statusChip(hidden: true)
             Text("Select a Host")
                 .font(.geist(gamepadTitleSize(compact: compact), .bold, relativeTo: .title))
                 .foregroundStyle(ink.fg)
                 .lineLimit(1)
                 .minimumScaleFactor(0.75)
-                .frame(maxWidth: .infinity, alignment: .leading)
-            statusChip
+                .frame(maxWidth: .infinity)
+            statusChip(hidden: false)
         }
-        .padding(.horizontal, 24)
+        .padding(.horizontal, 20)
     }
 
     /// Which pad is driving this UI (name + battery) — quiet, and only where there's room; a
-    /// compact-height phone gives the pixels to the carousel instead.
-    @ViewBuilder private var statusChip: some View {
+    /// compact-height phone gives the pixels to the carousel instead. `hidden` renders the same
+    /// chip purely as a width reserve.
+    @ViewBuilder private func statusChip(hidden: Bool) -> some View {
         if !compact, let active = gamepads.active {
             ControllerStatusChip(controller: active)
+                .opacity(hidden ? 0 : 1)
+                .accessibilityHidden(hidden)
         }
     }
 
@@ -414,9 +229,14 @@ struct GamepadHomeView: View {
             onActivate: { $0.activate() },
             onSecondary: { openLibraryForSelected() },
             onTertiary: { showSettings = true },
-            isActive: homeOwnsController
-        ) { tile, entrance in
-            hostCard(tile, size: CGSize(width: cardWidth, height: cardHeight), entrance: entrance)
+            // Stop consuming the controller while another screen (or the connect/wake takeover) is on
+            // top — otherwise the launcher navigates behind it (invisibly on iPhone, visibly on iPad),
+            // and a second A during a dial would launch a concurrent connect. `.connecting` covers the
+            // takeover's Connecting phase; `waker.waking` covers its Waking phase.
+            isActive: libraryTarget == nil && !showSettings && !showAddHost
+                && waker.waking == nil && model.phase != .connecting
+        ) { tile in
+            hostCard(tile, size: CGSize(width: cardWidth, height: cardHeight))
         }
         .frame(height: cardHeight + 40)
     }
@@ -425,12 +245,8 @@ struct GamepadHomeView: View {
     /// per-frame `phase` (real distance-from-centered), so the look always matches what's on screen
     /// mid-scroll. `.shadow`/`.overlay` aren't part of `VisualEffect`, so the focus pop is scale +
     /// brightness/saturation + a depth blur on the recessed neighbors.
-    private func hostCard(
-        _ tile: HomeTile, size: CGSize, entrance: CardEntrance
-    ) -> some View {
+    private func hostCard(_ tile: HomeTile, size: CGSize) -> some View {
         GamepadHostTile(tile: tile, size: size)
-            // Beneath the scroll transition, never around it — see CardEntrance.
-            .modifier(entrance)
             .scrollTransition { content, phase in
                 let d = CGFloat(min(abs(phase.value), 1))
                 let scale = 1 - d * 0.12
@@ -456,22 +272,13 @@ struct GamepadHomeView: View {
         case .rescan: "Rescan"
         default: nil
         }
-        // Every cell's action re-resolves the selection when it FIRES rather than closing over the
-        // one this render saw: the legend is rebuilt on selection changes, but a tap landing in
-        // the same frame as a carousel move would otherwise activate the tile that was selected a
-        // moment ago — the one failure mode a launcher cannot afford.
         var hints = [GamepadHint(
             glyph: buttonGlyph(\.buttonA, fallback: "a.circle"),
-            text: action ?? (selected?.canWake == true ? "Wake & Connect" : "Connect"),
-            action: { tiles.first { $0.id == selection }?.activate() })]
+            text: action ?? (selected?.canWake == true ? "Wake & Connect" : "Connect"))]
         if libraryEnabled, selected?.hasLibrary == true {
-            hints.append(.init(
-                glyph: buttonGlyph(\.buttonY, fallback: "y.circle"), text: "Library",
-                action: { openLibraryForSelected() }))
+            hints.append(.init(glyph: buttonGlyph(\.buttonY, fallback: "y.circle"), text: "Library"))
         }
-        hints.append(.init(
-            glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Settings",
-            action: { showSettings = true }))
+        hints.append(.init(glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Settings"))
         return hints
     }
 
@@ -595,15 +402,10 @@ private struct GamepadHostTile: View {
                             .foregroundStyle(ink.fg(0.5))
                     }
                     if tile.isOnline {
-                        // Status colours stay palette-independent (a pip must not change meaning
-                        // with the wallpaper) — only the glow softens on a pale field, where it
-                        // reads as a smudge at full strength.
                         Circle()
-                            .fill(GamepadInk.onlineGreen)
+                            .fill(Color.green)
                             .frame(width: Self.pipSide, height: Self.pipSide)
-                            .shadow(
-                                color: GamepadInk.onlineGreen.opacity(ink.isLight ? 0.45 : 0.7),
-                                radius: 5)
+                            .shadow(color: .green.opacity(0.7), radius: 5)
                     }
                 }
             }
@@ -626,21 +428,11 @@ private struct GamepadHostTile: View {
         }
         .padding(Self.pad)
         .frame(width: size.width, height: size.height, alignment: .leading)
-        // Console tile — a brand wash marks a saved host as primary; discovered / Add-Host tiles
-        // stay neutral with a dashed edge. The surface clips to the shape itself.
-        //
-        // `forceMaterial`: these tiles are the one console surface that gets TRANSFORMED while it
-        // animates — `CardEntrance` swings each card in on a `rotation3DEffect` under an opacity
-        // ramp, and the carousel's `.scrollTransition` keeps scaling and rotating the neighbours
-        // forever after. Liquid Glass samples the backdrop through its own layer and cannot do
-        // that under a 3D transform, so it drew one way through the swing and snapped to another
-        // as the card landed — on glass it read as the tiles being swapped out for different ones
-        // at the end of their entrance. A material composites flat, so the card looks the same at
-        // every frame of the travel. (tvOS already takes this path for its own reasons.)
+        // Liquid Glass console tile — a brand wash marks a saved host as primary; discovered /
+        // Add-Host tiles stay neutral glass with a dashed edge. Glass clips to the shape itself.
         .consoleGlass(
             RoundedRectangle(cornerRadius: Self.corner, style: .continuous),
-            tint: tile.filled ? ink.accent(0.20) : nil,
-            forceMaterial: true)
+            tint: tile.filled ? ink.accent(0.20) : nil)
         .overlay {
             RoundedRectangle(cornerRadius: Self.corner, style: .continuous)
                 .strokeBorder(
@@ -649,7 +441,7 @@ private struct GamepadHostTile: View {
                         startPoint: .top, endPoint: .bottom),
                     style: StrokeStyle(lineWidth: 1, dash: tile.filled ? [] : [6, 5]))
         }
-        .shadow(color: ink.shadow(0.45), radius: 20, y: 14)
+        .shadow(color: .black.opacity(0.45), radius: 20, y: 14)
     }
 
     private var monogramBadge: some View {

clients/apple/Sources/PunktfunkClient/Home/GamepadInk.swift

@@ -37,12 +37,6 @@ struct GamepadInk: Equatable, Sendable {
     func accent(_ alpha: Double) -> Color { accent.opacity(alpha) }
     /// A wash under text: `alpha` is the dark-field strength, scaled for a pale one.
     func shade(_ alpha: Double) -> Color { shade.opacity(alpha * shadeScale) }
-    /// The glass base at `alpha` — what a surface's material is washed with so it carries the
-    /// palette's hue (the console fills its panels with exactly this colour).
-    func glass(_ alpha: Double) -> Color { glass.opacity(alpha) }
-    /// A drop shadow: always black — a white shadow is not a shadow — but softened on a pale
-    /// field, where full-strength black under every card reads as a smear rather than depth.
-    func shadow(_ alpha: Double) -> Color { .black.opacity(alpha * (isLight ? 0.4 : 1)) }
 
     static func of(_ p: GamepadPalette) -> GamepadInk {
         let accent = Color(red: p.accent.x, green: p.accent.y, blue: p.accent.z)
@@ -66,10 +60,6 @@ struct GamepadInk: Equatable, Sendable {
 
     /// The shipped dark look — what a preview or a test composition gets.
     static let dark = GamepadInk.of(GamepadPalette.named("violet"))
-
-    /// The online pip — deliberately NOT palette-derived: a status colour must not change
-    /// meaning with the wallpaper (the console's rule; this is its `ONLINE_GREEN` verbatim).
-    static let onlineGreen = Color(red: 0.20, green: 0.84, blue: 0.29)
 }
 
 private struct GamepadInkKey: EnvironmentKey {
@@ -85,40 +75,16 @@ extension EnvironmentValues {
 }
 
 extension View {
-    /// Resolve the stored `ui_palette` and publish its ink — AND the matching colour scheme — to
-    /// everything below. Applied by the gamepad screens' common root so no individual view has to
-    /// read the setting.
-    ///
-    /// `active` exists for the one surface that is the same view in both worlds: `LibraryView`
-    /// renders the coverflow under the gamepad UI and a plain grid without it. Passing `false`
-    /// publishes nothing, because the touch/desktop layouts sit on the SYSTEM background, where a
-    /// palette's scheme would invert their own system colours instead of matching them.
-    func gamepadPaletteInk(_ active: Bool = true) -> some View {
-        modifier(GamepadInkModifier(active: active))
-    }
+    /// Resolve the stored `ui_palette` and publish its ink to everything below. Applied by the
+    /// gamepad screens' common root so no individual view has to read the setting.
+    func gamepadPaletteInk() -> some View { modifier(GamepadInkModifier()) }
 }
 
 private struct GamepadInkModifier: ViewModifier {
-    var active = true
     @AppStorage(DefaultsKey.uiPalette) private var paletteID = "violet"
-    /// The ambient scheme from ABOVE this modifier — what gets republished unchanged when the
-    /// gamepad UI isn't the one drawing, so `active: false` is a true no-op rather than a branch
-    /// that would change this view's identity.
-    @Environment(\.colorScheme) private var systemScheme
 
     func body(content: Content) -> some View {
-        let palette = GamepadPalette.named(paletteID)
-        return content
-            .environment(\.gamepadInk, active ? GamepadInk.of(palette) : .dark)
-            // The ink alone was never enough. Every SYSTEM-derived colour that lands on these
-            // screens — `.secondary` in a placeholder, a `.bordered` button's chrome, a
-            // NavigationStack's title, a material's frost — resolves against the DEVICE's
-            // appearance, which no part of this app had ever set. On iPhone and Mac that is often
-            // Light, so the pale palettes looked correct by accident; an Apple TV is Dark
-            // essentially always, so on tvOS every one of them came out WHITE on a pale field and
-            // the interface was unreadable. Publishing the scheme here — once, beside the ink it
-            // has to agree with — is what makes a pale palette mean "light" to UIKit too.
-            .environment(\.colorScheme, active ? (palette.light ? .light : .dark) : systemScheme)
+        content.environment(\.gamepadInk, GamepadInk.of(GamepadPalette.named(paletteID)))
     }
 }
 

clients/apple/Sources/PunktfunkClient/Home/GamepadKeyNav.swift

@@ -1,79 +0,0 @@
-// Hardware-keyboard navigation for the gamepad UI (iOS/iPadOS/macOS): arrows move, Return/Space
-// activate, Esc backs out.
-//
-// Asked for by a field user on an iPad ("select games with keyboard arrows, enter to launch"). An
-// iPad on a Magic Keyboard and a couch Mac are the same situation the console layout was built
-// for — a screen driven from a distance with a fixed set of directional inputs — and the whole
-// navigation model (a cursor, a confirm, a back) already exists here for the controller. A
-// keyboard is just a third input onto it, alongside the pad poll and touch.
-//
-// tvOS is excluded: the focus engine already routes hardware-keyboard arrows into focus moves
-// there, and these screens hand it navigation authority on purpose.
-//
-// The view must be FOCUSED to receive key presses, so this takes focus on appear. That is safe on
-// exactly these screens because the gamepad UI has no system text fields to steal it from —
-// GamepadKeyboard is a custom grid of keycaps, not a `TextField`.
-
-import PunktfunkKit
-import SwiftUI
-#if os(iOS) || os(macOS)
-
-extension View {
-    /// Route arrows / Return / Esc into the same handlers the controller poll drives.
-    ///
-    /// `active` mirrors the caller's `isActive` controller gate: a screen that has handed the pad
-    /// to something on top must not keep eating key presses either, or a covered launcher
-    /// navigates behind the screen in front of it.
-    func gamepadKeyNavigation(
-        active: Bool = true,
-        onMove: @escaping (GamepadMenuInput.Direction) -> Void,
-        onConfirm: @escaping () -> Void,
-        onBack: (() -> Void)? = nil
-    ) -> some View {
-        modifier(GamepadKeyNav(active: active, onMove: onMove, onConfirm: onConfirm, onBack: onBack))
-    }
-}
-
-private struct GamepadKeyNav: ViewModifier {
-    let active: Bool
-    let onMove: (GamepadMenuInput.Direction) -> Void
-    let onConfirm: () -> Void
-    let onBack: (() -> Void)?
-
-    @FocusState private var focused: Bool
-
-    func body(content: Content) -> some View {
-        content
-            .focusable(active)
-            // No focus ring: these screens draw their own cursor (the centred card, the focused
-            // row), and a system ring around the whole scroll view on top of it reads as a bug.
-            .focusEffectDisabled()
-            .focused($focused)
-            // Claim focus on appear, and re-claim it whenever this screen becomes the active one
-            // again — a pushed screen popping off leaves the one underneath unfocused.
-            .onAppear { focused = active }
-            .onChange(of: active) { _, nowActive in
-                if nowActive { focused = true }
-            }
-            .onKeyPress(.upArrow) { handle { onMove(.up) } }
-            .onKeyPress(.downArrow) { handle { onMove(.down) } }
-            .onKeyPress(.leftArrow) { handle { onMove(.left) } }
-            .onKeyPress(.rightArrow) { handle { onMove(.right) } }
-            .onKeyPress(.return) { handle(onConfirm) }
-            .onKeyPress(.space) { handle(onConfirm) }
-            .onKeyPress(.escape) {
-                guard let onBack else { return .ignored }
-                return handle(onBack)
-            }
-    }
-
-    /// Run a handler only while this screen owns input, and report back whether the press was
-    /// consumed. `.ignored` matters: an unhandled Esc still has to reach the `.cancelAction`
-    /// shortcut that closes a macOS sheet (see GamepadAddHostView's hidden Cancel button).
-    private func handle(_ action: () -> Void) -> KeyPress.Result {
-        guard active else { return .ignored }
-        action()
-        return .handled
-    }
-}
-#endif

clients/apple/Sources/PunktfunkClient/Home/GamepadKeyboard.swift

@@ -111,9 +111,7 @@ struct GamepadKeyboard: View {
                     .font(.geist(15, .semibold, relativeTo: .callout))
             }
         }
-        // The focused keycap sits on `ink.accent`, so `onAccent` is what reads on it — a dark
-        // accent palette got black-on-dark with the old literal black.
-        .foregroundStyle(focused ? ink.onAccent : ink.fg)
+        .foregroundStyle(focused ? Color.black : ink.fg)
         .frame(maxWidth: .infinity, minHeight: compact ? 34 : 42)
         .background {
             RoundedRectangle(cornerRadius: 9, style: .continuous)

clients/apple/Sources/PunktfunkClient/Home/GamepadLibraryScreen.swift

@@ -1,55 +0,0 @@
-// The library as one of the gamepad shell's in-place layers (iOS): console chrome — a pinned
-// title and a close ✕ styled like the settings screen's — around the shared LibraryView, whose
-// gamepad branch renders the coverflow. The cover presentation used to get its title and Close
-// from the wrapping NavigationStack's bar; a shell layer has no bar, so this restores both in
-// the console's own grammar. Everything data-shaped (the fetch, the loading/error/empty states,
-// the image session lifecycle) stays LibraryView's.
-
-import PunktfunkKit
-import SwiftUI
-#if os(iOS)
-
-struct GamepadLibraryScreen: View {
-    @Environment(\.gamepadInk) private var ink
-    @ObservedObject var store: HostStore
-    let host: StoredHost
-    let onLaunch: (String) -> Void
-    let close: () -> Void
-    var controllerActive = true
-
-    /// `.compact` in a landscape phone window — tighter chrome, like every gamepad screen.
-    @Environment(\.verticalSizeClass) private var vSizeClass
-
-    private var compact: Bool { vSizeClass == .compact }
-
-    var body: some View {
-        LibraryView(
-            store: store, host: host, onLaunch: onLaunch,
-            onClose: close, controllerActive: controllerActive)
-            .safeAreaInset(edge: .top, spacing: 0) {
-                // Leading, like every gamepad heading — no close chrome, B is the exit (the
-                // coverflow's, or LibraryView's own back-catcher before the coverflow exists).
-                Text("\(host.displayName) — Library")
-                    .font(.geist(gamepadTitleSize(compact: compact), .bold, relativeTo: .title))
-                    .foregroundStyle(ink.fg)
-                    .lineLimit(1)
-                    .minimumScaleFactor(0.75)
-                    .frame(maxWidth: .infinity, alignment: .leading)
-                    .padding(.horizontal, 24)
-                    .padding(.top, gamepadTitleTopPadding(compact: compact))
-                    .padding(.bottom, gamepadTitleBottomPadding(compact: compact))
-                    .background { GamepadTrayBlur(edge: .top) }
-            }
-            // A hardware keyboard's Esc still closes, without chrome.
-            .background {
-                Button("Close") { close() }
-                    .keyboardShortcut(.cancelAction)
-                    .buttonStyle(.plain)
-                    .frame(width: 0, height: 0)
-                    .opacity(0)
-                    .accessibilityHidden(true)
-            }
-            .gamepadPaletteInk()
-    }
-}
-#endif

clients/apple/Sources/PunktfunkClient/Home/GamepadMenuList.swift

@@ -119,22 +119,6 @@ struct GamepadMenuList<Item: Identifiable, Row: View>: View where Item.ID: Hasha
         .sensoryFeedback(.selection, trigger: adjustTick)
         .sensoryFeedback(.impact(weight: .medium), trigger: activateTick)
         .sensoryFeedback(.impact(flexibility: .rigid, intensity: 0.7), trigger: boundaryTick)
-        #if os(iOS) || os(macOS)
-        // Hardware keyboard: up/down step the focus bar, left/right adjust the focused row's
-        // value (exactly what the stick does), Return activates, Esc backs out.
-        .gamepadKeyNavigation(
-            active: isActive,
-            onMove: { direction in
-                switch direction {
-                case .up: step(by: -1)
-                case .down: step(by: 1)
-                case .left: adjust(by: -1)
-                case .right: adjust(by: 1)
-                }
-            },
-            onConfirm: { activate() },
-            onBack: onBack)
-        #endif
         .onAppear {
             reconcile()
             wire()

clients/apple/Sources/PunktfunkClient/Home/GamepadPrompt.swift

@@ -1,230 +0,0 @@
-// The gamepad UI's answer to a system alert / confirmation dialog (iOS/iPadOS/macOS).
-//
-// `.alert` and `.confirmationDialog` are UIKit/AppKit surfaces. A game controller cannot move
-// through their buttons or press one — so on iOS/macOS every prompt in the connect path was a dead
-// end for a pad-only user, and they are not incidental prompts:
-//
-//   - "Pairing required" (Request Access / Pair with PIN…) is the FIRST thing an unpaired host
-//     shows. Pairing was unreachable before it even got to the PIN.
-//   - "Connection failed" strands the console UI behind a modal only a finger can dismiss.
-//   - "Waiting for approval" owns the only Cancel for a connect that may never complete.
-//
-// tvOS keeps the system alerts: the focus engine drives them natively there, which is the whole
-// reason this gap was tvOS-invisible.
-//
-// Deliberately NOT built on GamepadMenuList: that is a ScrollView (right for a settings screen of
-// unknown length, wrong for two buttons in a card, where it would need an invented height and
-// could clip). A prompt has two or three actions, so it owns a plain VStack and a cursor.
-
-import PunktfunkKit
-import SwiftUI
-#if os(iOS) || os(macOS)
-
-/// One choice in a console prompt.
-struct GamepadPromptAction: Identifiable {
-    let id: String
-    let title: String
-    /// This is the action B (and Esc) performs, and the one the cursor opens on. Exactly one
-    /// action should carry it — `GamepadPrompt` falls back to the LAST action when none does,
-    /// which matches how a system alert treats its cancel role.
-    var isCancel = false
-    /// Drawn as the primary, accent-tinted row. At most one.
-    var isPrimary = false
-    let run: () -> Void
-}
-
-/// A prompt to show over the console UI: what happened, and what can be done about it.
-struct GamepadPrompt: Identifiable {
-    let id: String
-    let title: String
-    let message: String
-    let actions: [GamepadPromptAction]
-    /// A wait with no outcome yet (the delegated-approval hold) shows a spinner beside the title —
-    /// the prompt is the UI for something still in flight, not a report that it finished.
-    var busy = false
-}
-
-/// The prompt, worn as the console's own modal: a dimmed field, a glass card, a focus list of
-/// actions, and the same legend every other gamepad screen carries.
-struct GamepadPromptView: View {
-    @Environment(\.gamepadInk) private var ink
-    @Environment(\.gamepadMetrics) private var metrics
-    let prompt: GamepadPrompt
-
-    @State private var cursor = 0
-    @State private var input = GamepadMenuInput(manager: .shared)
-    @State private var haptics = MenuHaptics(manager: .shared)
-    /// `.sensoryFeedback` counters — device ticks for confirm and for a refused move at an end.
-    @State private var activateTick = 0
-    @State private var boundaryTick = 0
-
-    #if os(iOS)
-    @Environment(\.verticalSizeClass) private var vSizeClass
-
-    private var compact: Bool { vSizeClass == .compact }
-    #else
-    private let compact = false
-    #endif
-
-    var body: some View {
-        ZStack {
-            // Swallows touch to the launcher behind it, which is also gated out of the controller
-            // poll for as long as this is up (ContentView's `promptActive`).
-            Rectangle()
-                .fill(.black.opacity(0.55))
-                .ignoresSafeArea()
-                .contentShape(Rectangle())
-                .onTapGesture {}
-            card
-        }
-        .sensoryFeedback(.selection, trigger: cursor)
-        .sensoryFeedback(.impact(weight: .medium), trigger: activateTick)
-        .sensoryFeedback(.impact(flexibility: .rigid, intensity: 0.7), trigger: boundaryTick)
-        // A prompt is exactly where a keyboard user gets stuck, so it takes arrows/Return/Esc too.
-        .gamepadKeyNavigation(
-            onMove: { direction in
-                switch direction {
-                case .up: step(by: -1)
-                case .down: step(by: 1)
-                case .left, .right: break
-                }
-            },
-            onConfirm: { activate() },
-            onBack: { back() })
-        .onAppear {
-            cursor = prompt.actions.firstIndex(where: \.isCancel) ?? max(prompt.actions.count - 1, 0)
-            wire()
-            input.start()
-        }
-        // The prompt's identity is stable across a message change (same `id`), so re-wire rather
-        // than rely on a remount: the stored closures captured the OLD actions array.
-        .onChange(of: prompt.actions.map(\.id)) { _, _ in
-            cursor = min(cursor, max(prompt.actions.count - 1, 0))
-            wire()
-        }
-        .onDisappear {
-            input.stop()
-            haptics.stop()
-        }
-    }
-
-    private var card: some View {
-        VStack(alignment: .leading, spacing: 14) {
-            HStack(spacing: 10) {
-                if prompt.busy {
-                    ProgressView().controlSize(.small).tint(ink.fg(0.8))
-                }
-                Text(prompt.title)
-                    .font(.geist(compact ? 19 : 22, .bold, relativeTo: .title3))
-                    .foregroundStyle(ink.fg)
-            }
-            Text(prompt.message)
-                .font(.geist(metrics.detailFont, relativeTo: .callout))
-                .foregroundStyle(ink.fg(0.62))
-                .fixedSize(horizontal: false, vertical: true)
-            VStack(spacing: 6) {
-                ForEach(Array(prompt.actions.enumerated()), id: \.element.id) { idx, action in
-                    actionRow(action, focused: idx == cursor)
-                        .contentShape(Rectangle())
-                        .onTapGesture { tap(idx) }
-                }
-            }
-            .padding(.top, 2)
-            GamepadHintBar(hints: hints)
-        }
-        .padding(compact ? 20 : 26)
-        .frame(maxWidth: 460)
-        .consoleGlass(RoundedRectangle(cornerRadius: 24, style: .continuous))
-        .overlay {
-            RoundedRectangle(cornerRadius: 24, style: .continuous)
-                .strokeBorder(ink.fg(0.12), lineWidth: 1)
-        }
-        .padding(24)
-    }
-
-    private func actionRow(_ action: GamepadPromptAction, focused: Bool) -> some View {
-        let m = metrics
-        return Text(action.title)
-            .font(.geist(m.labelFont, .semibold, relativeTo: .body))
-            .foregroundStyle(action.isPrimary ? ink.accent : ink.fg)
-            .frame(maxWidth: .infinity)
-            .padding(.horizontal, m.rowHPad)
-            .padding(.vertical, m.rowVPad)
-            .consoleGlass(
-                RoundedRectangle(cornerRadius: m.rowCorner, style: .continuous),
-                tint: focused ? ink.accent(0.30) : nil,
-                interactive: focused)
-            .overlay {
-                RoundedRectangle(cornerRadius: m.rowCorner, style: .continuous)
-                    .strokeBorder(ink.fg(focused ? 0.28 : 0.06), lineWidth: 1)
-            }
-            .scaleEffect(focused ? 1.0 : 0.98)
-            .animation(.smooth(duration: 0.18), value: focused)
-    }
-
-    private var hints: [GamepadHint] {
-        var hints: [GamepadHint] = [.init(
-            glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Select",
-            action: { activate() })]
-        // Only where B has somewhere to go: a one-action prompt ("OK") is dismissed by that
-        // action, and B does it too — naming it twice would just be noise.
-        if prompt.actions.count > 1, let cancel = prompt.actions.first(where: \.isCancel) {
-            hints.append(.init(
-                glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: cancel.title,
-                action: { back() }))
-        }
-        return hints
-    }
-
-    // MARK: - Input
-
-    private func wire() {
-        input.onMove = { direction in
-            switch direction {
-            case .up: step(by: -1)
-            case .down: step(by: 1)
-            // A prompt's actions are a vertical list; left/right have nothing to mean here, and
-            // silently treating them as up/down would make a nudged stick pick a different button.
-            case .left, .right: break
-            }
-        }
-        input.onConfirm = { activate() }
-        input.onBack = { back() }
-    }
-
-    private func step(by delta: Int) {
-        let target = cursor + delta
-        guard target >= 0, target < prompt.actions.count else {
-            boundaryTick &+= 1
-            haptics.boundary()
-            return
-        }
-        cursor = target
-        haptics.move()
-    }
-
-    private func activate() {
-        guard cursor >= 0, cursor < prompt.actions.count else { return }
-        activateTick &+= 1
-        haptics.confirm()
-        prompt.actions[cursor].run()
-    }
-
-    /// B: the cancel action, else the last one — the same fallback a system alert applies when
-    /// nothing carries the cancel role, so B always has a way out rather than doing nothing.
-    private func back() {
-        guard let action = prompt.actions.first(where: \.isCancel) ?? prompt.actions.last
-        else { return }
-        activateTick &+= 1
-        haptics.confirm()
-        action.run()
-    }
-
-    /// Touch fallback matching the rest of the gamepad UI: a tap focuses AND activates.
-    private func tap(_ idx: Int) {
-        guard idx >= 0, idx < prompt.actions.count else { return }
-        cursor = idx
-        activate()
-    }
-}
-#endif

clients/apple/Sources/PunktfunkClient/Home/GamepadShell.swift

@@ -1,97 +0,0 @@
-// The gamepad UI's screen-shell vocabulary (iOS): which screen sits over the launcher, and the
-// console push/pop choreography that presents it. On iOS the launcher's sub-screens (settings,
-// add-host, library) are NOT system covers — they are transparent layers composited in
-// GamepadHomeView's ZStack over ONE persistent living backdrop, exactly the model
-// `pf-console-ui`'s shell renders on the desktop clients: a push slides the incoming screen up
-// out of a fade while the outgoing one recedes; a pop mirrors it; the field underneath never
-// moves and never leaves. A system `fullScreenCover` — an opaque sheet sliding up from the
-// bottom edge, mounting its own backdrop — was exactly the wrong grammar for a console.
-// (macOS keeps its windowed sheets and tvOS its focus-engine covers; this file's motion
-// constants are iOS-only in practice, but compile everywhere for the shared call sites.)
-
-import PunktfunkKit
-import SwiftUI
-#if os(iOS) || os(macOS) || os(tvOS)
-
-/// The screen the shell currently shows over the launcher. Derived, not stored: the presentation
-/// triggers (`showSettings`, `showAddHost`, `libraryTarget`) stay authoritative on every
-/// platform — this enum is just their iOS rendering. Depth is ≤ 1 by construction (the settings
-/// pin picker is an in-screen layer, and every trigger is only reachable from the launcher), so
-/// there is no stack to model.
-enum GamepadScreen: Identifiable {
-    case settings
-    case addHost
-    case pair(StoredHost)
-    case library(StoredHost)
-
-    var id: String {
-        switch self {
-        case .settings: return "settings"
-        case .addHost: return "addHost"
-        case .pair(let host): return "pair-\(host.id.uuidString)"
-        case .library(let host): return "library-\(host.id.uuidString)"
-        }
-    }
-
-    /// The backdrop's calm target while this screen is up: the form screens quiet the field
-    /// (`Bg::Form` in the console); the library keeps the launcher's full aurora.
-    var isForm: Bool {
-        switch self {
-        case .settings, .addHost, .pair: return true
-        case .library: return false
-        }
-    }
-}
-
-/// The console shell's motion constants, mapped to SwiftUI. Source of truth:
-/// `crates/pf-console-ui/src/shell/render.rs` (push/pop) and `shell.rs` (`TRANSITION_S`).
-enum GamepadShellMotion {
-    /// One transition, both layers — the console's `TRANSITION_S`.
-    static let duration: TimeInterval = 0.26
-    /// `1-(1-t)³` as a bezier: the standard ease-out-cubic control points.
-    static let screen = Animation.timingCurve(0.33, 1, 0.68, 1, duration: duration)
-    /// The backdrop's calm chase. The console runs an exponential approach (τ 0.12 s); the same
-    /// ease-out at 0.30 s lands within a few percent of it and settles together with the screen.
-    static let calm = Animation.timingCurve(0.33, 1, 0.68, 1, duration: 0.30)
-    /// The push/pop travel — the console's `36 * k`, k-floored for a landscape phone.
-    static func slide(compact: Bool) -> CGFloat { compact ? 27 : 36 }
-    /// The incoming screen grows from this; the revealed launcher grows back from `underScale`.
-    static let inScale: CGFloat = 0.985
-    static let underScale: CGFloat = 0.96
-}
-
-extension AnyTransition {
-    /// The console push/pop for the top layer. Insertion: up out of a fade, growing from 0.985.
-    /// Removal: down into a fade at full size (the console's pop leaves scale alone). The
-    /// launcher's recede underneath is NOT a transition — it never unmounts — it is the
-    /// `covered` opacity/scale in GamepadHomeView, animated in the same transaction.
-    ///
-    /// Known deviation from the console: a pop there re-reveals the launcher from α 0.4; a
-    /// SwiftUI opacity animates from 0. Same duration, same landing — the revealed screen just
-    /// reads a beat later in the fade, not worth an explicitly-driven progress machine.
-    static func gamepadScreen(slide: CGFloat) -> AnyTransition {
-        .asymmetric(
-            insertion: .opacity
-                .combined(with: .offset(y: slide))
-                .combined(with: .scale(scale: GamepadShellMotion.inScale)),
-            removal: .opacity.combined(with: .offset(y: slide)))
-    }
-}
-
-private struct GamepadHostedInShellKey: EnvironmentKey {
-    static let defaultValue = false
-}
-
-extension EnvironmentValues {
-    /// True for a screen mounted as one of the shell's layers: it must NOT mount its own
-    /// backdrop (the shell's single persistent field is behind everything already — a second
-    /// one would double the mesh cost and break the "field never moves" illusion). The same
-    /// screens presented as macOS sheets / tvOS covers read the default `false` and keep
-    /// mounting their own, exactly as before.
-    var gamepadHostedInShell: Bool {
-        get { self[GamepadHostedInShellKey.self] }
-        set { self[GamepadHostedInShellKey.self] = newValue }
-    }
-}
-
-#endif

clients/apple/Sources/PunktfunkClient/Home/LibraryCoverflowView.swift

@@ -21,16 +21,11 @@ import GameController
 struct LibraryCoverflowView: View {
     @Environment(\.gamepadInk) private var ink
     let games: [GameEntry]
-    let artLoader: LibraryArtLoader?
+    let imageSession: URLSession?
     var onLaunch: ((String) -> Void)?
     /// Button B (back) — dismisses the library screen. No touch equivalent needed here (the toolbar
     /// Close button already covers that); this is what makes gamepad-only exit possible.
     var onDismiss: (() -> Void)?
-    /// Whether the carousel owns the controller — the in-place shell gates it (mid-transition,
-    /// and under the connect takeover after A launches a title, where this coverflow used to
-    /// keep polling underneath). Cover/sheet presentations keep the default.
-    var controllerActive = true
-    @Environment(\.gamepadHostedInShell) private var hostedInShell
 
     #if os(iOS)
     /// `.compact` in a landscape phone window — drives a tighter poster so everything still fits.
@@ -41,18 +36,6 @@ struct LibraryCoverflowView: View {
     private let compact = false // no size classes on macOS
     #endif
     @State private var selection: String?
-    /// How many covers have settled (art loaded, or every candidate exhausted).
-    @State private var artSettled = 0
-    /// The backstop below has fired: play the entrance regardless of what the art is doing.
-    @State private var artWaitOver = false
-
-    /// Whether the strip may play its entrance yet. Cards swinging in as grey placeholders and
-    /// then filling with artwork afterwards is the whole effect wasted, so the entrance waits for
-    /// the first few covers — every poster is fetched in parallel, so those land together and
-    /// cover the visible strip. The wait is capped: a slow or artless library still animates.
-    private var contentReady: Bool {
-        artWaitOver || artSettled >= min(4, games.count)
-    }
 
     var body: some View {
         GeometryReader { geo in
@@ -63,19 +46,10 @@ struct LibraryCoverflowView: View {
                 .padding(.leading, 22)
                 .padding(.vertical, compact ? 6 : 10)
         }
-        // Hosted in the shell, the field is the shell's own persistent aurora (the library is
-        // an aurora screen — the calm mix simply stays 0, so nothing even chases).
-        .background {
-            if !hostedInShell { GamepadScreenBackground() }
-        }
+        .background { GamepadScreenBackground() }
         // Publish the palette's ink to this screen (text, glass, accent, scrims) — a
         // pale palette flips all of them, and no leaf should have to read the setting.
         .gamepadPaletteInk()
-        // The entrance's backstop (see `contentReady`).
-        .task {
-            try? await Task.sleep(for: .milliseconds(700))
-            artWaitOver = true
-        }
     }
 
     @ViewBuilder private func content(for size: CGSize) -> some View {
@@ -107,11 +81,9 @@ struct LibraryCoverflowView: View {
             spacing: 34,
             onActivate: { onLaunch?($0.id) },
             onBack: { onDismiss?() },
-            shoulderJump: 5,
-            isActive: controllerActive,
-            contentReady: contentReady
-        ) { game, entrance in
-            cover(game, width: coverWidth, height: coverHeight, entrance: entrance)
+            shoulderJump: 5
+        ) { game in
+            cover(game, width: coverWidth, height: coverHeight)
         }
         .frame(height: coverHeight + 44)
     }
@@ -120,26 +92,18 @@ struct LibraryCoverflowView: View {
     /// per-frame `phase` (real distance-from-centered), so the tilt tracks what's actually on screen
     /// mid-scroll. `.shadow` isn't a `VisualEffect`, so it's baked constant into the card; the
     /// scale/rotation/opacity ramp already makes the centered cover prominent.
-    private func cover(
-        _ game: GameEntry, width: CGFloat, height: CGFloat, entrance: CardEntrance
-    ) -> some View {
-        PosterImage(
-            candidates: game.art.posterCandidates, title: game.title, loader: artLoader,
-            onLoaded: { artSettled += 1 })
+    private func cover(_ game: GameEntry, width: CGFloat, height: CGFloat) -> some View {
+        PosterImage(candidates: game.art.posterCandidates, title: game.title, session: imageSession)
             .frame(width: width, height: height)
             .clipShape(RoundedRectangle(cornerRadius: 16, style: .continuous))
             .overlay(alignment: .topLeading) {
-                // `solid`: a frosted chip can't sample a backdrop through this card's own
-                // composited transform, so it would only show up on the centred card.
-                StoreBadge(label: game.storeLabel, isLauncher: game.isLauncher, solid: true)
+                StoreBadge(label: game.storeLabel, isLauncher: game.isLauncher)
             }
             .overlay {
                 RoundedRectangle(cornerRadius: 16, style: .continuous)
                     .strokeBorder(ink.fg(0.12), lineWidth: 1)
             }
-            .shadow(color: ink.shadow(0.5), radius: 16, y: 12)
-            // Beneath the scroll transition, never around it — see CardEntrance.
-            .modifier(entrance)
+            .shadow(color: .black.opacity(0.5), radius: 16, y: 12)
             .scrollTransition { content, phase in
                 let v = phase.value
                 let d = CGFloat(min(abs(v), 1))
@@ -204,19 +168,13 @@ struct LibraryCoverflowView: View {
 
     private var hints: [GamepadHint] {
         var hints: [GamepadHint] = []
-        if let onLaunch {
+        if onLaunch != nil {
             // You *open* a launcher and *launch* a game — the hint follows the focused entry.
             let opens = games.first { $0.id == selection }?.isLauncher == true
-            hints.append(.init(
-                glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: opens ? "Open" : "Launch",
-                // Reads `selection` when it fires, not when the legend was built (see the
-                // launcher's twin) — and does nothing with no title centred, which is exactly
-                // what A does.
-                action: { if let id = selection { onLaunch(id) } }))
+            hints.append(
+                .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: opens ? "Open" : "Launch"))
         }
-        hints.append(.init(
-            glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Close",
-            action: { onDismiss?() }))
+        hints.append(.init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Close"))
         return hints
     }
 }

clients/apple/Sources/PunktfunkClient/Home/LibraryView.swift

@@ -12,39 +12,23 @@ struct LibraryView: View {
     /// Tapping a title starts a session that asks the host to launch it (the library id is passed
     /// through). `nil` ⇒ browse-only (cards aren't tappable).
     var onLaunch: ((String) -> Void)? = nil
-    /// How the gamepad shell (GamepadLibraryScreen) closes this screen; nil — every sheet/cover
-    /// presentation — falls back to the environment dismiss.
-    var onClose: (() -> Void)? = nil
-    /// Whether the gamepad coverflow owns the controller — the shell gates it during a push/pop
-    /// and while the connect takeover is up. Presentations that cover the launcher keep the
-    /// default (their being up IS the launcher's gate).
-    var controllerActive = true
     @Environment(\.dismiss) private var dismiss
 
     @State private var games: [GameEntry] = []
     @State private var loading = false
     @State private var errorText: String?
-    /// Cover-art loader (the same paired identity + host pinning as the list fetch, reused across
-    /// every poster in the grid). Built alongside `games` in `load()`; dropped on disappear.
-    @State private var artLoader: LibraryArtLoader?
-    #if os(iOS) || os(macOS)
-    /// The plain grid's hardware-keyboard cursor (a game id), and the grid width the column count
-    /// is derived from. nil until the first arrow press, so a touch user never sees a selection
-    /// they didn't ask for.
-    @State private var keyCursor: String?
-    @State private var gridWidth: CGFloat = 0
-    #endif
+    /// Authenticated session for cover-art fetches (the same paired identity + host pinning as the
+    /// list fetch, reused across every poster in the grid). Built alongside `games` in `load()`;
+    /// torn down on disappear since it isn't one-shot like `LibraryClient.fetch`'s own session.
+    @State private var imageSession: URLSession?
     #if os(iOS) || os(macOS) || os(tvOS)
     // Gamepad-driven browsing — see ContentView's identical gate. With no controller (or the
     // setting off) every platform keeps the plain-grid presentation of this same view.
     @ObservedObject private var gamepadManager = GamepadManager.shared
     @AppStorage(DefaultsKey.gamepadUIEnabled) private var gamepadUIEnabled = true
-    @AppStorage(DefaultsKey.gamepadUIMode) private var gamepadUIMode =
-        GamepadUIEnvironment.modeWhenConnected
     private var gamepadUIActive: Bool {
         GamepadUIEnvironment.isActive(
-            gamepadConnected: gamepadManager.active != nil, enabledSetting: gamepadUIEnabled,
-            mode: gamepadUIMode)
+            gamepadConnected: gamepadManager.active != nil, enabledSetting: gamepadUIEnabled)
     }
     #endif
 
@@ -71,33 +55,9 @@ struct LibraryView: View {
             }
             .task { await load() }
             .onDisappear {
-                // Hand the loader off before clearing it, so its pooled connections are closed
-                // rather than left open on a screen the user has left.
-                let leaving = artLoader
-                artLoader = nil
-                Task { await leaving?.close() }
+                imageSession?.finishTasksAndInvalidate()
+                imageSession = nil
             }
-            #if os(iOS) || os(macOS)
-            // B closes the library even before the coverflow exists (loading / error / empty):
-            // the coverflow's carousel owns B once games render; until then this zero-size
-            // listener does — without it a controller-only user is trapped on an error screen
-            // (the gamepad screens carry no close chrome).
-            .background {
-                if gamepadUIActive && games.isEmpty {
-                    LibraryBackCatcher(active: controllerActive) { (onClose ?? { dismiss() })() }
-                }
-            }
-            #endif
-            #if os(iOS) || os(macOS) || os(tvOS)
-            // Published HERE, not just inside the coverflow, because the coverflow is only one of
-            // four things this view renders: the loading spinner, the error state and the empty
-            // state sit above it, as do the navigation title and toolbar. On iOS those are wrapped
-            // by GamepadLibraryScreen, which inks the whole thing; tvOS and macOS present this view
-            // directly in a NavigationStack, so under a pale palette every one of them kept the
-            // system's own (dark, on an Apple TV) chrome over a light field. Off when the gamepad
-            // UI isn't drawing — the plain grid belongs to the system background.
-            .gamepadPaletteInk(gamepadUIActive)
-            #endif
     }
 
     @ViewBuilder private var content: some View {
@@ -111,9 +71,8 @@ struct LibraryView: View {
         } else {
             if gamepadUIActive {
                 LibraryCoverflowView(
-                    games: games, artLoader: artLoader, onLaunch: onLaunch,
-                    onDismiss: { (onClose ?? { dismiss() })() },
-                    controllerActive: controllerActive)
+                    games: games, imageSession: imageSession, onLaunch: onLaunch,
+                    onDismiss: { dismiss() })
             } else {
                 grid
             }
@@ -127,103 +86,34 @@ struct LibraryView: View {
         let launchers = games.filter(\.isLauncher)
         let titles = games.filter { !$0.isLauncher }
         let both = !launchers.isEmpty && !titles.isEmpty
-        return ScrollViewReader { proxy in
-            ScrollView {
-                VStack(alignment: .leading, spacing: 18) {
-                    if !launchers.isEmpty {
-                        if both { sectionHeader("Launchers") }
-                        tiles(launchers)
-                    }
-                    if !titles.isEmpty {
-                        if both { sectionHeader("Games") }
-                        tiles(titles)
-                    }
+        return ScrollView {
+            VStack(alignment: .leading, spacing: 18) {
+                if !launchers.isEmpty {
+                    if both { sectionHeader("Launchers") }
+                    tiles(launchers)
                 }
-                .padding()
-                #if os(iOS) || os(macOS)
-                // The grid's own width, reported without affecting layout — a GeometryReader
-                // SIBLING inside a ScrollView would claim the whole viewport. It's what tells the
-                // keyboard cursor how many columns `.adaptive` actually produced, so it is only
-                // measured where that cursor exists.
-                .background {
-                    GeometryReader { geo in
-                        Color.clear
-                            .onAppear { gridWidth = geo.size.width }
-                            .onChange(of: geo.size.width) { _, w in gridWidth = w }
-                    }
+                if !titles.isEmpty {
+                    if both { sectionHeader("Games") }
+                    tiles(titles)
                 }
-                #endif
             }
-            #if os(iOS) || os(macOS)
-            // Hardware keyboard: arrows pick a title, Return launches it — a field ask from an
-            // iPad user on a Magic Keyboard. The gamepad UI's coverflow has had this via the
-            // controller all along; this is the same thing for the plain grid, which is what an
-            // iPad with a keyboard and NO pad actually sees.
-            .gamepadKeyNavigation(
-                active: onLaunch != nil,
-                onMove: { direction in
-                    guard let next = gridNav(launchers: launchers, titles: titles)
-                        .move(from: keyCursor, direction) else { return }
-                    keyCursor = next
-                    withAnimation(.easeOut(duration: 0.18)) { proxy.scrollTo(next, anchor: .center) }
-                },
-                onConfirm: {
-                    guard let onLaunch, let id = keyCursor else { return }
-                    onLaunch(id)
-                })
-            #endif
+            .padding()
         }
     }
 
-    #if os(iOS) || os(macOS)
-    /// The keyboard cursor's model over the two grid sections. Rebuilt per press from the live
-    /// sections so it can never point into a stale list.
-    private func gridNav(launchers: [GameEntry], titles: [GameEntry]) -> LibraryGridNav {
-        LibraryGridNav(
-            sections: [launchers, titles].filter { !$0.isEmpty }.map { $0.map(\.id) },
-            columns: columnCount)
-    }
-
-    /// How many columns `.adaptive(minimum:spacing:)` fits into the measured width — the same
-    /// arithmetic the layout does, so up/down move exactly one visual row rather than a guess.
-    /// Falls back to one column before the first measurement lands.
-    private var columnCount: Int {
-        let minimum: CGFloat = 130 // matches `columns` below on iOS/macOS
-        let spacing: CGFloat = 18
-        // The VStack's `.padding()` is inside the measured width, so take it back off.
-        let usable = gridWidth - 32
-        guard usable > 0 else { return 1 }
-        return max(1, Int((usable + spacing) / (minimum + spacing)))
-    }
-    #endif
-
     private func tiles(_ entries: [GameEntry]) -> some View {
         LazyVGrid(columns: columns, spacing: 18) {
             ForEach(entries) { game in
                 if let onLaunch {
-                    Button { onLaunch(game.id) } label: {
-                        GameCard(game: game, artLoader: artLoader, selected: isKeyCursor(game))
-                    }
-                    .buttonStyle(.plain)
-                    .id(game.id)
+                    Button { onLaunch(game.id) } label: { GameCard(game: game, imageSession: imageSession) }
+                        .buttonStyle(.plain)
                 } else {
-                    GameCard(game: game, artLoader: artLoader, selected: isKeyCursor(game))
-                        .id(game.id)
+                    GameCard(game: game, imageSession: imageSession)
                 }
             }
         }
     }
 
-    /// Whether the keyboard cursor is on this tile (always false where there is no keyboard
-    /// navigation to have moved it).
-    private func isKeyCursor(_ game: GameEntry) -> Bool {
-        #if os(iOS) || os(macOS)
-        keyCursor == game.id
-        #else
-        false
-        #endif
-    }
-
     private func sectionHeader(_ text: String) -> some View {
         Text(text)
             .font(.geist(12, .semibold, relativeTo: .caption))
@@ -297,7 +187,8 @@ struct LibraryView: View {
                 keyPEM: identity.keyPEM,
                 hostFingerprint: current.pinnedSHA256
             ).launchersFirst
-            artLoader = try LibraryArtLoader(
+            imageSession?.finishTasksAndInvalidate()
+            imageSession = try LibraryImageLoader.session(
                 address: current.address,
                 port: current.effectiveMgmtPort,
                 certPEM: identity.certPEM,
@@ -311,51 +202,18 @@ struct LibraryView: View {
     }
 }
 
-#if os(iOS) || os(macOS)
-/// Zero-size controller listener for the library's pre-coverflow states — B backs out. The same
-/// shape as ConnectOverlay's `ConnectControllerInput`; `GamepadMenuInput.needsSnapshot` swallows
-/// the held press that opened the screen. Unmounts the moment the coverflow (and its own B) is up.
-private struct LibraryBackCatcher: View {
-    let active: Bool
-    let onBack: () -> Void
-    @State private var input = GamepadMenuInput(manager: .shared)
-
-    var body: some View {
-        Color.clear
-            .frame(width: 0, height: 0)
-            .onAppear {
-                input.onBack = onBack
-                if active { input.start() }
-            }
-            .onChange(of: active) { _, nowActive in
-                if nowActive { input.start() } else { input.stop() }
-            }
-            .onDisappear { input.stop() }
-    }
-}
-#endif
-
 /// One poster tile. Steam vs custom is marked with a badge; the art walks the candidate URLs
 /// (portrait → header → hero) and finally a text placeholder.
 private struct GameCard: View {
     let game: GameEntry
-    let artLoader: LibraryArtLoader?
-    /// The hardware-keyboard cursor is on this tile — drawn as an accent ring, since the plain
-    /// grid has no other way to say "Return launches THIS one".
-    var selected = false
+    let imageSession: URLSession?
 
     var body: some View {
         VStack(alignment: .leading, spacing: 6) {
-            PosterImage(candidates: game.art.posterCandidates, title: game.title, loader: artLoader)
+            PosterImage(candidates: game.art.posterCandidates, title: game.title, session: imageSession)
                 .aspectRatio(2.0 / 3.0, contentMode: .fit)
                 .frame(maxWidth: .infinity)
                 .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
-                .overlay {
-                    if selected {
-                        RoundedRectangle(cornerRadius: 10, style: .continuous)
-                            .strokeBorder(.tint, lineWidth: 3)
-                    }
-                }
                 .overlay(alignment: .topLeading) {
                     StoreBadge(label: game.storeLabel, isLauncher: game.isLauncher)
                 }

clients/apple/Sources/PunktfunkClient/Home/LibraryWidgets.swift

@@ -17,29 +17,16 @@ struct StoreBadge: View {
     /// A launcher entry (design D4) gets the brand fill, so "opens Steam" is legible at poster size
     /// without reading the title.
     var isLauncher: Bool = false
-    /// Fill the chip with a flat wash instead of a frosted material.
-    ///
-    /// The coverflow MUST pass true. Its cards ride a `.scrollTransition` that composites them
-    /// with `opacity < 1` and a 3D rotation, and a material cannot sample a backdrop through an
-    /// offscreen composite — so the frost stayed blank on every card and only appeared on the one
-    /// card sitting at exactly full opacity in the centre, reading as a flash on focus. A flat
-    /// wash has no backdrop to sample: it is simply always there. (Deliberately black, not
-    /// palette ink: the chip sits on cover art, whose colours the palette has no business
-    /// fighting.)
-    var solid: Bool = false
-
-    private var fill: AnyShapeStyle {
-        if isLauncher { return AnyShapeStyle(Color.brand) }
-        return solid ? AnyShapeStyle(Color.black.opacity(0.58)) : AnyShapeStyle(.ultraThinMaterial)
-    }
 
     var body: some View {
         Text(label)
             .font(.geist(11, .semibold, relativeTo: .caption2))
-            .foregroundStyle(isLauncher || solid ? AnyShapeStyle(.white) : AnyShapeStyle(.primary))
+            .foregroundStyle(isLauncher ? AnyShapeStyle(.white) : AnyShapeStyle(.primary))
             .padding(.horizontal, 6)
             .padding(.vertical, 3)
-            .background(fill, in: Capsule())
+            .background(
+                isLauncher ? AnyShapeStyle(Color.brand) : AnyShapeStyle(.ultraThinMaterial),
+                in: Capsule())
             .padding(6)
     }
 }
@@ -60,8 +47,8 @@ private extension Image {
     }
 }
 
-/// Sequentially tries cover-art URLs over `loader` (so a paired client can reach the host's own
-/// art proxy, not just public CDNs — see `LibraryArtLoader`), advancing past any that fail to
+/// Sequentially tries cover-art URLs over `session` (so a paired client can reach the host's own
+/// art proxy, not just public CDNs — see `LibraryImageLoader`), advancing past any that fail to
 /// load, then a placeholder. The loaded image is hard-clipped to fill the card's actual frame
 /// regardless of its own aspect ratio: a portrait capsule fills it as intended, but a fallback
 /// banner (wide hero/header art, used when a title has no portrait capsule) would otherwise report
@@ -70,11 +57,7 @@ private extension Image {
 struct PosterImage: View {
     let candidates: [URL]
     let title: String
-    let loader: LibraryArtLoader?
-    /// Fires once this poster has settled — art loaded, or every candidate exhausted and the
-    /// placeholder is what it will be. The gamepad coverflow waits on a few of these before
-    /// playing its entrance, so the cards swing in carrying artwork rather than grey rectangles.
-    var onLoaded: (() -> Void)?
+    let session: URLSession?
     @State private var index = 0
     @State private var image: PlatformImage?
 
@@ -84,38 +67,26 @@ struct PosterImage: View {
                 Image(platformImage: image)
                     .resizable()
                     .scaledToFill()
-                    .transition(.opacity)
             } else if index < candidates.count {
                 ZStack { placeholder; ProgressView() }
-                    .transition(.opacity)
             } else {
                 placeholder
-                    .transition(.opacity)
             }
         }
-        // Art crosses over its placeholder instead of replacing it between two frames. Cover
-        // fetches land one by one, so without this a freshly opened library is a run of cards
-        // visibly snapping from grey to artwork after the strip has already settled.
-        .animation(.easeOut(duration: 0.3), value: image != nil)
         .frame(maxWidth: .infinity, maxHeight: .infinity)
         .clipped()
         .task(id: index) { await loadCurrent() }
     }
 
     private func loadCurrent() async {
-        // Past the end: the placeholder IS the final look, so this poster has settled.
-        guard index < candidates.count else {
-            onLoaded?()
-            return
-        }
-        guard let loader, let data = try? await loader.data(for: candidates[index]),
+        guard index < candidates.count else { return }
+        guard let session, let data = try? await session.data(from: candidates[index]).0,
               let loaded = PlatformImage(data: data)
         else {
             index += 1 // advance to the next candidate (or past the end → placeholder)
             return
         }
         image = loaded
-        onLoaded?()
     }
 
     private var placeholder: some View {

clients/apple/Sources/PunktfunkClient/Intents/SessionShortcuts.swift

@@ -1,8 +1,7 @@
 // Siri / Shortcuts / Spotlight surface (design §M4, extended by client-deep-links.md §6).
 // Deliberately thin: every action already has an internal entry point — the deep-link router
-// (connect / connect-and-launch / connect-with-a-profile, and the `browse` route into a host's
-// library), the in-process end-session hook, and the existing Wake-on-LAN path — so these
-// intents only wrap them.
+// (connect / connect-and-launch / connect-with-a-profile), the in-process end-session hook, and
+// the existing Wake-on-LAN path — so these intents only wrap them.
 //
 // Connect and Wake compile on macOS and tvOS too: AppIntents is genuinely available there
 // (macOS 13+ / tvOS 16+), and "Stream Desktop with Work" from Spotlight on a Mac is part of the
@@ -52,28 +51,6 @@ struct ConnectToHostIntent: AppIntent {
     }
 }
 
-/// Jump straight into a host's game library — no session. Foregrounds the app and routes the
-/// `browse` route through the same `.onOpenURL` path a widget tap uses, which drives the one
-/// `libraryTarget` every surface shares — so the shortcut lands in whichever library presentation
-/// the current mode owns: the gamepad console's library screen when the gamepad UI is active, the
-/// touch/desktop library otherwise. A session starts only when a title is picked there.
-struct OpenLibraryIntent: AppIntent {
-    static let title: LocalizedStringResource = "Open Game Library"
-    static let description = IntentDescription(
-        "Open a host's game library in Punktfunk, without starting a stream.")
-    static let openAppWhenRun = true
-
-    @Parameter(title: "Host") var host: HostEntity
-
-    func perform() async throws -> some IntentResult {
-        let url = DeepLink.browse(host: host.id).url
-        await MainActor.run {
-            NotificationCenter.default.post(name: .punktfunkOpenDeepLink, object: url)
-        }
-        return .result()
-    }
-}
-
 /// Wake a sleeping host (magic packet). No `openAppWhenRun` — usable in automations ("when I get
 /// home, wake the tower") without foregrounding the app.
 struct WakeHostIntent: AppIntent {
@@ -120,13 +97,6 @@ struct PunktfunkShortcuts: AppShortcutsProvider {
                 "Stream \(\.$host) with \(.applicationName)",
             ],
             shortTitle: "Connect", systemImageName: "play.tv.fill")
-        AppShortcut(
-            intent: OpenLibraryIntent(),
-            phrases: [
-                "Open \(\.$host) library in \(.applicationName)",
-                "Show \(\.$host) games in \(.applicationName)",
-            ],
-            shortTitle: "Game Library", systemImageName: "square.grid.2x2.fill")
         AppShortcut(
             intent: WakeHostIntent(),
             phrases: [

clients/apple/Sources/PunktfunkClient/Screenshots/ScreenshotHost.swift

@@ -43,27 +43,10 @@ enum ScreenshotMode {
 /// readiness ping for the capture script.
 struct ScreenshotHostView: View {
     let scene: ShotScene
-    #if os(iOS)
-    @Environment(\.horizontalSizeClass) private var hSizeClass
-    @Environment(\.verticalSizeClass) private var vSizeClass
-    #endif
-
-    /// The gamepad UI's form-metric tier, published here for the same reason ContentView does it:
-    /// this harness mounts those screens DIRECTLY, with no ContentView in the tree, so without it
-    /// an iPad capture renders every gamepad screen at iPhone scale — a capture that doesn't look
-    /// like the app.
-    private var gamepadMetrics: GamepadFormMetrics {
-        #if os(iOS)
-        .forWindow(h: hSizeClass, v: vSizeClass)
-        #else
-        .platformDefault
-        #endif
-    }
 
     var body: some View {
         scene.make()
             .environment(\.colorScheme, scene.colorScheme)
-            .environment(\.gamepadMetrics, gamepadMetrics)
             .frame(maxWidth: .infinity, maxHeight: .infinity)
             // Black fills the display, but the SCENE keeps its safe area. Ignoring it wholesale
             // here pushed the stream hero's HUD under the Dynamic Island (the resolution/bitrate

clients/apple/Sources/PunktfunkClient/Screenshots/ScreenshotScenes.swift

@@ -242,9 +242,8 @@ private struct ShotGamepadHome: View {
     var body: some View {
         GamepadHomeView(
             store: store, model: model, discovery: discovery,
-            libraryTarget: .constant(nil), pairingTarget: .constant(nil),
-            onPaired: { _, _ in }, waker: waker,
-            connect: { _, _ in }, connectDiscovered: { _ in }, launchTitle: { _, _ in })
+            libraryTarget: .constant(nil), waker: waker,
+            connect: { _, _ in }, connectDiscovered: { _ in })
     }
 }
 
@@ -301,9 +300,8 @@ private struct ShotConnect: View {
         if gamepadUI {
             GamepadHomeView(
                 store: store, model: model, discovery: discovery,
-                libraryTarget: .constant(nil), pairingTarget: .constant(nil),
-            onPaired: { _, _ in }, waker: waker,
-                connect: { _, _ in }, connectDiscovered: { _ in }, launchTitle: { _, _ in })
+                libraryTarget: .constant(nil), waker: waker,
+                connect: { _, _ in }, connectDiscovered: { _ in })
         } else {
             ShotHome()
         }

clients/apple/Sources/PunktfunkClient/Session/SessionModel.swift

@@ -132,17 +132,6 @@ final class SessionModel: ObservableObject {
     /// and under stage-1.
     @Published var osFloorP50Ms = 0.0
     @Published var osFloorValid = false
-    /// The AUDIO plane's latency, from the playback ring (`SessionAudio.Stats`): how much decoded
-    /// audio is queued ahead of the speaker, and where that PUTS it relative to the picture
-    /// (positive = audio behind). `audioValid` is false until playback runs.
-    ///
-    /// Both numbers, never just the depth — a deep ring on a jittery link is the adaptive floor
-    /// doing its job, and only the offset separates that from audio simply being held late. They
-    /// existed nowhere a surface could render them until now, which is why a field report of "the
-    /// audio delay seems way too high" was triaged all the way to a conclusion without them.
-    @Published var audioBufferMs = 0
-    @Published var audioAvOffsetMs = 0
-    @Published var audioValid = false
 
     /// The floor-shaved values every HUD tier displays (raw − floor, never below 0). Identical
     /// to the raw values whenever no floor is measured.
@@ -164,20 +153,6 @@ final class SessionModel: ObservableObject {
     /// background's privacy mute never clears the user's choice. Local and instant: it gates
     /// capture on this device, nothing is sent to the host.
     @Published private(set) var micMuted = false
-    /// The kind a controller declared when it turned out this session cannot carry its motion —
-    /// set once per such pad, cleared after `motionHintSeconds`. Nil the rest of the time.
-    ///
-    /// It exists because the failure is otherwise entirely silent: the gyro simply does nothing,
-    /// with no way for the player to tell a dead sensor from a session that resolved a backend
-    /// without a motion plane. The fix is a settings change, so the hint has to name it.
-    @Published private(set) var motionUnreachableKind: PunktfunkConnection.GamepadType?
-    /// Drops `motionUnreachableKind` again — held so a second pad's hint replaces the first
-    /// cleanly, and so ending the session cancels a pending clear rather than letting it fire
-    /// into a torn-down model.
-    private var motionHintTimer: Task<Void, Never>?
-    /// How long the motion hint stays up — the start-of-stream shortcut banner's 6 s, since the
-    /// two share the bottom-centre stack and a player reads them the same way.
-    private static let motionHintSeconds: UInt64 = 6
     /// Resize overlay (design/midstream-resolution-resize.md — client resize UX): true from the
     /// instant a Match-window resize starts steering toward a new size until a frame at that size
     /// decodes (or a safety timeout). Drives the blur+spinner so the unavoidable host-rebuild delay
@@ -549,21 +524,6 @@ final class SessionModel: ObservableObject {
         applyMicMute()
     }
 
-    /// A forwarded controller has a gyro this session cannot carry (see
-    /// `GamepadCapture.onMotionUnreachable`). Show it briefly, then let it go.
-    ///
-    /// Last pad wins, and its timer restarts: two such pads are the same one fact to a player, and
-    /// a second hint appearing under a still-visible first would only read as a stutter.
-    private func noteMotionUnreachable(_ kind: PunktfunkConnection.GamepadType) {
-        motionUnreachableKind = kind
-        motionHintTimer?.cancel()
-        motionHintTimer = Task { [weak self] in
-            try? await Task.sleep(for: .seconds(Self.motionHintSeconds))
-            guard !Task.isCancelled else { return }
-            self?.motionUnreachableKind = nil
-        }
-    }
-
     /// Push the EFFECTIVE mute — the user's choice OR the background keep-alive's privacy mute —
     /// onto the audio engine. The two reasons are composed here and nowhere else: whichever one
     /// changed, the other still holds, so returning from the background can't un-mute a user who
@@ -613,11 +573,6 @@ final class SessionModel: ObservableObject {
         // The mic mute is per-session and never persisted: the next stream starts live (if the
         // mic is enabled), rather than silently carrying a mute nobody remembers making.
         micMuted = false
-        // Cancel before clearing: a pending clear firing into a torn-down session would be
-        // harmless but pointless, and leaving the hint set would carry it into the next stream.
-        motionHintTimer?.cancel()
-        motionHintTimer = nil
-        motionUnreachableKind = nil
         let audio = self.audio
         self.audio = nil
         // Gamepad capture is main-actor (releases held buttons on the wire while the
@@ -673,7 +628,6 @@ final class SessionModel: ObservableObject {
         displayValid = false
         clientQueueValid = false
         osFloorValid = false
-        audioValid = false
         lostFrames = 0
         lostPct = 0
         mouseCaptured = false
@@ -748,14 +702,7 @@ final class SessionModel: ObservableObject {
             micUID: settings.micUID,
             micChannel: settings.micChannel,
             micEnabled: settings.micEnabled,
-            echoCancel: settings.echoCancel,
-            // The A/V sync reference: `endToEnd` is capture→on-glass, the one figure that says
-            // where the picture actually IS, and the audio ring steers its depth to land with it.
-            // The same meter object the presenter writes per presented frame, so audio reads the
-            // video plane's own measurement rather than a second estimate of it — and under the
-            // stage-1 fallback presenter, which stamps nothing, it stays empty and the loop
-            // correctly declines to correct.
-            videoLatency: endToEnd)
+            echoCancel: settings.echoCancel)
         self.audio = audio
         // Gamepads: forward every controller GamepadManager selected — each on its own wire pad
         // index (a pin forwards only one, Automatic forwards all) — and render the host's feedback
@@ -775,9 +722,6 @@ final class SessionModel: ObservableObject {
         // The cross-client escape chord (hold L1+R1+Start+Select 1.5 s) — on tvOS the only
         // controller way out of a stream (B/Menu is swallowed during sessions; see ContentView).
         capture.onDisconnectRequest = { [weak self] in self?.disconnect() }
-        // A pad with a gyro that this session cannot carry — say so once, briefly, and name the
-        // setting that fixes it. Already main-actor (GamepadCapture fires it there).
-        capture.onMotionUnreachable = { [weak self] kind in self?.noteMotionUnreachable(kind) }
         capture.start()
         gamepadCapture = capture
         let feedback = GamepadFeedback(connection: conn, manager: .shared)
@@ -916,15 +860,6 @@ final class SessionModel: ObservableObject {
                 } else {
                     self.clientQueueValid = false
                 }
-                // The audio plane is a LEVEL, not a window: the ring's depth and the sync loop's
-                // smoothed offset are both current values, so they are read rather than drained.
-                if let a = self.audio?.stats {
-                    self.audioBufferMs = a.bufferMS
-                    self.audioAvOffsetMs = a.avOffsetMS
-                    self.audioValid = true
-                } else {
-                    self.audioValid = false
-                }
                 // Mirror the window to the unified log (see statsLog) — one line per second,
                 // stages in ms, only while frames actually flowed. `fps` counts RECEIVED AUs;
                 // `presents` counts frames that reached glass (the display meter's sample count)
@@ -940,12 +875,7 @@ final class SessionModel: ObservableObject {
                         // the whole line (a cascade error that also mis-blames the float args).
                         format: "fps=%lld presents=%lld e2e_p50=%.1f e2e_p95=%.1f hostnet_p50=%.1f "
                             + "decode_p50=%.1f display_p50=%.1f lost=%lld "
-                            + "floor_p50=%.1f display_adj=%.1f e2e_adj=%.1f queue_p50=%.1f "
-                            // Appended LAST, so every existing parser of this line is unaffected.
-                            // In the log as well as on the HUD because the overlay is only up when
-                            // someone thought to turn it on, and the reports that need these
-                            // numbers arrive after the fact.
-                            + "audio_buffer=%lld audio_av_offset=%lld",
+                            + "floor_p50=%.1f display_adj=%.1f e2e_adj=%.1f queue_p50=%.1f",
                         frames,
                         displayWindow?.count ?? 0,
                         self.endToEndValid ? self.endToEndP50Ms : -1,
@@ -957,9 +887,7 @@ final class SessionModel: ObservableObject {
                         self.osFloorValid ? self.osFloorP50Ms : -1,
                         self.displayValid ? self.displayAdjP50Ms : -1,
                         self.endToEndValid ? self.endToEndAdjP50Ms : -1,
-                        self.clientQueueValid ? self.clientQueueP50Ms : -1,
-                        self.audioValid ? self.audioBufferMs : -1,
-                        self.audioValid ? self.audioAvOffsetMs : 0)
+                        self.clientQueueValid ? self.clientQueueP50Ms : -1)
                     statsLog.info("\(line, privacy: .public)")
                 }
             }

clients/apple/Sources/PunktfunkClient/Session/StreamHUDView.swift

@@ -154,28 +154,6 @@ struct StreamHUDView: View {
                         .foregroundStyle(.secondary)
                 }
             }
-            // The AUDIO plane's own latency (detailed tier). Deliberately OUTSIDE the video branch
-            // above: it is not a term of that equation — audio is steered to MEET the video total,
-            // never summed into it — and the depth is exactly as worth seeing under the stage-1
-            // fallback presenter, which measures no end-to-end at all.
-            //
-            // `buffer` is how much decoded audio is queued ahead of the speaker; `a/v` is where
-            // that puts it relative to the picture (+ = audio behind). Both, not just the depth: a
-            // deep ring on a jittery link is the adaptive floor doing its job, and only the offset
-            // distinguishes that from a ring holding audio late. Neither number was renderable
-            // anywhere before — they lived in a periodic log line — which is how a report of "the
-            // audio delay seems way too high" got triaged to a conclusion with no instrument.
-            if verbosity == .detailed && model.audioValid && model.audioBufferMs > 0 {
-                // String(format:) for the signed offset: `%+d` has no specifier-interpolation
-                // equivalent, and Swift's Int is 64-bit (%lld, never the 32-bit %d).
-                Text(model.audioAvOffsetMs == 0
-                    ? "audio buffer \(model.audioBufferMs) ms"
-                    : String(
-                        format: "audio buffer %lld ms · a/v %+lld ms",
-                        model.audioBufferMs, model.audioAvOffsetMs))
-                    .font(.system(.caption2, design: .monospaced))
-                    .foregroundStyle(.tertiary)
-            }
             if model.lostFrames > 0 {
                 // Unrecoverable network drops this window; hidden while the link is clean.
                 // String(format:) rather than specifier interpolation: the literal % would
@@ -246,18 +224,9 @@ struct StreamHUDView: View {
 
     /// The card's inner content padding. Roomier on tvOS — the stat text auto-scales for the
     /// couch (relative system styles), so the card's chrome must keep pace or it reads cramped.
-    ///
-    /// On iOS it also has to CLEAR THE CORNER. A rounded corner of radius `r` pulls the card's
-    /// edge inward by `r − √(r² − (r−y)²)` at a distance `y` below the top, so the first and last
-    /// lines of a padded stack sit inside the arc unless the padding keeps pace with the radius.
-    /// At `0.45 · r` that intrusion stays well inside the padding across the whole range this
-    /// card can wear (≈4.6 pt of arc against 12.6 pt of padding at the 28 pt cap), so no line
-    /// ever runs into the curve.
     private var cardPadding: CGFloat {
         #if os(tvOS)
         return 16
-        #elseif os(iOS)
-        return max(10, cardCornerRadius * 0.45)
         #else
         return 10
         #endif
@@ -277,20 +246,13 @@ struct StreamHUDView: View {
         #endif
     }
 
-    /// The card's corner radius. On iOS it aims to be concentric with the physical display
-    /// corner — `displayCornerRadius − edgeInset`, so the gap to the screen edge stays uniform
-    /// right around the corner instead of a small-radius card cutting into the very rounded
-    /// glass — but that aim is BOUNDED by what a card this small can actually carry.
-    ///
-    /// Unbounded, a modern phone (~62 pt of display radius) asked for a 48 pt corner on a card
-    /// whose lines sit 10 pt from the edge: the arc reaches ~19 pt inward at the first line, so
-    /// the top and bottom lines rendered INSIDE the curve. Concentricity is only a virtue while
-    /// the radius is small next to the card; past that it is just a blob eating its own text.
-    /// 28 pt is the most this card's stack can wear (with `cardPadding` scaling alongside), and
-    /// devices whose display radius asks for less than that still get a truly concentric corner.
+    /// The card's corner radius. On iOS it's concentric with the physical display corner —
+    /// `displayCornerRadius − edgeInset`, so the gap to the screen edge stays uniform right around the
+    /// corner instead of a small-radius card cutting into the very rounded glass. Clamped so a
+    /// flat-cornered device (or a hidden radius) still gets a sensibly rounded card.
     private var cardCornerRadius: CGFloat {
         #if os(iOS)
-        return min(28, max(12, DeviceMetrics.displayCornerRadius - edgeInset))
+        return max(12, DeviceMetrics.displayCornerRadius - edgeInset)
         #elseif os(tvOS)
         return 16 // scales with the roomier padding
         #else
@@ -305,39 +267,6 @@ struct StreamHUDView: View {
     }
 }
 
-/// "This pad's gyro can't reach the game" — shown briefly when a forwarded controller with motion
-/// meets a session whose virtual controller has no motion plane (an X-Box class pad has no gyro in
-/// its HID contract, so every sample would be decoded and dropped).
-///
-/// Not a control, unlike `MicMutedBadge`: the fix is the Controller type setting, which is not
-/// reachable mid-stream on every platform, and changing it applies from the next session anyway.
-/// So this states the fact and names the setting, in the HUD's glass language, and gets out of the
-/// way — the alternative is what shipped before, which was a gyro that silently did nothing with
-/// no way to tell that from a broken sensor.
-///
-/// Every platform: a DualSense on an Apple TV is an ordinary way to play, and it is exactly the
-/// pad this can happen to.
-struct MotionUnreachableBadge: View {
-    var body: some View {
-        HStack(spacing: 7) {
-            Image(systemName: "gyroscope")
-                .font(.system(size: 13, weight: .semibold))
-                .foregroundStyle(.yellow)
-            Text("Motion won't reach this session — set Controller type to DualSense")
-                .font(.geist(12, .medium, relativeTo: .caption))
-                .foregroundStyle(.white.opacity(0.9))
-        }
-        .padding(.horizontal, 14)
-        .padding(.vertical, 8)
-        .glassBackground(Capsule())
-        .environment(\.colorScheme, .dark) // reads over any frame, like the resize overlay
-        .accessibilityElement(children: .combine)
-        .accessibilityLabel(
-            "This controller's motion will not reach the game. "
-                + "Set Controller type to DualSense to enable it.")
-    }
-}
-
 #if !os(tvOS)
 /// The muted-microphone badge — the mute STATE, as opposed to the buttons that flip it. It rides
 /// over the stream whenever the mic is muted, INDEPENDENT of the stats overlay (which the user

clients/apple/Sources/PunktfunkClient/Settings/AcknowledgementsView.swift

@@ -54,15 +54,6 @@ struct AcknowledgementsView: View {
 
                     Divider()
 
-                    Text("Swift packages")
-                        .font(.geist(Self.headlineFont, .semibold, relativeTo: .headline))
-                    Text("Punktfunk uses Glur (progressive backdrop blur), "
-                        + "© 2023 João Gabriel, under the MIT License.")
-                        .font(.geist(Self.captionFont, relativeTo: .caption))
-                        .foregroundStyle(.secondary)
-
-                    Divider()
-
                     Text("Third-party software")
                         .font(.geist(Self.headlineFont, .semibold, relativeTo: .headline))
                     Text(

clients/apple/Sources/PunktfunkClient/Settings/GamepadOptionBand.swift

@@ -1,209 +0,0 @@
-// The gamepad settings' "select" value as a REAL band: the options sit side by side on a drum
-// segment curving about a vertical axis — the current one faces you flat, and a step rotates the
-// next one in with perspective. The old presentation animated a single Text keyed by its value
-// (an old-out/new-in crossfade that merely implied motion), which fell apart under fast repeated
-// steps: each press restarted the fade. Here the drum's position is one continuous value driven
-// by a spring, and SwiftUI's spring retargeting preserves velocity — rapid presses accumulate
-// into one accelerating travel instead of five restarted crossfades.
-//
-// The band is LINEAR, not a ring (field verdict on the first cut): a ring showed the first
-// option waiting to the right of the last one, which left/right can't reach (adjust clamps) —
-// a promise the navigation doesn't keep. And on a 2-option ring the unselected option flipped
-// sides with every step. So positions are fixed: option i sits i steps from the start, the ends
-// are the ends, and A's wrap from the last option travels BACK across the list to the first.
-// Options other than the facing one exist only while the drum is actually moving — at rest a row
-// shows exactly its value (a resting neighbour under a long label rendered as overlapping,
-// unreadable text).
-//
-// The band is purely presentational: stepping semantics (left/right clamps with a boundary thud,
-// A cycles forward wrapping, disabled rows refuse input) stay in GamepadSettingsView's row
-// closures. Font and ink come from the environment — the row applies the same value font/colour
-// it always did, and the drum's own opacity ramp multiplies on top.
-
-import Foundation
-import SwiftUI
-
-#if os(iOS) || os(macOS) || os(tvOS)
-
-struct GamepadOptionBand: View {
-    let options: [String]
-    /// The committed selection — the caller's clamp/wrap already applied.
-    let selection: Int
-    let focused: Bool
-    /// The band's footprint, FIXED by the row: a step must never reflow the row (the old
-    /// free-width value shifted the chevrons with every label), and the drum needs its stage
-    /// even when the facing label is short.
-    let width: CGFloat
-
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion
-
-    /// Where the drum rests, in option steps — always chasing `Double(selection)`; only the
-    /// spring's interpolation ever puts it between integers.
-    @State private var drumPosition: Double
-
-    init(options: [String], selection: Int, focused: Bool, width: CGFloat) {
-        self.options = options
-        self.selection = selection
-        self.focused = focused
-        self.width = width
-        _drumPosition = State(initialValue: Double(selection))
-    }
-
-    var body: some View {
-        Group {
-            if reduceMotion {
-                // No drum, no travel: today's quiet crossfade, minus even the 14 pt slip.
-                ZStack {
-                    Text(current)
-                        .lineLimit(1)
-                        .id(selection)
-                        .transition(.opacity)
-                }
-                .animation(.smooth(duration: 0.2), value: selection)
-            } else {
-                Drum(
-                    options: options,
-                    rotation: drumPosition,
-                    target: drumPosition,
-                    // Puts the ±1 neighbour ~40 % of the band off-centre, curling to the edge.
-                    radius: width * 0.72,
-                    width: width)
-            }
-        }
-        .frame(width: width)
-        .clipped()
-        // NO `.mask` here. The soft edges used to be a gradient mask over the whole band, and a
-        // mask RASTERISES what it covers — which flattens `rotation3DEffect`'s perspective, so the
-        // drum was being composited as a flat sideways slide rather than a turning cylinder. That
-        // is the "3D effect isn't what it should be" the field kept seeing: the geometry was
-        // always right, and the mask was throwing the projection away every frame.
-        //
-        // The same soft edge is folded into each option's own opacity instead (see `Drum.option`),
-        // which costs nothing and leaves the projection intact.
-        .onChange(of: selection) { old, new in step(from: old, to: new) }
-        // The options list itself can mutate under the drum (a custom resolution appears, a
-        // controller connects, the buffer options re-derive from a new refresh rate) — re-seat
-        // without a travel.
-        .onChange(of: options.count) { _, _ in snap() }
-        // One element to VoiceOver — the neighbour texts are rendering, not content.
-        .accessibilityElement(children: .ignore)
-        .accessibilityLabel(current)
-    }
-
-    private var current: String {
-        options.indices.contains(selection) ? options[selection] : ""
-    }
-
-    /// A step (or A's wrap — which on a linear band is a fast travel back to the start) springs
-    /// the drum; anything else (an external write from the touch settings, a re-derived options
-    /// list) re-seats it — a travel to a value the user didn't step to would read as the UI
-    /// acting on its own.
-    private func step(from old: Int, to new: Int) {
-        let wrapped = options.count > 1 && old == options.count - 1 && new == 0
-        guard (abs(new - old) == 1 || wrapped), !reduceMotion else { return snap() }
-        withAnimation(.spring(response: 0.32, dampingFraction: 0.78)) {
-            drumPosition = Double(new)
-        }
-    }
-
-    private func snap() {
-        var tx = Transaction()
-        tx.disablesAnimations = true
-        withTransaction(tx) { drumPosition = Double(selection) }
-    }
-}
-
-/// The rotating drum itself. `Animatable` so SwiftUI re-evaluates the body with the INTERPOLATED
-/// rotation every frame of the spring — each option's offset/scale/opacity follows the real arc,
-/// and options along the travel genuinely enter and leave mid-flight. (A plain `.animation` on
-/// independent modifiers can't do that: each modifier would lerp its own endpoints and the
-/// in-between options would never appear.)
-private struct Drum: View, Animatable {
-    let options: [String]
-    /// The interpolated drum position, in option steps.
-    var rotation: Double
-    /// Where the spring is headed (jumps instantly on a step; only `rotation` chases it). The
-    /// distance between them is "how mid-flight are we" — the neighbours exist exactly as long
-    /// as the drum is moving, fading continuously as it lands, so a resting row is one flat
-    /// Text and a long label never sits under a resting neighbour.
-    let target: Double
-    /// Drum radius in points (from the band width — see the caller).
-    let radius: Double
-    /// The band's own width — the stage the options turn on, and what the edge fade is measured
-    /// against now that the container no longer carries a mask.
-    let width: Double
-
-    var animatableData: Double {
-        get { rotation }
-        set { rotation = newValue }
-    }
-
-    /// Angular pitch between adjacent options on the drum.
-    private static let stepAngle = 34.0 * .pi / 180.0
-
-    // Neighbours exist only while the drum is MOVING, and that is not a compromise — it is the
-    // documented field fix this file was written around. Showing them at rest was tried (to make a
-    // settled row look more like a cylinder) and immediately reproduced the original defect: on the
-    // simulator, "This device · 2752 × 2064" rendered with "280 ×" sitting on top of it, and
-    // "Automatic" with "10 Mbps" through it. A long value and its neighbour occupy the same
-    // pixels, and no opacity low enough to fix that is high enough to be worth drawing.
-    //
-    // The cylinder is meant to be READ WHILE IT TURNS. What was actually broken is fixed above:
-    // the band used to mask itself, and the mask rasterised the drum and threw its perspective
-    // away every frame, so the turn never looked like a turn.
-
-    var body: some View {
-        let flight = min(1, abs(rotation - target) * 3)
-        let content = ZStack {
-            ForEach(0..<options.count, id: \.self) { i in
-                // Plain signed distance — the band is linear, so option i has ONE home and the
-                // ends are the ends (nothing waits beyond the last option).
-                let d = Double(i) - rotation
-                // Only the facing option at rest; its neighbours join it for the travel (see the
-                // note on `restingNeighbour`'s removal above).
-                if abs(d) < 0.5 || (flight > 0.001 && abs(d) <= 2.5) {
-                    option(i, distance: d, gate: flight)
-                }
-            }
-        }
-        #if os(tvOS)
-        // Flatten the transform stack — the 10-foot GPU already made these rows drop Liquid
-        // Glass, and several projected texts per step is the same class of cost. It costs the
-        // projection (a rasterised layer has no perspective), which is the trade tvOS already
-        // makes elsewhere on this screen.
-        content.drawingGroup()
-        #else
-        content
-        #endif
-    }
-
-    @ViewBuilder private func option(_ i: Int, distance d: Double, gate: Double) -> some View {
-        let angle = d * Self.stepAngle
-        let depth = cos(angle)
-        let x = radius * sin(angle)
-        // The facing option never gates: a resting row still shows its value.
-        let alpha = pow(max(depth, 0), 3) * (abs(d) < 0.5 ? 1 : gate) * edgeFade(x)
-        Text(options[i])
-            .lineLimit(1)
-            .fixedSize() // never let a turning label re-wrap to the band's width mid-flight
-            .scaleEffect(0.70 + 0.30 * depth)
-            // Foreshorten the label as it turns away — this is what sells the cylinder.
-            .rotation3DEffect(.radians(angle), axis: (x: 0, y: 1, z: 0), perspective: 0.55)
-            .offset(x: x)
-            .opacity(alpha)
-            .zIndex(depth)
-    }
-
-    /// The soft edge, per option, replacing the container mask that used to flatten the
-    /// projection: full strength through the middle of the band, dissolving to nothing by the
-    /// time an option reaches its rim, so the drum never ends on a cut.
-    private func edgeFade(_ x: Double) -> Double {
-        let halfWidth = width / 2
-        guard halfWidth > 0 else { return 1 }
-        let fadeStart = halfWidth * 0.55
-        guard abs(x) > fadeStart else { return 1 }
-        return max(0, min(1, (halfWidth - abs(x)) / (halfWidth - fadeStart)))
-    }
-}
-
-#endif

clients/apple/Sources/PunktfunkClient/Settings/GamepadSettingsView.swift

@@ -46,21 +46,11 @@ enum GpSettingsTab: String, CaseIterable, Hashable {
 
 struct GamepadSettingsView: View {
     @Environment(\.gamepadInk) private var ink
-    @Environment(\.gamepadMetrics) private var metrics
-    @Environment(\.displayBottomInset) private var displayBottomInset
     @Environment(\.dismiss) private var dismiss
-    @Environment(\.gamepadHostedInShell) private var hostedInShell
     /// The saved-host store — the pin picker writes `setPinned` through it and the profile rows
     /// count pins from its live hosts. Threaded in from GamepadHomeView like the home screen
     /// itself (ContentView owns the instance).
     @ObservedObject var store: HostStore
-    /// How the in-place shell (iOS) closes this screen; nil (the macOS sheet, the tvOS cover)
-    /// falls back to the environment dismiss. See `performClose`.
-    var close: (() -> Void)?
-    /// Whether this screen owns the controller. The shell holds it false during a push/pop (the
-    /// console's input drop) and while the connect takeover is up; a system presentation never
-    /// needs the gate and keeps the default.
-    var controllerActive = true
     @AppStorage(DefaultsKey.streamWidth) private var width = 1920
     @AppStorage(DefaultsKey.streamHeight) private var height = 1080
     @AppStorage(DefaultsKey.streamHz) private var hz = 60
@@ -83,9 +73,6 @@ struct GamepadSettingsView: View {
     @AppStorage(DefaultsKey.hudPlacement) private var hudPlacement = HUDPlacement.topTrailing.rawValue
     @AppStorage(DefaultsKey.libraryEnabled) private var libraryEnabled = true
     @AppStorage(DefaultsKey.gamepadUIEnabled) private var gamepadUIEnabled = true
-    /// When the switch above takes over — the row is only built while it is on.
-    @AppStorage(DefaultsKey.gamepadUIMode) private var gamepadUIMode =
-        GamepadUIEnvironment.modeWhenConnected
     /// The gamepad UI's background colour family — the backdrop BEHIND this screen re-colours as
     /// the row steps, which is why the picker lives here and not in a sheet.
     @AppStorage(DefaultsKey.uiPalette) private var paletteID = "violet"
@@ -98,7 +85,6 @@ struct GamepadSettingsView: View {
     #endif
     #if os(iOS)
     @AppStorage(DefaultsKey.rumbleOnDevice) private var rumbleOnDevice = false
-    @AppStorage(DefaultsKey.gyroFromDevice) private var gyroFromDevice = false
     #endif
     @ObservedObject private var gamepads = GamepadManager.shared
     /// The profile catalog (ProfileStore.shared, like every other surface that reads it) — the
@@ -140,35 +126,32 @@ struct GamepadSettingsView: View {
             onAdjust: { row, delta in adjust(id: row.id, by: delta) },
             onActivate: { activate(id: $0.id) },
             onBack: { back() },
-            onShoulder: { step(tabBy: $0) },
-            isActive: controllerActive
+            onShoulder: { step(tabBy: $0) }
         ) { row, focused in
             rowView(row, focused: focused)
-                .frame(maxWidth: metrics.rowMaxWidth)
+                .frame(maxWidth: GamepadFormMetrics.rowMaxWidth)
                 .padding(.horizontal, 24)
         }
         .frame(maxWidth: .infinity)
         .safeAreaInset(edge: .top, spacing: 0) {
-            VStack(alignment: .leading, spacing: gamepadHeaderSpacing(compact: compact)) {
-                // Leading, like a console section heading — centred read as a floating label,
-                // and a gamepad UI needs no close chrome next to it (B is the exit).
+            VStack(spacing: compact ? 4 : 8) {
                 Text(title)
                     .font(.geist(gamepadTitleSize(compact: compact), .bold, relativeTo: .title))
                     .foregroundStyle(ink.fg)
-                    .frame(maxWidth: .infinity, alignment: .leading)
-                    .padding(.horizontal, 24)
+                    .frame(maxWidth: .infinity)
+                    .overlay(alignment: .trailing) { closeButton.padding(.trailing, 20) }
                 // The picker is one layer deeper — its rows aren't sections of anything, so the
                 // strip would be a control that does nothing while it's up.
                 if pinTarget == nil { tabStrip }
             }
             .padding(.top, gamepadTitleTopPadding(compact: compact))
-            .padding(.bottom, gamepadTitleBottomPadding(compact: compact))
-            .background { GamepadTrayBlur(edge: .top) }
+            .padding(.bottom, compact ? 4 : 8)
+            .background { GamepadTrayScrim(edge: .top) }
         }
         .safeAreaInset(edge: .bottom, alignment: .leading, spacing: 0) {
             VStack(alignment: .leading, spacing: 8) {
                 Text(focusedDetail)
-                    .font(.geist(metrics.detailFont, relativeTo: .caption))
+                    .font(.geist(GamepadFormMetrics.detailFont, relativeTo: .caption))
                     .foregroundStyle(ink.fg(0.55))
                     .lineLimit(2, reservesSpace: true)
                     .animation(.smooth(duration: 0.2), value: focusID)
@@ -177,22 +160,15 @@ struct GamepadSettingsView: View {
             // Equal distance from the left and bottom edges for the legend pill (see GamepadHomeView).
             .padding(.leading, compact ? 12 : 18)
             .padding(.trailing, 22)
-            .padding(
-                .bottom,
-                gamepadLegendBottomPadding(
-                    compact ? 12 : 18, tier: metrics.tier, displayBottom: displayBottomInset))
+            .padding(.bottom, compact ? 12 : 18)
             .padding(.top, compact ? 6 : 10)
             .frame(maxWidth: .infinity, alignment: .leading)
-            .background { GamepadTrayBlur(edge: .bottom) }
+            .background { GamepadTrayScrim(edge: .bottom) }
         }
         // The launcher's living field, calmed (GamepadFormBackground) — the glass rows keep real
         // colour and luminance to lens without the launcher's contrast, and the palette setting
-        // applies here too, so this screen previews the row you're stepping. Hosted in the
-        // shell, the field is the SHELL's (one persistent backdrop, calm-chased) — mounting a
-        // second would double the mesh and snap where the shell crossfades.
-        .background {
-            if !hostedInShell { GamepadFormBackground() }
-        }
+        // applies here too, so this screen previews the row you're stepping.
+        .background { GamepadFormBackground() }
         // Publish the palette's ink to this screen (text, glass, accent, scrims) — a
         // pale palette flips all of them, and no leaf should have to read the setting.
         .gamepadPaletteInk()
@@ -201,18 +177,6 @@ struct GamepadSettingsView: View {
             gamepads.startDiscovery()
         }
         .onDisappear { gamepads.stopDiscovery() }
-        #if !os(tvOS)
-        // The visible close ✕ is gone (a gamepad UI exits with B) — this keeps a hardware
-        // keyboard's Esc and the macOS sheet's cancel working without chrome.
-        .background {
-            Button("Close") { performClose() }
-                .keyboardShortcut(.cancelAction)
-                .buttonStyle(.plain)
-                .frame(width: 0, height: 0)
-                .opacity(0)
-                .accessibilityHidden(true)
-        }
-        #endif
     }
 
     /// The section switcher. Horizontally scrollable so a narrow phone in landscape never has to
@@ -259,26 +223,16 @@ struct GamepadSettingsView: View {
     private func pill(_ t: GpSettingsTab) -> some View {
         let selected = t == tab
         return Text(t.rawValue)
-            .font(.geist(compact ? 12 : metrics.tabFont, .semibold, relativeTo: .footnote))
-            // `onAccent`, not `fg` — the selected pill is FILLED with the palette accent, and
-            // `onAccent` is the colour picked (by the accent's own luminance) to read on top of
-            // it; its doc calls out "a filled pill's label" for exactly this surface. Using the
-            // foreground meant white-on-white wherever a palette's accent is pale: Graphite's is
-            // a light grey (luma ≈ 0.80), so its selected tab was unreadable.
-            .foregroundStyle(selected ? ink.onAccent : ink.fg(0.55))
-            // Proportional to the row metrics rather than fixed, so the strip grows with the
-            // fields under it — a tab bar at phone scale above iPad-scale rows was half the
-            // "does not adapt to larger screens" complaint.
-            .padding(.horizontal, metrics.rowHPad * 0.8)
-            .padding(.vertical, metrics.rowVPad * 0.55)
+            .font(.geist(compact ? 12 : 13, .semibold, relativeTo: .footnote))
+            .foregroundStyle(selected ? ink.fg : ink.fg(0.55))
+            .padding(.horizontal, 13)
+            .padding(.vertical, 7)
             .background {
                 // One shared capsule that MOVES between pills, rather than one per pill fading
-                // in and out — the highlight travels the way the press did. A Liquid Glass
-                // surface (accent-tinted through consoleGlass), so the strip wears the same
-                // material language as the rows it sits above.
+                // in and out — the highlight travels the way the press did.
                 if selected {
-                    Color.clear
-                        .consoleGlass(Capsule(), tint: ink.accent(0.85))
+                    Capsule()
+                        .fill(ink.accent(0.85))
                         .matchedGeometryEffect(id: "tab", in: tabHighlight)
                 }
             }
@@ -320,10 +274,22 @@ struct GamepadSettingsView: View {
         focusID = landing
     }
 
-    /// Close this screen through whichever mechanism presents it: the shell's layer pop on iOS,
-    /// the environment dismiss under a macOS sheet / tvOS cover.
-    private func performClose() {
-        if let close { close() } else { dismiss() }
+    /// Touch/click fallback for closing — the controller path is B, a hardware keyboard's Esc
+    /// rides the cancel action.
+    private var closeButton: some View {
+        Button { dismiss() } label: {
+            Image(systemName: "xmark")
+                .font(.system(size: GamepadFormMetrics.closeFont, weight: .semibold))
+                .foregroundStyle(ink.fg)
+                .frame(width: GamepadFormMetrics.closeSide, height: GamepadFormMetrics.closeSide)
+                .glassBackground(Circle(), interactive: true)
+                .contentShape(Circle())
+        }
+        .buttonStyle(.plain)
+        #if !os(tvOS)
+        .keyboardShortcut(.cancelAction) // unavailable on tvOS (Menu is the cancel there)
+        #endif
+        .accessibilityLabel("Close settings")
     }
 
     /// "Settings", or "Pin “Work”" while the pin picker is up — the title is what says which
@@ -341,39 +307,26 @@ struct GamepadSettingsView: View {
             // shoulders exist at all (see `showsSectionHint`).
             let sections: [GamepadHint] = showsSectionHint
                 ? [.init(glyph: buttonGlyph(\.leftShoulder, fallback: "l1.rectangle.roundedbottom"),
-                         text: "Section", action: { step(tabBy: 1) })]
+                         text: "Section")]
                 : []
             // A dimmed row takes neither, so offering them would be the same lie the row itself
             // used to tell — only Done remains, and the detail line says what to turn on first.
             guard rows.first(where: { $0.id == focusID })?.enabled ?? true else {
                 return sections
-                    + [.init(
-                        glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done",
-                        action: { back() })]
+                    + [.init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done")]
             }
             return sections + [
-                // The stick itself, not an action — nothing to tap (see GamepadHint.action).
                 .init(glyph: "arrow.left.and.right", text: "Adjust"),
-                .init(
-                    glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Change",
-                    action: { if let focusID { activate(id: focusID) } }),
-                .init(
-                    glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done",
-                    action: { back() }),
+                .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Change"),
+                .init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done"),
             ]
         }
         guard !store.hosts.isEmpty else {
-            return [.init(
-                glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Back",
-                action: { back() })]
+            return [.init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Back")]
         }
         return [
-            .init(
-                glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Pin / Unpin",
-                action: { if let focusID { activate(id: focusID) } }),
-            .init(
-                glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Back",
-                action: { back() }),
+            .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Pin / Unpin"),
+            .init(glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Back"),
         ]
     }
 
@@ -384,14 +337,14 @@ struct GamepadSettingsView: View {
             pinTarget = nil
             focusID = "profile-\(profile.id)"
         } else {
-            performClose()
+            dismiss()
         }
     }
 
     // MARK: - Row rendering
 
     private func rowView(_ row: Row, focused: Bool) -> some View {
-        let m = metrics
+        let m = GamepadFormMetrics.self
         // No section header: the tab strip names the section now, and repeating it above the
         // first row of every tab was just a second label saying the same word.
         return VStack(alignment: .leading, spacing: 6) {
@@ -410,31 +363,24 @@ struct GamepadSettingsView: View {
                         .font(.system(size: m.chevronFont, weight: .semibold))
                         .foregroundStyle(
                             ink.fg(focused && row.adjustable && row.enabled ? 0.6 : 0))
-                    if let labels = row.optionLabels, let idx = row.selectedIndex {
-                        // A choice row's value is a REAL band — the options ride a rotating
-                        // drum, so fast repeated steps spin it instead of restarting a fade.
-                        GamepadOptionBand(
-                            options: labels, selection: idx, focused: focused, width: bandWidth)
+                    // Keyed by the value so a change slides the new option in instead of
+                    // hard-swapping the string — a QUIET horizontal slip following the user's
+                    // motion (a right-step enters from the right), crossfading over ~14 pt.
+                    // Deliberately not `.push`: that travels the whole container width, loud
+                    // and visibly outside the row. The ZStack is the stable home the
+                    // removed/inserted texts transition within.
+                    let slide: CGFloat = lastAdjustDelta >= 0 ? 14 : -14
+                    ZStack {
+                        Text(row.value)
                             .font(.geist(m.valueFont, .medium, relativeTo: .callout))
                             .foregroundStyle(focused ? ink.fg : ink.fg(0.6))
-                    } else {
-                        // The flat rows (profile pin counts, placeholders) keep the quiet slip:
-                        // keyed by the value so a change slides the new string in following the
-                        // user's motion, crossfading over ~14 pt. The ZStack is the stable home
-                        // the removed/inserted texts transition within.
-                        let slide: CGFloat = lastAdjustDelta >= 0 ? 14 : -14
-                        ZStack {
-                            Text(row.value)
-                                .font(.geist(m.valueFont, .medium, relativeTo: .callout))
-                                .foregroundStyle(focused ? ink.fg : ink.fg(0.6))
-                                .lineLimit(1)
-                                .id(row.value)
-                                .transition(.asymmetric(
-                                    insertion: .offset(x: slide).combined(with: .opacity),
-                                    removal: .offset(x: -slide).combined(with: .opacity)))
-                        }
-                        .animation(.smooth(duration: 0.22), value: row.value)
+                            .lineLimit(1)
+                            .id(row.value)
+                            .transition(.asymmetric(
+                                insertion: .offset(x: slide).combined(with: .opacity),
+                                removal: .offset(x: -slide).combined(with: .opacity)))
                     }
+                    .animation(.smooth(duration: 0.22), value: row.value)
                     Image(systemName: "chevron.right")
                         .font(.system(size: m.chevronFont, weight: .semibold))
                         .foregroundStyle(
@@ -464,17 +410,6 @@ struct GamepadSettingsView: View {
         rows.first { $0.id == focusID }?.detail ?? " "
     }
 
-    /// The option band's fixed stage. A portrait phone is the one place the full 240 pt starves
-    /// the row's label (everywhere else the 620 pt row cap leaves room to spare), so it alone
-    /// narrows the stage.
-    private var bandWidth: CGFloat {
-        #if os(iOS)
-        hSizeClass == .compact && vSizeClass == .regular ? 170 : metrics.bandWidth
-        #else
-        metrics.bandWidth
-        #endif
-    }
-
     // MARK: - Row model
 
     private struct Row: Identifiable {
@@ -487,11 +422,6 @@ struct GamepadSettingsView: View {
         let value: String
         /// One-line explanation shown near the hint bar while this row is focused.
         let detail: String
-        /// A choice row's full option list (labels only — the tags stay inside the closures)
-        /// and where its drum currently rests. nil ⇒ the value renders as plain text (toggles,
-        /// actions, profiles — a two-position switch is not a drum; see GamepadOptionBand).
-        var optionLabels: [String]?
-        var selectedIndex: Int?
         /// Whether left/right means anything here — false hides the value's chevrons (the
         /// Profiles rows navigate, and the placeholder rows do nothing at all).
         var adjustable = true
@@ -688,21 +618,6 @@ struct GamepadSettingsView: View {
                 detail: "Turn off to use the touch interface even with a controller connected.",
                 value: $gamepadUIEnabled),
         ]
-        // WHEN the switch above takes over. Built only while it is on: with the switch off this
-        // screen is unreachable in the first place (no gamepad UI to open it from), so a row
-        // that decides nothing would exist purely to be found in a screenshot.
-        if gamepadUIEnabled, let at = list.firstIndex(where: { $0.id == "gamepadUI" }) {
-            list.insert(
-                choiceRow(
-                    id: "gamepadUIMode", tab: .interface, icon: "gamecontroller.circle",
-                    label: "Show it",
-                    detail: "With a controller: the touch interface comes back when the last one "
-                        + "disconnects. Always keeps this layout either way — for a device that "
-                        + "lives on a TV.",
-                    options: SettingsOptions.gamepadUIModes, current: gamepadUIMode
-                ) { gamepadUIMode = $0 },
-                at: at + 1)
-        }
         #if os(macOS)
         // The windowed safe-present toggle slots in after "Smoothness buffer" (staying inside
         // the Video tab) — macOS only, mirroring the touch SettingsView's Presentation row
@@ -734,31 +649,7 @@ struct GamepadSettingsView: View {
                     value: $rumbleOnDevice),
                 at: at + 1)
         }
-        // The phone-gyro mirror sits beside the rumble mirror: same clip-on-pad audience,
-        // opposite data direction. Hidden where the device has no motion hardware; engages
-        // in-session only while player 1's controller reports no rotation rate of its own.
-        if DeviceGyro.isAvailable,
-            let anchor = list.firstIndex(where: { $0.id == "deviceRumble" })
-                ?? list.firstIndex(where: { $0.id == "padType" }) {
-            list.insert(
-                toggleRow(
-                    id: "deviceGyro", tab: .controller,
-                    icon: "gyroscope",
-                    label: "Gyro from this device",
-                    detail: "When the controller has no gyro, send this device's motion "
-                        + "sensors as player 1's — for clip-on pads without one of their own.",
-                    value: $gyroFromDevice),
-                at: anchor + 1)
-        }
         #endif
-        // The smoothness buffer only decides anything under Smoothness. Every other settings
-        // surface — touch, tvOS, the GTK and WinUI shells — hides it under Lowest latency; this
-        // screen alone left it live and steppable, which is a row that thuds or silently stores
-        // a value nothing reads. Removed here rather than omitted from the literal above so the
-        // macOS safe-present insertion can still anchor on it.
-        if presentPriority != "smooth" {
-            list.removeAll { $0.id == "smoothBuffer" }
-        }
         return list + profileRows
     }
 
@@ -819,8 +710,6 @@ struct GamepadSettingsView: View {
                 value: pinned ? "Pinned" : "Off",
                 detail: "A pinned profile appears as its own card on the host — one press "
                     + "connects with it.",
-                optionLabels: ["Off", "Pinned"],
-                selectedIndex: pinned ? 1 : 0,
                 adjust: { delta in
                     let target = delta > 0
                     guard pinned != target else { return false }
@@ -887,10 +776,6 @@ struct GamepadSettingsView: View {
             id: id, tab: tab, icon: icon, label: label,
             value: index.map { options[$0].label } ?? "—",
             detail: detail,
-            // The band mounts only once the value is a known option — the "—" of an unknown
-            // current renders flat, and the first step's snap-to-first seats the drum.
-            optionLabels: index != nil ? options.map(\.label) : nil,
-            selectedIndex: index,
             enabled: enabled,
             adjust: { delta in
                 // Unknown current value: snap to the first option on any step.
@@ -918,10 +803,6 @@ struct GamepadSettingsView: View {
             id: id, tab: tab, icon: icon, label: label,
             value: value.wrappedValue ? "On" : "Off",
             detail: detail,
-            // Toggles ride the band too (field ask): Off sits left of On, matching the
-            // directional semantics below, so a right-step slides On in from the right.
-            optionLabels: ["Off", "On"],
-            selectedIndex: value.wrappedValue ? 1 : 0,
             enabled: enabled,
             adjust: { delta in
                 // Directional semantics: left = off, right = on; a no-op reads as a boundary.

clients/apple/Sources/PunktfunkClient/Settings/SettingsOptions.swift

@@ -53,14 +53,6 @@ enum SettingsOptions {
     static let hudPlacements: [(label: String, tag: String)] =
         HUDPlacement.allCases.map { ($0.label, $0.rawValue) }
 
-    /// When the gamepad UI takes over (`DefaultsKey.gamepadUIMode`) — only meaningful while
-    /// `gamepadUIEnabled` is on, so every surface that offers it hides the row when the switch
-    /// is off rather than showing a picker that decides nothing.
-    static let gamepadUIModes: [(label: String, tag: String)] = [
-        ("With a controller", GamepadUIEnvironment.modeWhenConnected),
-        ("Always", GamepadUIEnvironment.modeAlways),
-    ]
-
     /// Presentation intent (`DefaultsKey.presentPriority` — the 2026-07 rebuild that replaced
     /// the visible stage picker with intent; see SessionPresenter's PresentPriority and
     /// design/apple-presentation-rebuild.md). The stage ladder survives only as the hidden

clients/apple/Sources/PunktfunkClient/Settings/SettingsView+Sections.swift

@@ -712,36 +712,14 @@ extension SettingsView {
                     Toggle("Rumble on this iPhone", isOn: $rumbleOnDevice)
                 }
             }
-            // The rumble mirror's sibling, data flowing the other way: hidden where the
-            // device has no motion hardware, engages only while the player-1 controller
-            // reports no rotation rate of its own.
-            if !inProfileScope, DeviceGyro.isAvailable {
-                described("When the controller has no gyro of its own, sends this device's "
-                    + "motion sensors as player 1's — for clip-on pads without one.") {
-                    Toggle("Gyro from this device", isOn: $gyroFromDevice)
-                }
-            }
             #endif
             #if !os(tvOS)
             if !inProfileScope {
-                described("The host list and library switch to a controller-friendly layout — "
-                    + "larger focus targets, a swipeable cover browser.") {
+                described("With a controller connected, the host list and library switch to a "
+                    + "controller-friendly layout — larger focus targets, a swipeable cover "
+                    + "browser.") {
                     Toggle("Gamepad-optimized browsing", isOn: $gamepadUIEnabled)
                 }
-                // Only meaningful while the switch above is on, so it is HIDDEN rather than
-                // disabled when it isn't: a picker whose every option decides nothing is worse
-                // than no picker, and this Section is short enough that nothing jumps far.
-                if gamepadUIEnabled {
-                    described("With a controller: the touch interface comes back when the last "
-                        + "one disconnects. Always keeps the controller-friendly layout either "
-                        + "way — for a device that lives on a TV.") {
-                        Picker("Show it", selection: $gamepadUIMode) {
-                            ForEach(SettingsOptions.gamepadUIModes, id: \.tag) { option in
-                                Text(option.label).tag(option.tag)
-                            }
-                        }
-                    }
-                }
             }
             #endif
             #if DEBUG && !os(tvOS)

clients/apple/Sources/PunktfunkClient/Settings/SettingsView.swift

@@ -75,13 +75,6 @@ struct SettingsView: View {
     @AppStorage(DefaultsKey.hudPlacement) var hudPlacement = HUDPlacement.topTrailing.rawValue
     @ObservedObject var gamepads = GamepadManager.shared
     @AppStorage(DefaultsKey.gamepadUIEnabled) var gamepadUIEnabled = true
-    /// When the switch above takes over — read (and shown) only while it is on.
-    @AppStorage(DefaultsKey.gamepadUIMode) var gamepadUIMode =
-        GamepadUIEnvironment.modeWhenConnected
-    /// The gamepad UI's background palette. Edited here on tvOS only (see `tvBody`) — every other
-    /// platform reaches it through the gamepad settings screen, which an Apple TV without a
-    /// controller cannot open.
-    @AppStorage(DefaultsKey.uiPalette) var uiPalette = "violet"
     @AppStorage(DefaultsKey.autoWake) var autoWakeEnabled = true
     @AppStorage(DefaultsKey.backgroundKeepAlive) var backgroundKeepAlive = false
     @AppStorage(DefaultsKey.backgroundTimeoutMinutes) var backgroundTimeoutMinutes = 10
@@ -98,7 +91,6 @@ struct SettingsView: View {
     @AppStorage(DefaultsKey.pointerCapture) var pointerCapture = true
     @AppStorage(DefaultsKey.touchMode) var touchMode = TouchInputMode.trackpad.rawValue
     @AppStorage(DefaultsKey.rumbleOnDevice) var rumbleOnDevice = false
-    @AppStorage(DefaultsKey.gyroFromDevice) var gyroFromDevice = false
     // The sidebar selection drives the detail pane on iPad and the pushed sub-page on iPhone.
     // Width class decides the initial value: nil on iPhone (show the category list first),
     // General on iPad (a two-column layout should never open with an empty detail).
@@ -495,22 +487,6 @@ struct SettingsView: View {
                 TVSelectionRow(
                     title: "Gamepad-optimized browsing",
                     options: [("On", "on"), ("Off", "off")], selection: gamepadUIEnabledTag)
-                // Hidden while the switch above is off — see the touch settings' identical gate.
-                if gamepadUIEnabled {
-                    TVSelectionRow(
-                        title: "Show it",
-                        options: SettingsOptions.gamepadUIModes, selection: $gamepadUIMode)
-                    // The Apple TV's ONLY route to the shared `ui_palette`. Everywhere else the
-                    // Background row lives on the gamepad settings screen, which is reached from
-                    // the gamepad launcher — and on tvOS that launcher needs an extended-profile
-                    // controller, so an Apple TV driven by the Siri Remote alone could not reach
-                    // the palettes at all. It belongs beside "Show it" because both describe the
-                    // same interface: this row is what that interface looks like once it is up.
-                    TVSelectionRow(
-                        title: "Background",
-                        options: GamepadPalette.all.map { (label: $0.name, tag: $0.id) },
-                        selection: $uiPalette)
-                }
                 tvCaption(Self.controllersFooter)
                 NavigationLink("About") { AboutView() }
                     .padding(.top, 8)

clients/apple/Sources/PunktfunkClient/Stores/HostStore.swift

@@ -200,16 +200,15 @@ final class HostStore: ObservableObject {
         if let data = try? JSONEncoder().encode(hosts) {
             defaults.set(data, forKey: Self.key)
         }
-        reloadHostsWidget() // the widgets read this store; any change refreshes their timelines
+        reloadHostsWidget() // the widget reads this store; any change refreshes its timeline
     }
 
-    /// Ask WidgetKit to rebuild the launcher widgets' timelines after any store change (add/remove/
-    /// pin/last-connected). iOS-only and a no-op where WidgetKit is absent; both widgets use
-    /// `.never`-refresh entries and rely on this push.
+    /// Ask WidgetKit to rebuild the hosts widget's timeline after any store change (add/remove/pin/
+    /// last-connected). iOS-only and a no-op where WidgetKit is absent; the widget uses
+    /// `.never`-refresh entries and relies on this push.
     private func reloadHostsWidget() {
         #if canImport(WidgetKit) && os(iOS)
         WidgetCenter.shared.reloadTimelines(ofKind: "PunktfunkHosts")
-        WidgetCenter.shared.reloadTimelines(ofKind: "PunktfunkLibrary")
         #endif
     }
 }

clients/apple/Sources/PunktfunkClient/Support/GlassStyle.swift

@@ -70,82 +70,41 @@ extension View {
 
 // MARK: - Console glass (gamepad host tiles + settings rows)
 
-/// Liquid Glass tuned for the gamepad UI's "console" surfaces — the host-carousel tiles and
+/// Liquid Glass tuned for the gamepad UI's dark "console" surfaces — the host-carousel tiles and
 /// the settings rows. Unlike `glassBackground` (floating-overlay only, per HIG), this deliberately
 /// clads content tiles / dense rows: a chosen part of the 10-foot console look. `tint` washes the
-/// glass toward a color (the palette accent on the focused / primary surface); `interactive` makes
-/// it flex on press.
-///
-/// Every tier is WASHED with the palette's `ink.glass` — the same surface colour the console
-/// fills its panels with — so switching the background palette recolours the surfaces, not just
-/// the text on them. The wash alphas are tune-on-device values with one fixed direction: the
-/// pale palettes' white frost needs MORE body than the dark glass (the console's 0.66-vs-0.62
-/// pair), because a thin white wash over a colourful field reads as haze, not as a surface.
+/// glass toward a color (the brand violet on the focused / primary surface); `interactive` makes
+/// it flex on press. The pre-26 fallback is `.ultraThinMaterial` forced dark — these surfaces
+/// always sit on the near-black backdrop, so the material must stay dark even in a light appearance.
 private struct ConsoleGlass<S: Shape>: ViewModifier {
     let shape: S
     var tint: Color?
     var interactive = false
-    /// Take the MATERIAL path even where real Liquid Glass is available. For surfaces that get
-    /// transformed while they animate: glass samples the backdrop through its own layer, and under
-    /// a `rotation3DEffect` / `opacity` it cannot, so it renders one way mid-animation and snaps to
-    /// another the instant the transform ends — on glass that reads as the tile being SWAPPED for a
-    /// different one as it lands. A material is a flat composite and looks identical throughout.
-    var forceMaterial = false
     /// The console surface follows the background palette: a PALE field needs the material to
     /// frost light and the glass to read as white, or the dark ink on top of it disappears.
     /// Defaults to the dark ink, so every non-gamepad caller is unchanged.
     @Environment(\.gamepadInk) private var ink
 
     private var scheme: ColorScheme { ink.isLight ? .light : .dark }
-    /// The palette wash over the material tiers (the material itself supplies the blur body).
-    private var materialWash: Color { ink.glass(ink.isLight ? 0.55 : 0.40) }
 
     func body(content: Content) -> some View {
-        // The scheme goes on the WHOLE modified view, not just the fill inside `.background {}`.
-        // Scoped to the fill it frosts the material correctly and stops there, so a system colour
-        // in the row's own content (a `.secondary` label, a `.bordered` button) still resolved
-        // against the device appearance — which is how the pale palettes came out light-on-light
-        // on tvOS, whose appearance is always Dark. The 26 branch had it right all along; the
-        // tvOS and pre-26 branches were the odd ones out.
         #if os(tvOS)
         // ALWAYS the material fallback on tvOS: the gamepad settings list is 15+ of these
         // surfaces, and live Liquid Glass per row made the whole screen visibly laggy on the
         // Apple TV's GPU (same class of call GlassProminentButton already makes — glass fights
-        // the 10-foot platform). The wash and tint ride overlays — two flat fills, no GPU cost.
-        content
-            .background {
-                shape.fill(.ultraThinMaterial)
-                    .environment(\.colorScheme, scheme)
-                    .overlay { shape.fill(materialWash) }
-                    .overlay {
-                        if let tint { shape.fill(tint) }
-                    }
-            }
-            .environment(\.colorScheme, scheme)
-        #else
-        if #available(iOS 26, macOS 26, *), !forceMaterial {
-            content
-                // The caller's tint rides HERE, not in `Glass.tint`, so it can ANIMATE. A Glass
-                // value is opaque to SwiftUI's animation system: changing its tint swaps one
-                // effect for another, which is why a focused row's accent used to appear (and,
-                // worse, disappear a beat late) as a hard jump while the row's scale animated
-                // smoothly beside it. A plain fill interpolates, so `.animation(value: focused)`
-                // at the call site now covers the whole row. Sits between the glass and the
-                // content: `.background` is behind the label, `glassEffect` behind both.
-                .background { shape.fill(tint ?? .clear) }
-                .glassEffect(glass, in: shape)
+        // the 10-foot platform). The tint rides an overlay so the focused row keeps its wash.
+        content.background {
+            shape.fill(.ultraThinMaterial)
                 .environment(\.colorScheme, scheme)
-        } else {
-            content
-                .background {
-                    shape.fill(.ultraThinMaterial)
-                        .environment(\.colorScheme, scheme)
-                        .overlay { shape.fill(materialWash) }
-                        .overlay {
-                            if let tint { shape.fill(tint) }
-                        }
+                .overlay {
+                    if let tint { shape.fill(tint) }
                 }
-                .environment(\.colorScheme, scheme)
+        }
+        #else
+        if #available(iOS 26, macOS 26, *) {
+            content.glassEffect(glass, in: shape).environment(\.colorScheme, scheme)
+        } else {
+            content.background { shape.fill(.ultraThinMaterial).environment(\.colorScheme, scheme) }
         }
         #endif
     }
@@ -153,21 +112,8 @@ private struct ConsoleGlass<S: Shape>: ViewModifier {
     #if !os(tvOS)
     @available(iOS 26, macOS 26, *)
     private var glass: Glass {
-        // The glass carries the PALETTE wash only — the caller's focus tint is an animatable fill
-        // above it now (see `body`).
-        //
-        // A pale palette gets `.clear` glass, not `.regular`. Its `ink.glass` is literal white, so
-        // over `.regular` — which is already a bright, high-body material — even a light white
-        // wash lands as a flat white slab: the refraction and the blurred field behind stop
-        // reading entirely, which is the "opaque fully white bg" on every row, pill and legend.
-        // Lowering the tint alone did NOT fix it, because the opacity was coming from the glass
-        // BODY rather than from the tint. `.clear` is the variant meant for exactly this — a
-        // surface over content that must stay visible through it — and a small white wash on top
-        // of it is enough to keep the dark ink legible without closing the surface up.
-        let wash = ink.glass(ink.isLight ? 0.18 : 0.45)
-        // Spelled out rather than `.clear`/`.regular`: a ternary between two leading-dot members
-        // gives the compiler no base type to infer from.
-        var g: Glass = (ink.isLight ? Glass.clear : Glass.regular).tint(wash)
+        var g: Glass = .regular
+        if let tint { g = g.tint(tint) }
         if interactive { g = g.interactive() }
         return g
     }
@@ -175,59 +121,9 @@ private struct ConsoleGlass<S: Shape>: ViewModifier {
 }
 
 extension View {
-    /// Liquid Glass for a console surface (a host tile / settings row), or `.ultraThinMaterial`
-    /// pre-26 — both washed with the palette's own glass colour, both frosting to the palette's
-    /// scheme. Pass the surface's shape explicitly — glass defaults to a Capsule.
-    ///
-    /// `forceMaterial` opts a TRANSFORMED surface out of live glass; see the property.
-    func consoleGlass<S: Shape>(
-        _ shape: S, tint: Color? = nil, interactive: Bool = false, forceMaterial: Bool = false
-    ) -> some View {
-        modifier(ConsoleGlass(
-            shape: shape, tint: tint, interactive: interactive, forceMaterial: forceMaterial))
-    }
-}
-
-// MARK: - Console floating glass (the gamepad screens' close buttons)
-
-/// `glassBackground` for a floating control INSIDE the gamepad UI (the close ✕): same shape
-/// contract, but washed with the palette's ink and frosted to the palette's scheme — plain
-/// `glassBackground` follows the SYSTEM appearance, which leaves the frost dark under dark ink
-/// when a pale palette is up. The non-gamepad floating surfaces (the HUD, the trust card, the
-/// touch connect modal) keep plain `glassBackground`: they sit over video or the touch UI,
-/// where the palette means nothing.
-private struct ConsoleGlassBackground<S: Shape>: ViewModifier {
-    let shape: S
-    var interactive = false
-    @Environment(\.gamepadInk) private var ink
-
-    private var scheme: ColorScheme { ink.isLight ? .light : .dark }
-
-    func body(content: Content) -> some View {
-        if #available(iOS 26, macOS 26, tvOS 26, *) {
-            content
-                .glassEffect(
-                    (interactive ? Glass.regular.interactive() : .regular)
-                        .tint(ink.glass(ink.isLight ? 0.60 : 0.45)),
-                    in: shape)
-                .environment(\.colorScheme, scheme)
-        } else {
-            // Same hoist as ConsoleGlass: the content needs the scheme too, not only the frost.
-            content
-                .background {
-                    shape.fill(.regularMaterial)
-                        .environment(\.colorScheme, scheme)
-                        .overlay { shape.fill(ink.glass(ink.isLight ? 0.55 : 0.40)) }
-                }
-                .environment(\.colorScheme, scheme)
-        }
-    }
-}
-
-extension View {
-    /// Palette-washed floating glass for the gamepad screens' own controls. Same fallback story
-    /// as `glassBackground` (`.regularMaterial` pre-26), plus the ink wash and scheme flip.
-    func consoleGlassBackground<S: Shape>(_ shape: S, interactive: Bool = false) -> some View {
-        modifier(ConsoleGlassBackground(shape: shape, interactive: interactive))
+    /// Liquid Glass for a dark console surface (a host tile / settings row), or `.ultraThinMaterial`
+    /// (forced dark) pre-26. Pass the surface's shape explicitly — glass defaults to a Capsule.
+    func consoleGlass<S: Shape>(_ shape: S, tint: Color? = nil, interactive: Bool = false) -> some View {
+        modifier(ConsoleGlass(shape: shape, tint: tint, interactive: interactive))
     }
 }

clients/apple/Sources/PunktfunkClient/Trust/GamepadPairView.swift

@@ -1,328 +0,0 @@
-// The gamepad-driven PIN pairing screen (iOS/iPadOS/macOS) — the controller counterpart of
-// PairSheet, and the reason a console-UI user can pair at all.
-//
-// PairSheet is a `Form` with two `TextField`s. On tvOS the focus engine drives those natively, but
-// on iOS/macOS a controller cannot reach a text field, type into it, or press the button
-// underneath — so for anyone in the console UI, pairing (the ONE thing standing between a fresh
-// install and a first stream) ended at "now touch the screen". This screen is the same ceremony
-// wearing the gamepad UI's own vocabulary: the vertical focus list from the settings/add-host
-// screens, A on a field to open GamepadKeyboard in a bottom tray, B to peel one layer.
-//
-// Structure deliberately mirrors GamepadAddHostView field for field — the two screens are the same
-// interaction (a short form, typed with a pad, committed by an action row) and a user who has
-// added a host should recognise this immediately. The ceremony itself is shared with PairSheet
-// (`PairCeremony`), so the two presentations can never disagree about what a wrong PIN means.
-
-import PunktfunkKit
-import SwiftUI
-#if os(iOS) || os(macOS)
-
-struct GamepadPairView: View {
-    @Environment(\.gamepadInk) private var ink
-    @Environment(\.gamepadMetrics) private var metrics
-    @Environment(\.displayBottomInset) private var displayBottomInset
-    @Environment(\.dismiss) private var dismiss
-    @Environment(\.gamepadHostedInShell) private var hostedInShell
-    let host: StoredHost
-    /// Called with the verified host fingerprint after a successful ceremony — the caller pins it
-    /// and connects (ContentView's `handlePaired`).
-    let onPaired: (Data) -> Void
-    /// How the in-place shell (iOS) closes this screen; nil (the macOS sheet) falls back to the
-    /// environment dismiss.
-    var close: (() -> Void)?
-    /// Whether this screen owns the controller — false while the shell is mid-transition or the
-    /// connect takeover is up (see GamepadAddHostView's twin).
-    var controllerActive = true
-
-    #if os(iOS)
-    /// `.compact` in a landscape phone window — tighter chrome so the keyboard tray still fits.
-    @Environment(\.verticalSizeClass) private var vSizeClass
-
-    private var compact: Bool { vSizeClass == .compact }
-    #else
-    private let compact = false // no size classes on macOS; the sheet is sized to fit the tray
-    #endif
-
-    @StateObject private var ceremony = PairCeremony()
-    @State private var pin = ""
-    #if os(macOS)
-    @State private var clientName = Host.current().localizedName ?? "Mac"
-    #else
-    @State private var clientName = UIDevice.current.name
-    #endif
-    @State private var focusID: String?
-    /// The field row the keyboard tray is editing; nil ⇒ the row list owns the controller.
-    @State private var editing: String?
-
-    var body: some View {
-        GamepadMenuList(
-            items: rows,
-            focusID: $focusID,
-            onActivate: { activate(id: $0.id) },
-            onBack: { performClose() },
-            // A ceremony in flight also takes the list out of the loop: `pair()` blocks on a
-            // background thread and its result rewrites this screen, so letting B peel a layer
-            // or A fire a second ceremony underneath it would race the completion.
-            isActive: controllerActive && editing == nil && !ceremony.busy
-        ) { row, focused in
-            rowView(row, focused: focused)
-                .frame(maxWidth: metrics.rowMaxWidth)
-                .padding(.horizontal, 24)
-        }
-        .frame(maxWidth: .infinity)
-        .safeAreaInset(edge: .top, spacing: 0) {
-            header
-                .padding(.horizontal, 24)
-                .padding(.top, gamepadTitleTopPadding(compact: compact))
-                .padding(.bottom, gamepadTitleBottomPadding(compact: compact))
-                .frame(maxWidth: .infinity, alignment: .leading)
-                .background { GamepadTrayBlur(edge: .top) }
-        }
-        .safeAreaInset(edge: .bottom, spacing: 0) {
-            bottomTray
-                // Equal distance from the left and bottom edges for the legend pill (see
-                // GamepadHomeView).
-                .padding(.horizontal, compact ? 12 : 18)
-                .padding(
-                    .bottom,
-                    gamepadLegendBottomPadding(
-                        compact ? 12 : 18, tier: metrics.tier, displayBottom: displayBottomInset))
-                .padding(.top, compact ? 6 : 10)
-                .background { GamepadTrayBlur(edge: .bottom) }
-        }
-        // Hosted in the shell, the field is the shell's own (see GamepadAddHostView's twin).
-        .background {
-            if !hostedInShell { GamepadFormBackground() }
-        }
-        // Publish the palette's ink to this screen (text, glass, accent, scrims) — a
-        // pale palette flips all of them, and no leaf should have to read the setting.
-        .gamepadPaletteInk()
-        // A PIN is short; cap it so the row can't grow absurd on a stuck key.
-        .onChange(of: pin) { _, value in
-            if value.count > Self.maxPINLength { pin = String(value.prefix(Self.maxPINLength)) }
-        }
-        // Any dismissal path abandons an in-flight ceremony — a late success must not pin and
-        // connect to a host the user backed out of.
-        .onDisappear { ceremony.abandon() }
-        // The visible close ✕ is gone (a gamepad UI exits with B) — this keeps a hardware
-        // keyboard's Esc and the macOS sheet's cancel working without chrome.
-        .background {
-            Button("Cancel") { performClose() }
-                .keyboardShortcut(.cancelAction)
-                .buttonStyle(.plain)
-                .frame(width: 0, height: 0)
-                .opacity(0)
-                .accessibilityHidden(true)
-        }
-    }
-
-    /// Generous next to the host's 4 digits: the PIN length is the HOST's business (a future one
-    /// may well be longer), so this is a runaway guard, not a validator. Rejecting a correct PIN
-    /// locally would be a far worse failure than sending a wrong one, which the host just refuses.
-    private static let maxPINLength = 12
-
-    private var header: some View {
-        VStack(alignment: .leading, spacing: gamepadHeaderSpacing(compact: compact)) {
-            // Leading, like every gamepad heading — and no close chrome (B is the exit).
-            Text("Pair with \(host.displayName)")
-                .font(.geist(gamepadTitleSize(compact: compact), .bold, relativeTo: .title))
-                .foregroundStyle(ink.fg)
-                .lineLimit(1)
-                .minimumScaleFactor(0.7)
-            if !compact {
-                Text("The PIN is shown in the host's web console (port 47992 → Pairing). "
-                    + "Pairing verifies both sides at once — no fingerprint comparison needed.")
-                    .font(.geist(metrics.detailFont, relativeTo: .caption))
-                    .foregroundStyle(ink.fg(0.55))
-                    .multilineTextAlignment(.leading)
-                    .frame(maxWidth: metrics.rowMaxWidth * 0.72, alignment: .leading)
-            }
-        }
-    }
-
-    /// The keyboard tray while editing, the status line + controls legend otherwise.
-    @ViewBuilder private var bottomTray: some View {
-        if let editing {
-            VStack(spacing: 10) {
-                GamepadKeyboard(
-                    text: editingBinding(editing),
-                    allowed: allowedCharacters(editing),
-                    onDone: { closeKeyboard() })
-                    // Fresh keyboard per field (see GamepadAddHostView) — the tray's input wiring
-                    // captured the previous binding on appear.
-                    .id(editing)
-                GamepadHintBar(hints: [
-                    .init(glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Type"),
-                    .init(
-                        glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Delete",
-                        action: { backspace(editing) }),
-                    .init(
-                        glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Done",
-                        action: { closeKeyboard() }),
-                ])
-                .frame(maxWidth: .infinity, alignment: .leading)
-            }
-            .transition(.move(edge: .bottom).combined(with: .opacity))
-        } else {
-            VStack(alignment: .leading, spacing: 8) {
-                statusLine
-                GamepadHintBar(hints: [
-                    .init(
-                        glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Select",
-                        action: { if let focusID { activate(id: focusID) } }),
-                    .init(
-                        glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Cancel",
-                        action: { performClose() }),
-                ])
-            }
-            .frame(maxWidth: .infinity, alignment: .leading)
-        }
-    }
-
-    /// What the ceremony is doing, in the slot the settings screen gives its detail line. Reserves
-    /// its space so the legend never jumps when a failure arrives.
-    @ViewBuilder private var statusLine: some View {
-        Group {
-            if ceremony.busy {
-                HStack(spacing: 8) {
-                    ProgressView().controlSize(.small).tint(ink.fg(0.7))
-                    Text("Pairing with \(host.displayName)…").foregroundStyle(ink.fg(0.7))
-                }
-            } else if let error = ceremony.errorText {
-                Text(error).foregroundStyle(.red)
-            } else {
-                // Placeholder keeps the reserved height honest under `lineLimit(2)`.
-                Text(" ").foregroundStyle(.clear)
-            }
-        }
-        .font(.geist(metrics.detailFont, relativeTo: .caption))
-        .lineLimit(2, reservesSpace: true)
-        .multilineTextAlignment(.leading)
-        .frame(maxWidth: metrics.rowMaxWidth, alignment: .leading)
-        .animation(.smooth(duration: 0.2), value: ceremony.errorText)
-    }
-
-    /// Close this screen through whichever mechanism presents it: the shell's layer pop on iOS,
-    /// the environment dismiss under a macOS sheet.
-    private func performClose() {
-        ceremony.abandon()
-        if let close { close() } else { dismiss() }
-    }
-
-    // MARK: - Rows
-
-    private struct Row: Identifiable {
-        let id: String
-        let label: String
-        var value = ""
-        var placeholder = ""
-        var isAction = false
-    }
-
-    private var rows: [Row] {
-        [
-            Row(id: "pin", label: "PIN", value: pin, placeholder: "Shown in the web console"),
-            Row(
-                id: "name", label: "Device name", value: clientName,
-                placeholder: "How the host lists this device"),
-            Row(id: "pair", label: "Pair & Connect", isAction: true),
-        ]
-    }
-
-    private func rowView(_ row: Row, focused: Bool) -> some View {
-        let m = metrics
-        return HStack(spacing: 14) {
-            if row.isAction {
-                Label("Pair & Connect", systemImage: "lock.shield")
-                    .font(.geist(m.labelFont, .semibold, relativeTo: .body))
-                    .foregroundStyle(canPair ? ink.accent : ink.fg(0.35))
-                    .frame(maxWidth: .infinity)
-            } else {
-                Text(row.label)
-                    .font(.geist(m.labelFont, .semibold, relativeTo: .body))
-                    .foregroundStyle(ink.fg)
-                Spacer(minLength: 12)
-                Text(row.value.isEmpty ? row.placeholder : row.value)
-                    .font(.geistFixed(m.valueFont, .medium))
-                    .foregroundStyle(row.value.isEmpty ? ink.fg(0.35) : ink.fg)
-                    .lineLimit(1)
-                    .truncationMode(.head) // keep the end of a long name visible while typing
-                if editing == row.id {
-                    // The live-edit caret: this row is what the keyboard tray is typing into.
-                    Rectangle()
-                        .fill(ink.accent)
-                        .frame(width: 2, height: m.labelFont + 2)
-                }
-            }
-        }
-        .padding(.horizontal, m.rowHPad)
-        .padding(.vertical, m.rowVPad)
-        .consoleGlass(
-            RoundedRectangle(cornerRadius: m.rowCorner, style: .continuous),
-            tint: (focused || editing == row.id) ? ink.accent(0.30) : nil,
-            interactive: focused)
-        .overlay {
-            RoundedRectangle(cornerRadius: m.rowCorner, style: .continuous)
-                .strokeBorder(
-                    editing == row.id ? ink.accent(0.7) : ink.fg(focused ? 0.28 : 0.06),
-                    lineWidth: 1)
-        }
-        .scaleEffect(focused ? 1.0 : 0.98)
-        .animation(.smooth(duration: 0.18), value: focused)
-    }
-
-    // MARK: - Actions
-
-    private func activate(id: String) {
-        guard !ceremony.busy else { return }
-        switch id {
-        case "pair":
-            guard canPair else {
-                // Not pairable yet — jump straight to what's missing instead of a dead press,
-                // matching the add-host screen's Add row.
-                focusID = "pin"
-                openKeyboard("pin")
-                return
-            }
-            ceremony.run(host: host.address, port: host.port, pin: pin, clientName: clientName) {
-                fingerprint in
-                onPaired(fingerprint)
-                // NOT `performClose()`: that abandons the ceremony, and this IS the ceremony's
-                // success. Closing is all that's left to do.
-                if let close { close() } else { dismiss() }
-            }
-        default:
-            openKeyboard(id)
-        }
-    }
-
-    private var canPair: Bool {
-        !pin.trimmingCharacters(in: .whitespaces).isEmpty && !ceremony.busy
-    }
-
-    private func openKeyboard(_ id: String) {
-        withAnimation(.spring(response: 0.32, dampingFraction: 0.86)) { editing = id }
-    }
-
-    private func closeKeyboard() {
-        withAnimation(.spring(response: 0.32, dampingFraction: 0.86)) { editing = nil }
-    }
-
-    private func editingBinding(_ id: String) -> Binding<String> {
-        id == "pin" ? $pin : $clientName
-    }
-
-    /// The legend's Delete cell — see GamepadAddHostView's twin for why this edits the binding
-    /// rather than reaching into the keyboard.
-    private func backspace(_ id: String) {
-        let binding = editingBinding(id)
-        guard !binding.wrappedValue.isEmpty else { return }
-        binding.wrappedValue.removeLast()
-    }
-
-    /// What the keyboard may type per field: a PIN is digits; a device name is free-form.
-    private func allowedCharacters(_ id: String) -> CharacterSet? {
-        id == "pin" ? CharacterSet(charactersIn: "0123456789") : nil
-    }
-}
-#endif

clients/apple/Sources/PunktfunkClient/Trust/PairCeremony.swift

@@ -1,86 +0,0 @@
-// The SPAKE2 PIN ceremony itself, with no opinion about how it's presented. Two screens run it:
-// `PairSheet` (the touch/desktop Form, and tvOS's focus-engine layout) and `GamepadPairView` (the
-// controller-driven console screen). The ceremony is the part that must not diverge between them —
-// it decides what counts as a wrong PIN, what a rejection means, and which failures are worth
-// telling the user apart — so it lives here once rather than being copied into the second caller.
-//
-// Threading: `pair()` and the identity load both BLOCK, so they run off the main actor; every
-// published mutation lands back on it.
-
-import Foundation
-import PunktfunkKit
-import SwiftUI
-
-@MainActor
-final class PairCeremony: ObservableObject {
-    /// A ceremony is in flight — callers disable their commit action and show a spinner.
-    @Published private(set) var busy = false
-    /// The last failure, in user-facing terms; cleared when a new attempt starts.
-    @Published var errorText: String?
-
-    /// Dismissing the presenting screen must abandon an in-flight ceremony: the blocking `pair()`
-    /// call can't be interrupted, so its completion checks this token and self-discards — a late
-    /// success must NOT pin and auto-connect to a host the user cancelled out of. A fresh token
-    /// per attempt, so abandoning one attempt can't silence the next.
-    private var token = Token()
-
-    private final class Token: @unchecked Sendable {
-        var cancelled = false
-    }
-
-    /// Run the ceremony. `onPaired` receives the host's now-VERIFIED fingerprint — the caller pins
-    /// it and connects; no manual fingerprint comparison is needed, because the host proved itself
-    /// with the same PIN.
-    func run(
-        host address: String, port: UInt16, pin rawPIN: String, clientName rawName: String,
-        onPaired: @escaping (Data) -> Void
-    ) {
-        busy = true
-        errorText = nil
-        let pin = rawPIN.trimmingCharacters(in: .whitespaces)
-        let name = rawName.trimmingCharacters(in: .whitespaces)
-        token = Token()
-        let token = token
-        Task.detached(priority: .userInitiated) {
-            // Identity load + the ceremony both block — keep them off the main actor.
-            // loadForPairing is the strict variant: the host durably trusts this
-            // identity, so it must have made it into the Keychain.
-            let result = Result {
-                let identity = try ClientIdentityStore.shared.loadForPairing()
-                return try PunktfunkKit.pair(
-                    host: address, port: port, identity: identity,
-                    pin: pin, name: name.isEmpty ? "Mac" : name)
-            }
-            await MainActor.run {
-                guard !token.cancelled else { return } // screen dismissed mid-ceremony
-                self.busy = false
-                switch result {
-                case .success(let fingerprint):
-                    onPaired(fingerprint)
-                case .failure(PunktfunkClientError.wrongPIN):
-                    self.errorText = "Wrong PIN — check the host's web console (port 47992) "
-                        + "and try again."
-                case .failure(PunktfunkClientError.rejected(let rejection)):
-                    // The host answered and said why (not armed / rate-limited / armed for
-                    // another device) — show that instead of the guessing-game fallback.
-                    self.errorText = rejection.userMessage
-                case .failure(is ClientIdentityStore.IdentityError):
-                    self.errorText = "Can't store this Mac's identity in the Keychain, so the "
-                        + "pairing would not survive a relaunch. Unlock the login "
-                        + "keychain and try again."
-                case .failure:
-                    self.errorText = "Pairing failed — the host didn't answer. Is it running, "
-                        + "and is this device on the same network (no VPN, no guest-Wi-Fi "
-                        + "isolation)?"
-                }
-            }
-        }
-    }
-
-    /// The presenting screen went away — discard whatever is still in flight. Called from every
-    /// dismissal path (an explicit Cancel, a swipe, B on a controller), which is why it is safe to
-    /// call when nothing is running.
-    func abandon() {
-        token.cancelled = true
-    }
-}

clients/apple/Sources/PunktfunkClient/Trust/PairSheet.swift

@@ -5,15 +5,19 @@
 // host rate-limits ceremonies to one per 2 s). Success returns the host's now-VERIFIED
 // fingerprint: the caller pins it, no manual comparison needed, and the host stores this
 // client's identity in return.
-//
-// This is the TOUCH/desktop presentation (and tvOS's, where the focus engine drives the same
-// fields). A controller can't reach a `Form`'s text fields on iOS/macOS, so the console UI
-// presents `GamepadPairView` instead — same ceremony, via the shared `PairCeremony`.
 
 import Foundation
 import PunktfunkKit
 import SwiftUI
 
+/// Dismissing the sheet must abandon an in-flight ceremony: the blocking pair() call
+/// can't be interrupted, so its completion checks this flag and self-discards — a late
+/// success must NOT pin and auto-connect to a host the user cancelled out of. Only
+/// touched on the main actor.
+private final class CeremonyToken: @unchecked Sendable {
+    var cancelled = false
+}
+
 struct PairSheet: View {
     @Environment(\.dismiss) private var dismiss
     let host: StoredHost
@@ -26,10 +30,9 @@ struct PairSheet: View {
     #else
     @State private var clientName = UIDevice.current.name
     #endif
-    @StateObject private var ceremony = PairCeremony()
-
-    private var busy: Bool { ceremony.busy }
-    private var errorText: String? { ceremony.errorText }
+    @State private var busy = false
+    @State private var errorText: String?
+    @State private var token = CeremonyToken()
     #if os(tvOS)
     private enum EditField: String, Identifiable {
         case pin, clientName
@@ -61,7 +64,7 @@ struct PairSheet: View {
             }
             HStack(spacing: 32) {
                 Button("Cancel", role: .cancel) {
-                    ceremony.abandon()
+                    token.cancelled = true
                     dismiss()
                 }
                 if busy {
@@ -75,7 +78,7 @@ struct PairSheet: View {
         .frame(maxWidth: 1000)
         .padding(60)
         .navigationTitle("Pair with \(host.displayName)")
-        .onDisappear { ceremony.abandon() }
+        .onDisappear { token.cancelled = true }
         .fullScreenCover(item: $editing) { field in
             switch field {
             case .pin:
@@ -139,7 +142,7 @@ struct PairSheet: View {
         #endif
             HStack {
                 Button("Cancel", role: .cancel) {
-                    ceremony.abandon()
+                    token.cancelled = true
                     dismiss()
                 }
                 #if !os(tvOS)
@@ -177,7 +180,7 @@ struct PairSheet: View {
         .presentationDragIndicator(busy ? .hidden : .visible)
         #endif
         .interactiveDismissDisabled(busy)
-        .onDisappear { ceremony.abandon() } // any other dismissal path
+        .onDisappear { token.cancelled = true } // any other dismissal path
         #endif
     }
 
@@ -192,11 +195,47 @@ struct PairSheet: View {
     }
 
     private func runCeremony() {
-        ceremony.run(
-            host: host.address, port: host.port, pin: pin, clientName: clientName
-        ) { fingerprint in
-            onPaired(fingerprint)
-            dismiss()
+        busy = true
+        errorText = nil
+        let pin = pin.trimmingCharacters(in: .whitespaces)
+        let name = clientName.trimmingCharacters(in: .whitespaces)
+        let address = host.address
+        let port = host.port
+        let token = token
+        Task.detached(priority: .userInitiated) {
+            // Identity load + the ceremony both block — keep them off the main actor.
+            // loadForPairing is the strict variant: the host durably trusts this
+            // identity, so it must have made it into the Keychain.
+            let result = Result {
+                let identity = try ClientIdentityStore.shared.loadForPairing()
+                return try PunktfunkKit.pair(
+                    host: address, port: port, identity: identity,
+                    pin: pin, name: name.isEmpty ? "Mac" : name)
+            }
+            await MainActor.run {
+                guard !token.cancelled else { return } // sheet dismissed mid-ceremony
+                busy = false
+                switch result {
+                case .success(let fingerprint):
+                    onPaired(fingerprint)
+                    dismiss()
+                case .failure(PunktfunkClientError.wrongPIN):
+                    errorText = "Wrong PIN — check the host's web console (port 47992) "
+                        + "and try again."
+                case .failure(PunktfunkClientError.rejected(let rejection)):
+                    // The host answered and said why (not armed / rate-limited / armed for
+                    // another device) — show that instead of the guessing-game fallback.
+                    errorText = rejection.userMessage
+                case .failure(is ClientIdentityStore.IdentityError):
+                    errorText = "Can't store this Mac's identity in the Keychain, so the "
+                        + "pairing would not survive a relaunch. Unlock the login "
+                        + "keychain and try again."
+                case .failure:
+                    errorText = "Pairing failed — the host didn't answer. Is it running, "
+                        + "and is this device on the same network (no VPN, no guest-Wi-Fi "
+                        + "isolation)?"
+                }
+            }
         }
     }
 }

clients/apple/Sources/PunktfunkClient/Trust/TrustCardView.swift

@@ -1,12 +1,6 @@
 // Trust-on-first-use prompt: shown over the live-but-blurred stream when connecting to an
 // unpinned host. The user compares the fingerprint with the one the host logged at startup,
 // or drops this and runs the PIN pairing ceremony instead.
-//
-// Controller-drivable on iOS/macOS (A trust, B cancel, X pair instead). It had no controller
-// wiring at all, which made it a dead end for a pad-only user at the worst possible moment: the
-// card appears mid-connect with capture disabled (ContentView blurs the stream and stops
-// forwarding), so the pad in their hands genuinely did nothing and the only way past was to reach
-// for the screen. tvOS needs none of this — the focus engine drives the buttons natively.
 
 import Foundation
 import PunktfunkKit
@@ -19,12 +13,6 @@ struct TrustCardView: View {
     let onTrust: () -> Void
     let onPairInstead: () -> Void
 
-    #if os(iOS) || os(macOS)
-    /// Observed so the legend appears the moment a pad wakes up mid-prompt — and so it stays
-    /// absent for the mouse/touch users this card is otherwise for.
-    @ObservedObject private var gamepads = GamepadManager.shared
-    #endif
-
     var body: some View {
         VStack(spacing: 14) {
             Image(systemName: "lock.shield")
@@ -72,35 +60,12 @@ struct TrustCardView: View {
                 .buttonStyle(.borderless)
                 #endif
                 .font(.geist(16, relativeTo: .callout))
-            #if os(iOS) || os(macOS)
-            // Only with a pad attached: controller glyphs in front of a trackpad user would be
-            // naming buttons they don't have.
-            if gamepads.active != nil {
-                GamepadHintBar(hints: [
-                    .init(
-                        glyph: buttonGlyph(\.buttonA, fallback: "a.circle"), text: "Trust",
-                        action: onTrust),
-                    .init(
-                        glyph: buttonGlyph(\.buttonX, fallback: "x.circle"), text: "Pair with PIN",
-                        action: onPairInstead),
-                    .init(
-                        glyph: buttonGlyph(\.buttonB, fallback: "b.circle"), text: "Cancel",
-                        action: onCancel),
-                ])
-                .padding(.top, 2)
-            }
-            #endif
         }
         .padding(28)
         .frame(maxWidth: 440)
         // Floating trust card over the blurred stream — Liquid Glass on 26+, .regularMaterial
         // fallback below. The inner fingerprint box stays .quaternary (content, not glass).
         .glassBackground(RoundedRectangle(cornerRadius: 18))
-        #if os(iOS) || os(macOS)
-        .background {
-            TrustControllerInput(onTrust: onTrust, onCancel: onCancel, onPairInstead: onPairInstead)
-        }
-        #endif
     }
 
     /// 64 hex chars → four groups per line, two lines — easy to eyeball against the log.
@@ -115,35 +80,6 @@ struct TrustCardView: View {
     }
 }
 
-#if os(iOS) || os(macOS)
-/// Controller binding for the trust prompt: A trusts, B cancels, X runs the PIN ceremony instead.
-/// The same zero-size-backing-view shape as `ConnectOverlay`'s `ConnectControllerInput` — mounted
-/// for exactly as long as the card is up, and `GamepadMenuInput`'s snapshot-on-start swallows
-/// whatever button was still held when it appeared (the A press that started the connect is
-/// usually still down).
-///
-/// Nothing else is polling the pad here: capture is off for the duration of the prompt, and the
-/// home screens are unmounted behind the session view.
-private struct TrustControllerInput: View {
-    let onTrust: () -> Void
-    let onCancel: () -> Void
-    let onPairInstead: () -> Void
-    @State private var input = GamepadMenuInput(manager: .shared)
-
-    var body: some View {
-        Color.clear
-            .frame(width: 0, height: 0)
-            .onAppear {
-                input.onConfirm = onTrust
-                input.onBack = onCancel
-                input.onTertiary = onPairInstead
-                input.start()
-            }
-            .onDisappear { input.stop() }
-    }
-}
-#endif
-
 private extension Array {
     func chunks(of size: Int) -> [[Element]] {
         stride(from: 0, to: count, by: size).map { Array(self[$0..<Swift.min($0 + size, count)]) }

clients/apple/Sources/PunktfunkKit/Audio/AudioDeviceWatcher.swift

@@ -1,129 +0,0 @@
-// "The audio output moved under us" — the one signal `SessionAudio` needs to survive a device
-// change, and the one piece of it that can be tested without a stream.
-//
-// Split out of SessionAudio deliberately. An end-to-end test of the recovery needs a live session,
-// which needs a host, and punktfunk-host does not build on macOS — so the wiring that matters most
-// (is the observer actually installed? does the identity check let the notification through?) would
-// otherwise ship unverified, and a silent failure in it costs the session ALL of its audio. On its
-// own this can be pointed at the real hardware from a unit test: see AudioDeviceWatcherTests.
-//
-// What it does NOT own: anything with session semantics. The iOS route-change steer and the
-// media-services-reset re-activation stay in SessionAudio, next to the AVAudioSession they act on.
-
-import AVFoundation
-import os
-#if os(macOS)
-import CoreAudio
-#endif
-
-private let log = Logger(subsystem: "io.unom.punktfunk", category: "audio")
-
-final class AudioDeviceWatcher {
-    /// Why the owner is being told. Only for the log line — every reason leads to the same
-    /// question, "is playback still on the device it should be on".
-    enum Reason: String {
-        /// An engine stopped itself because its IO hardware changed underneath it.
-        case engineConfiguration = "the audio hardware configuration changed"
-        /// The system's default output device moved (macOS).
-        case defaultOutputDevice = "the default output device changed"
-    }
-
-    /// Does this configuration change belong to an engine the session still owns? A retired engine
-    /// posts one last change as it is torn down, and other AVAudioEngines in the process are not
-    /// ours to restart.
-    private let isOurs: (AnyObject?) -> Bool
-    /// Delivered on the main queue.
-    private let onChange: (Reason) -> Void
-
-    private let lock = NSLock()
-    private var configObserver: NSObjectProtocol?
-    #if os(macOS)
-    private var defaultOutputListener: AudioObjectPropertyListenerBlock?
-    #endif
-
-    init(isOurs: @escaping (AnyObject?) -> Bool, onChange: @escaping (Reason) -> Void) {
-        self.isOurs = isOurs
-        self.onChange = onChange
-    }
-
-    deinit { stop() }
-
-    /// Idempotent.
-    func start() {
-        lock.lock()
-        let already = configObserver != nil
-        lock.unlock()
-        guard !already else { return }
-
-        let token = NotificationCenter.default.addObserver(
-            forName: .AVAudioEngineConfigurationChange, object: nil, queue: nil
-        ) { [weak self] note in
-            // Posted from whatever thread the IO unit noticed on. The engine is the notification's
-            // object; it is only ever compared by identity, never resurrected.
-            let posted = note.object as AnyObject?
-            DispatchQueue.main.async {
-                guard let self, self.isOurs(posted) else { return }
-                self.onChange(.engineConfiguration)
-            }
-        }
-        lock.lock()
-        configObserver = token
-        lock.unlock()
-
-        #if os(macOS)
-        // The engine notification is the direct signal, but it is delivered BY an engine — useless
-        // in the two places it is needed most: after a rebuild that could not start (no engine left
-        // to notify anyone) and on an engine topology whose notification behaviour is unverified
-        // (the voice-processing engine, which is the DEFAULT macOS configuration and which no Mac
-        // here can even initialize). The HAL is told either way.
-        let block: AudioObjectPropertyListenerBlock = { [weak self] _, _ in
-            self?.onChange(.defaultOutputDevice) // on the main queue — registered against it below
-        }
-        var address = Self.defaultOutputAddress()
-        let status = AudioObjectAddPropertyListenerBlock(
-            AudioObjectID(kAudioObjectSystemObject), &address, DispatchQueue.main, block)
-        guard status == noErr else {
-            log.warning("""
-                could not watch the default output device (\(status)) — an output device change \
-                mid-stream may need a reconnect
-                """)
-            return
-        }
-        lock.lock()
-        defaultOutputListener = block
-        lock.unlock()
-        #endif
-    }
-
-    /// Idempotent, and safe from any thread. After it returns, no further `onChange` is delivered
-    /// except one already in flight on the main queue — which the owner's own stopped-flag catches.
-    func stop() {
-        lock.lock()
-        let token = configObserver
-        configObserver = nil
-        #if os(macOS)
-        let listener = defaultOutputListener
-        defaultOutputListener = nil
-        #endif
-        lock.unlock()
-        if let token { NotificationCenter.default.removeObserver(token) }
-        #if os(macOS)
-        guard let listener else { return }
-        var address = Self.defaultOutputAddress()
-        AudioObjectRemovePropertyListenerBlock(
-            AudioObjectID(kAudioObjectSystemObject), &address, DispatchQueue.main, listener)
-        #endif
-    }
-
-    #if os(macOS)
-    /// Freshly built per call rather than held in a mutable static: the HAL takes the address
-    /// `inout` and copies it, so there is nothing to share and a shared one would only be a
-    /// mutable global.
-    private static func defaultOutputAddress() -> AudioObjectPropertyAddress {
-        AudioObjectPropertyAddress(
-            mSelector: kAudioHardwarePropertyDefaultOutputDevice,
-            mScope: kAudioObjectPropertyScopeGlobal,
-            mElement: kAudioObjectPropertyElementMain)
-    }
-    #endif
-}

clients/apple/Sources/PunktfunkKit/Audio/AudioDevices.swift

@@ -43,21 +43,8 @@ public enum AudioDevices {
     }
 
     private static func defaultInputDevice() -> AudioDeviceID? {
-        systemDevice(kAudioHardwarePropertyDefaultInputDevice)
-    }
-
-    /// The device the system is currently playing to — what an engine with no pinned speaker UID
-    /// follows, and so what `SessionAudio` compares its live output device against when the
-    /// default moves (AirPods in or out, a headset unplugged).
-    static func defaultOutputDevice() -> AudioDeviceID? {
-        systemDevice(kAudioHardwarePropertyDefaultOutputDevice)
-    }
-
-    private static func systemDevice(
-        _ selector: AudioObjectPropertySelector
-    ) -> AudioDeviceID? {
         var address = AudioObjectPropertyAddress(
-            mSelector: selector,
+            mSelector: kAudioHardwarePropertyDefaultInputDevice,
             mScope: kAudioObjectPropertyScopeGlobal,
             mElement: kAudioObjectPropertyElementMain)
         var dev = AudioDeviceID(0)

clients/apple/Sources/PunktfunkKit/Audio/AudioRing.swift

@@ -16,23 +16,11 @@ import os
 /// (`punktfunk_core::audio::JitterPolicy`): a slow depth average that sits above target for a
 /// sustained window sheds ONE 5 ms frame with a crossfade, and the hard cap is only a backstop.
 ///
-/// **Adaptive depth.** The target is a floor, not a constant: a NEAR-MISS — a read served with
-/// less than one frame left over — grows it a step BEFORE anything was audible, repeated genuine
-/// underruns grow it too (`noteRead`, mirroring `JitterPolicy::note_read`) up to `maxTargetMS`,
-/// and a long quiet spell relaxes it back toward the base — so a session on Wi-Fi that bunches
-/// arrivals deepens until it stops crackling, while a clean LAN keeps the tight base latency.
-/// Growth only raises a promise; the one thing that re-banks real depth is a re-prime, so an
-/// underrun while the ring is HOLLOW (depth average far below the target) re-primes at once,
-/// spending the click it already cost on the whole refill. Every shrink is armed as a PROBE:
-/// answered by an underrun or near-miss within its window, it is undone on the spot, and a
-/// failed sync-driven shrink is not retried for a growing backoff. Keep the constants here in
-/// step with `JitterTuning.COREAUDIO`.
-///
-/// **A/V sync.** On top of all that the depth can be STEERED, by `setSyncTarget` from the drain
-/// thread's `AvSync` — because a ring that is the right depth for the link is not thereby the
-/// right depth for the picture. Continuity still outranks sync: the request is clamped between
-/// the underrun-driven floor above and the hard cap, so the loop can never buy alignment with a
-/// dropout. `nil` (the default) is exactly the pre-sync behaviour.
+/// **Adaptive depth.** The target is a floor, not a constant: repeated genuine underruns grow it
+/// a step at a time (`noteRead`, mirroring `JitterPolicy::note_read`) up to `maxTargetMS`, and a
+/// long quiet spell relaxes it back toward the base — so a session on Wi-Fi that bunches arrivals
+/// deepens until it stops crackling, while a clean LAN keeps the tight base latency. Keep the
+/// constants here in step with `JitterTuning.COREAUDIO`.
 final class AudioRing: @unchecked Sendable {
     /// Mirrors `JitterTuning::COREAUDIO` — see that type for the rationale.
     private static let targetMS = 20
@@ -60,33 +48,6 @@ final class AudioRing: @unchecked Sendable {
     private static let growWindowMS = 5_000
     private static let growStepMS = 10
     private static let shrinkQuietMS = 30_000
-    /// The same quiet span, while the A/V sync loop is actively asking to run shallower. A grown
-    /// target normally relaxes only after a long spell because, absent other evidence, the only
-    /// thing that can justify giving up hard-won slack is time; a sync request IS that evidence —
-    /// a measurement saying the extra depth is costing alignment right now — so a smaller target
-    /// gets tested sooner. Mirrors `SHRINK_QUIET_SYNC_MS`.
-    private static let shrinkQuietSyncMS = 5_000
-    /// Post-read depth below which a served callback counts as a NEAR-MISS: the device got its
-    /// samples, but with less than one protocol frame left in hand — the same evidence as an
-    /// underrun, except nobody heard it yet, so the target grows BEFORE the click instead of
-    /// after the third one. Mirrors `NEAR_MISS_MARGIN_MS`.
-    private static let nearMissMarginMS = frameMS
-    /// How long a shrink remains a PROBE, in consumed audio: an underrun or near-miss inside
-    /// this window means the shrink was wrong, and the previous target is restored at once.
-    /// Mirrors `SHRINK_PROBE_MS`.
-    private static let shrinkProbeMS = 5_000
-    /// How long a failed probe keeps the sync loop from driving another shrink — without it the
-    /// loop pays an audible starvation event every `shrinkQuietSyncMS` on any link whose jitter
-    /// genuinely needs the depth, forever. Doubles per consecutive failure, capped; a probe that
-    /// survives its window resets it. Mirror `SYNC_BACKOFF_MS` / `SYNC_BACKOFF_MAX_MS`.
-    private static let syncBackoffMS = 60_000
-    private static let syncBackoffMaxMS = 480_000
-    /// A ring is HOLLOW when its depth AVERAGE sits this far below the target: growth only ever
-    /// raises the promise, and the one thing that re-banks real depth is a re-prime — so an
-    /// underrun in a hollow ring re-primes AT ONCE, spending the click it already cost on the
-    /// whole refill instead of riding the knife edge one click per bunching period. Mirrors
-    /// `DEPRIME_DEBT_MS`.
-    private static let deprimeDebtMS = growStepMS
 
     private var buf: [Float]
     private var readIdx = 0
@@ -109,32 +70,6 @@ final class AudioRing: @unchecked Sendable {
     /// which is a different problem from the depth being wrong.
     private var underrunCount = 0
     private var shedCount = 0
-    /// The depth the A/V sync loop would like, in interleaved samples (`AvSync.desiredDepth`).
-    /// `nil` — the default, and what an un-wired session keeps — reproduces the pre-sync
-    /// behaviour exactly, so this ring could adopt sync without the other three diverging.
-    private var syncTarget: Int?
-    /// This read was served with less than `nearMissMarginMS` left over (set in `read`,
-    /// consumed by `noteRead`).
-    private var nearMiss = false
-    /// A near-miss already grew the target this window — one step per window, so a bunching
-    /// episode (a RUN of consecutive near-misses while the ring refills) buys one measured
-    /// step, not a sprint to the ceiling.
-    private var nearMissGrown = false
-    /// The depth average runs a `deprimeDebtMS` debt against the target (set in `read`): an
-    /// underrun should re-prime at once instead of waiting out the hysteresis.
-    private var hollow = false
-    /// Interleaved samples left in the current shrink-probe window (0 = no probe outstanding).
-    private var probeRun = 0
-    /// The live target before the probed shrink, restored if the probe fails.
-    private var probePrevTarget = 0
-    /// Interleaved samples before the sync loop may drive another shrink (0 = allowed now).
-    private var syncBackoffRun = 0
-    /// Length of the NEXT backoff, in ms — doubles per consecutive failed probe, capped.
-    private var syncBackoffLenMS = AudioRing.syncBackoffMS
-    /// The sync loop's smoothed offset in ms, STORED not computed: the ring owns the depth but has
-    /// no timestamps, so the drain thread (which has both a packet's `pts_ns` and the video leg)
-    /// hands the number back for reporting. Mirrors `NativeClient::audio_av_offset_ms`.
-    private var avOffsetMS = 0
     private let channels: Int
     private let perMS: Int
     private let lock = OSAllocatedUnfairLock()
@@ -150,71 +85,9 @@ final class AudioRing: @unchecked Sendable {
 
     /// Effective target depth in interleaved samples: the (adaptively grown) live target, lifted
     /// so it can always serve one device quantum plus a packet (a large-buffer device cannot
-    /// sustain a target below its own quantum) — then, if the A/V sync loop has asked for a depth,
-    /// its request CLAMPED into that band. Mirrors `JitterPolicy::effective_target`.
-    ///
-    /// The clamp order is the whole safety argument for steering playback depth off a network
-    /// measurement at all: sync may pull the ring shallower to catch the picture up, or push it
-    /// deeper when audio runs early, but never below what underrun pressure has proven this link
-    /// needs, and never past the hard cap that bounds added latency. A link whose jitter genuinely
-    /// demands more buffer than the picture is away keeps its buffer and the residual is REPORTED
-    /// (`Stats.avOffsetMS`) rather than taken out of the listener's stream.
-    ///
-    /// The ceiling is raised to the floor rather than used as-is: a device whose callback quantum
-    /// alone exceeds `hardCapMS` makes `floor > cap`, and a plain `min(max(s, floor), cap)` would
-    /// then return the CAP — i.e. quietly below the continuity floor, inverting the very ordering
-    /// this exists to guarantee, on exactly the awkward hardware it exists to survive. (Rust's
-    /// `Ord::clamp` announces the same condition by panicking; Swift would just get it wrong.)
-    private var target: Int { target(lift: renderQuantum) }
-
-    /// The effective target with an explicit quantum lift. The property above uses the high-water
-    /// `renderQuantum` (priming must survive the biggest callback seen); the hollow check in
-    /// `read` passes the CURRENT callback instead, mirroring the Rust side's `want` — a one-off
-    /// oversized read would otherwise inflate the debt threshold forever and turn the very next
-    /// late packet into a full re-prime.
-    private func target(lift quantum: Int) -> Int {
-        let floor = max(targetLive, quantum + Self.frameMS * perMS)
-        guard let want = syncTarget else { return floor }
-        let cap = max(Self.hardCapMS * perMS, floor)
-        return min(max(want, floor), cap)
-    }
-
-    /// The sync loop is asking to run shallower than the adaptive target has grown to — the
-    /// evidence `noteRead` relaxes a grown target on. Compared against the LIVE target, not the
-    /// effective one: it is the underrun-driven growth that a sync request is evidence against,
-    /// not the device-quantum lift, which no amount of measurement can argue with.
-    private var syncWantsLess: Bool {
-        guard let want = syncTarget else { return false }
-        return want < targetLive
-    }
-
-    /// Hand the ring the depth the A/V sync loop wants (`AvSync.desiredDepth`), in interleaved
-    /// samples, or `nil` to run unsynchronised. Called from the drain thread.
-    ///
-    /// This is a REQUEST, not a command — see `target` for what happens to it. `nil` is the
-    /// default and reproduces the pre-sync behaviour exactly.
-    func setSyncTarget(_ samples: Int?) {
-        lock.lock()
-        defer { lock.unlock() }
-        syncTarget = samples
-    }
-
-    /// Store the sync loop's smoothed A/V offset for reporting (positive = audio behind the
-    /// picture). The ring cannot compute this — it has no timestamps — but it is where the two
-    /// numbers a listener's complaint needs, depth and offset, can be read under one lock.
-    func noteAvOffset(_ ms: Int) {
-        lock.lock()
-        defer { lock.unlock() }
-        avOffsetMS = ms
-    }
-
-    /// Buffered depth in interleaved samples — what the sync loop measures against (`bufferedMS`
-    /// is the same quantity rounded for humans). Everything queued here must play before the frame
-    /// the drain thread is about to write, which is exactly what delays it.
-    var bufferedSamples: Int {
-        lock.lock()
-        defer { lock.unlock() }
-        return writeIdx - readIdx
+    /// sustain a target below its own quantum).
+    private var target: Int {
+        max(targetLive, renderQuantum + Self.frameMS * perMS)
     }
 
     func write(_ samples: UnsafePointer<Float>, count: Int) {
@@ -262,24 +135,12 @@ final class AudioRing: @unchecked Sendable {
             if available >= target {
                 primed = true
                 emptyReads = 0
-                // The refill just banked this much: seed the average with it rather than letting
-                // it climb from wherever the drought left it — a freshly-primed ring would
-                // otherwise read as hollow for the EWMA's whole settling time, and the FIRST
-                // late packet would re-prime a ring that is actually full.
-                depthAvg = Double(available)
             } else {
                 for i in 0..<count { out[i] = 0 }
                 return
             }
         }
 
-        // Hollow: the depth AVERAGE runs a debt against the target — the promise has been raised
-        // but the depth was never re-banked (see `deprimeDebtMS`). Judged on the average, not
-        // this instant: a single late packet empties the ring for a callback without making it
-        // hollow, and must keep the consecutive-empties hysteresis. Lifted by THIS callback's
-        // size, not the high-water quantum — see `target(lift:)`.
-        hollow = depthAvg + Double(Self.deprimeDebtMS * perMS) < Double(target(lift: count))
-
         // Drift correction: shed exactly one frame, crossfaded, once the AVERAGE has sat above
         // the threshold for the sustain window. Anything shorter is jitter and must be left alone.
         if depthAvg > Double(target + Self.shedExcessMS * perMS) {
@@ -303,9 +164,6 @@ final class AudioRing: @unchecked Sendable {
         if n < count {
             for i in n..<count { out[i] = 0 }
         }
-        // Near-miss: served in full, but with less than one frame left over — the next callback
-        // starves unless a packet lands within one frame time.
-        nearMiss = n == count && writeIdx - readIdx < Self.nearMissMarginMS * perMS
         noteRead(ranShort: n < count, count: count)
     }
 
@@ -320,84 +178,27 @@ final class AudioRing: @unchecked Sendable {
         if windowRun >= Self.growWindowMS * perMS {
             windowRun = 0
             underrunsInWindow = 0
-            nearMissGrown = false
-        }
-        syncBackoffRun = max(0, syncBackoffRun - count)
-        var restored = false
-        if probeRun > 0 {
-            probeRun = max(0, probeRun - count)
-            if ranShort || nearMiss {
-                // The probe FAILED: the link answered a shrink with (nearly) starving the ring.
-                // Take the depth straight back — re-learning it three audible underruns at a
-                // time is what made the sync-vs-growth tug-of-war audible — and keep the sync
-                // loop from probing again for a while, doubling per consecutive failure. The
-                // residual A/V offset is reported instead; continuity outranks sync. The
-                // restore CONSUMES this event as growth evidence: it answered a depth the ring
-                // is no longer at, so growing past the proven target on top would overshoot.
-                probeRun = 0
-                targetLive = max(targetLive, probePrevTarget)
-                syncBackoffRun = syncBackoffLenMS * perMS
-                syncBackoffLenMS = min(syncBackoffLenMS * 2, Self.syncBackoffMaxMS)
-                restored = true
-            } else if probeRun == 0 {
-                // Survived the whole window: the shallower depth is genuinely safe here, so the
-                // next probe starts from a clean slate.
-                syncBackoffLenMS = Self.syncBackoffMS
-            }
         }
         if ranShort {
             quietRun = 0
             emptyReads += 1
             underrunCount += 1
-            if emptyReads >= Self.deprimeAfter || hollow {
-                // The consecutive-empties hysteresis protects a FULL ring from one late packet.
-                // A hollow ring is the opposite case: the target has been raised but the depth
-                // never re-banked (growth is a promise; only a re-prime cashes it), and riding
-                // that out is a click per bunching period, forever. The click just heard has
-                // already paid for the refill — take it now.
+            if emptyReads >= Self.deprimeAfter {
                 primed = false
                 emptyReads = 0
             }
-            if !restored {
-                underrunsInWindow += 1
-            }
+            underrunsInWindow += 1
             if underrunsInWindow >= Self.growUnderruns {
                 underrunsInWindow = 0
                 windowRun = 0
                 targetLive = min(targetLive + Self.growStepMS * perMS, Self.maxTargetMS * perMS)
             }
-        } else if nearMiss {
-            // Came within one frame of an underrun — the same evidence as one, heard by no one.
-            // Growing here, BEFORE the click, is what "no audible jitter" means: waiting for
-            // the third audible underrun means the user heard two. One step per window (a
-            // bunching episode is a RUN of near-misses while the ring refills, and must buy one
-            // measured step, not a sprint to the ceiling); if it worsens into real underruns
-            // the path above takes over. A near-miss is pressure, not quiet.
-            quietRun = 0
-            emptyReads = 0
-            if !nearMissGrown, !restored {
-                nearMissGrown = true
-                targetLive = min(targetLive + Self.growStepMS * perMS, Self.maxTargetMS * perMS)
-            }
         } else {
             emptyReads = 0
             quietRun += count
-            // Without a sync request, time is the only evidence that hard-won slack is no longer
-            // needed, so a grown target waits out the long window. A request for less IS evidence,
-            // and without this branch a ring that ratcheted to the ceiling during a transient would
-            // hold audio a ceiling's worth late for minutes after the cause had gone. Every shrink
-            // is armed as a PROBE — answered by an underrun or near-miss it is undone at once (see
-            // above), and a failed sync-driven guess is not retried for a backoff.
-            let syncShrink = syncWantsLess && syncBackoffRun == 0
-            let quietNeeded = syncShrink ? Self.shrinkQuietSyncMS : Self.shrinkQuietMS
-            if quietRun >= quietNeeded * perMS {
+            if quietRun >= Self.shrinkQuietMS * perMS {
                 quietRun = 0
-                let prev = targetLive
                 targetLive = max(targetLive - Self.growStepMS * perMS, Self.targetMS * perMS)
-                if targetLive < prev {
-                    probeRun = Self.shrinkProbeMS * perMS
-                    probePrevTarget = prev
-                }
             }
         }
     }
@@ -438,12 +239,6 @@ final class AudioRing: @unchecked Sendable {
         let targetMS: Int
         let underruns: Int
         let sheds: Int
-        /// The A/V sync loop's smoothed offset (ms): **positive = audio playing BEHIND the
-        /// picture**, negative = ahead of it. `0` before the loop has evidence, or with sync off.
-        ///
-        /// Reported next to the depth, never instead of it: a deep ring on a jittery link is
-        /// CORRECT behaviour, and only the offset separates that from a ring holding audio late.
-        let avOffsetMS: Int
     }
 
     var stats: Stats {
@@ -453,154 +248,7 @@ final class AudioRing: @unchecked Sendable {
             bufferedMS: (writeIdx - readIdx) / max(perMS, 1),
             targetMS: target / max(perMS, 1),
             underruns: underrunCount,
-            sheds: shedCount,
-            avOffsetMS: avOffsetMS)
-    }
-}
-
-// MARK: - A/V sync
-
-/// The A/V synchronisation controller: turns "when will this audio actually play" and "when did
-/// the picture it belongs with reach the glass" into a ring depth `AudioRing` should aim for.
-/// The Swift mirror of `punktfunk_core::audio::AvSync` — keep the two in step.
-///
-/// **The defect it exists to fix.** The host stamps `pts_ns` on every audio datagram and the
-/// client decoded it into `AudioPCM` — and then never read it. Video's `pts_ns`, by contrast, is
-/// used end to end (`LatencyMeter` computes a true glass-to-glass `displayed + clockOffset − pts`
-/// per presented frame). So audio free-ran at whatever depth its jitter ring happened to settle
-/// at, video was presented on a wholly independent path, and nothing ever compared them: the A/V
-/// offset was an accident of buffer depths. It moved whenever the ring ratcheted under underrun
-/// pressure, and — the way this surfaced in the field — it got WORSE every time video got faster,
-/// because a quicker decoder lowers the video leg while leaving the audio leg exactly where it was.
-///
-/// **Video is the master.** In a game streamer the video leg is the input-feel budget and must
-/// never be inflated to satisfy the audio clock; audio tolerates small, crossfaded, rate-limited
-/// corrections that are inaudible, and `AudioRing.shedOneFrame` already applies them. So audio
-/// moves.
-///
-/// **Continuity outranks sync.** This type only ever PROPOSES a depth. `AudioRing` clamps the
-/// proposal to its own underrun-driven floor (see `AudioRing.target`), so a link whose jitter
-/// genuinely needs more buffer than the picture is away keeps its buffer and the residual is
-/// reported instead of being taken out of the listener's stream.
-///
-/// Not a class and not locked: it is owned outright by the drain thread that observes packets.
-struct AvSync {
-    /// Smoothing time constant for the measured offset, in ms of consumed audio. Long enough that
-    /// network jitter and a single late datagram do not move it; short enough to track real drift.
-    private static let ewmaTauMS = 2_000
-    /// Offsets inside this band are left alone. Correcting a few ms costs a (crossfaded, but real)
-    /// discontinuity and buys nothing a listener can perceive — detectability for A/V misalignment
-    /// sits an order of magnitude above it. The deadband is what keeps the loop from hunting
-    /// forever around zero, which would be audible in a way the misalignment it chased was not.
-    private static let deadbandMS = 10
-    /// Observations folded before the first correction is offered. The offset is derived from a
-    /// clock skew estimate and a video figure that both need a moment to settle after connect;
-    /// acting on the first sample would chase the handshake, not the stream.
-    private static let minObservations = 100
-    /// An offset larger than this is not believed. A wall-clock step, a paused host, or a stale
-    /// video figure can all produce an enormous apparent misalignment, and steering the ring by it
-    /// would empty or overfill it outright. Beyond this the loop reports and waits rather than acts.
-    private static let saneLimitMS = 1_000
-    /// The protocol's frame, in ms — the EWMA is weighted by it so the time constant means the
-    /// same thing however often the caller observes.
-    private static let frameMS = 5
-
-    /// Interleaved samples per millisecond at the negotiated layout (48 × channels).
-    private let perMS: Int
-    /// EWMA of the measured offset in ns. Positive = audio is scheduled to play LATE relative to
-    /// the picture it belongs with.
-    private var offsetAvgNs: Double = 0
-    private var observations = 0
-    /// Set once an observation lands outside `saneLimitMS`, for reporting.
-    private(set) var implausible = false
-
-    /// `channels` is the negotiated interleaved channel count (2/6/8).
-    init(channels: Int) {
-        perMS = 48 * max(channels, 1)
-    }
-
-    /// One measurement handed to `observe`. Every field is in the units its source already
-    /// produces, so no caller has to do clock arithmetic to use it correctly.
-    struct Observation {
-        /// The host capture timestamp carried by the audio frame being queued (host clock).
-        let ptsNs: UInt64
-        /// Local `CLOCK_REALTIME` now — the same basis `LatencyMeter` stamps video in.
-        let nowLocalNs: Int64
-        /// Host clock minus client clock, from the skew handshake (`clockOffsetNs`).
-        ///
-        /// It very nearly CANCELS: the video figure this is differenced against was computed with
-        /// the same offset and the same sign, so as long as both terms use one value the skew
-        /// drops out of the result entirely. That is what makes the connect-time offset good
-        /// enough here even though the absolute legs would prefer a re-synced one.
-        let clockOffsetNs: Int64
-        /// How much audio is already queued AHEAD of this frame, in interleaved samples —
-        /// everything that must play before it does.
-        let bufferedAhead: Int
-        /// The video plane's current end-to-end figure in ns: `displayed + clockOffset − pts`, as
-        /// `LatencyMeter` already computes it per presented frame. `nil` while nothing has reached
-        /// the glass recently — no reference, no correction.
-        let videoE2eNs: Int64?
-    }
-
-    /// Fold one measurement. Returns the smoothed offset in ns once there is enough evidence to
-    /// believe it (positive = audio late), or `nil` while still settling.
-    ///
-    /// Rejecting the implausible rather than clamping it is deliberate: a wall-clock step or a
-    /// stale video figure produces a huge apparent offset, and a clamped-but-wrong value would be
-    /// acted on as though it were a small real one.
-    @discardableResult
-    mutating func observe(_ o: Observation) -> Int64? {
-        // No frame on the glass yet ⇒ no reference to align against, so nothing to say.
-        guard let videoE2eNs = o.videoE2eNs else { return nil }
-        // When this frame's samples will actually reach the speaker, expressed in the host's
-        // capture clock — the same clock, and the same shape, as the video figure it is compared
-        // against.
-        let bufferedNs = Int64(o.bufferedAhead / max(perMS, 1)) * 1_000_000
-        // Overflow-reporting arithmetic, NOT the wrapping `&+`/`&-` the meters use. Every term is
-        // a nanosecond count on the same epoch (~1.8e18), so the DIFFERENCE is tiny while the
-        // operands sit within a factor of five of `Int64.max` — and a garbage `pts_ns` would wrap
-        // a nonsense value round into a small, plausible-looking offset. This loop's entire
-        // defence is that it can tell nonsense from a real misalignment, so an overflow takes the
-        // same exit the sanity limit does rather than being silently believed.
-        let (playAtLocal, o1) = o.nowLocalNs.addingReportingOverflow(bufferedNs)
-        let (playAtHost, o2) = playAtLocal.addingReportingOverflow(o.clockOffsetNs)
-        let (audioE2eNs, o3) = playAtHost.subtractingReportingOverflow(Int64(bitPattern: o.ptsNs))
-        let (offsetNs, o4) = audioE2eNs.subtractingReportingOverflow(videoE2eNs)
-        guard !o1, !o2, !o3, !o4, abs(offsetNs) <= Int64(Self.saneLimitMS) * 1_000_000 else {
-            implausible = true
-            return nil
-        }
-        implausible = false
-
-        let alpha = min(1.0, Double(Self.frameMS) / Double(Self.ewmaTauMS))
-        if observations == 0 {
-            offsetAvgNs = Double(offsetNs)
-        } else {
-            offsetAvgNs += (Double(offsetNs) - offsetAvgNs) * alpha
-        }
-        observations += 1
-        return settled ? Int64(offsetAvgNs) : nil
-    }
-
-    /// Enough evidence folded to act on.
-    var settled: Bool { observations >= Self.minObservations }
-
-    /// The smoothed offset in ms (positive = audio late), for the HUD. Reported as soon as it is
-    /// measured, including while still settling — a number the operator can watch converge is more
-    /// useful than a blank that hides whether the loop is working at all.
-    var offsetMS: Int { Int(offsetAvgNs / 1_000_000) }
-
-    /// The ring depth that would place audio with the picture, given where the ring is now.
-    /// `nil` while unsettled or inside the deadband — the caller then leaves the ring alone.
-    ///
-    /// Audio late (offset > 0) means there is too much queued: aim shallower. Audio early means
-    /// aim deeper.
-    func desiredDepth(currentDepth: Int) -> Int? {
-        guard settled else { return nil }
-        let offsetMs = offsetAvgNs / 1_000_000
-        guard abs(offsetMs) >= Double(Self.deadbandMS) else { return nil }
-        let delta = Int(offsetMs * Double(perMS))
-        return max(0, currentDepth - delta)
+            sheds: shedCount)
     }
 }
 

clients/apple/Sources/PunktfunkKit/Audio/SessionAudio.swift

@@ -21,10 +21,6 @@
 //
 // Devices are chosen by UID ("" = system default: the engine is then never pinned to a
 // concrete device and follows default-device changes).
-//
-// Surviving the hardware. An AVAudioEngine does NOT follow the audio hardware: when the output
-// device changes underneath a running engine, the engine stops itself and stays stopped. The
-// session therefore watches for that and rebuilds its engines — see "Device changes" below.
 
 import AVFoundation
 import os
@@ -66,13 +62,6 @@ public final class SessionAudio {
     /// not the ring, so the drain thread never has to be re-pointed). Main-thread confined,
     /// like every start path.
     private var ring: AudioRing?
-    /// The video plane's end-to-end meter (capture→on-glass), if the owner wired one — the
-    /// reference the A/V sync loop steers the ring against. `nil` leaves the loop inert and the
-    /// ring exactly as it was before sync existed, which is also what the stage-1 fallback
-    /// presenter gets: it decodes and presents inside the layer with no per-frame stamp, so it can
-    /// offer no reference, and a loop with no reference must not invent one. Main-thread confined,
-    /// like `ring`; the meter itself is internally locked and read from the drain thread.
-    private var videoLatency: LatencyMeter?
     #if !os(macOS)
     /// AVAudioSession `setCategory`/`setActive` are synchronous and block on the audio server, so
     /// they must not run on the main thread (UI stall — AVFoundation warns about it). PROCESS-WIDE
@@ -83,52 +72,6 @@ public final class SessionAudio {
     /// session's activate.
     private static let sessionQueue = DispatchQueue(label: "io.unom.punktfunk.audio.session")
     #endif
-    #if !os(macOS)
-    /// Token for the route-change observer: it revives an engine the route change stopped, and on
-    /// iOS re-applies the earpiece steer (see `installRouteObserver`). Guarded by `stateLock`.
-    private var routeObserver: NSObjectProtocol?
-    /// Token for the media-services-reset observer — the audio server restarting takes the
-    /// session's configuration and every engine with it. Guarded by `stateLock`.
-    private var mediaResetObserver: NSObjectProtocol?
-    /// Token for the interruption observer — a phone call or a non-mixable app stops the engines,
-    /// and ending the interruption restarts nothing by itself (see
-    /// `installInterruptionObserver`). Guarded by `stateLock`.
-    private var interruptionObserver: NSObjectProtocol?
-    #endif
-
-    // MARK: - Device changes (see `installDeviceChangeRecovery`)
-
-    /// What `start()` was asked for, so a rebuild can put back the SAME topology the session was
-    /// started with. Main-thread confined, like the start paths that read it.
-    private var startConfig: StartConfig?
-    private struct StartConfig {
-        let speakerUID: String
-        let micUID: String
-        let micChannel: Int
-        let micEnabled: Bool
-        let echoCancel: Bool
-    }
-    /// Watches the hardware for us (see `AudioDeviceWatcher`). Guarded by `stateLock`.
-    private var deviceWatcher: AudioDeviceWatcher?
-    /// Whether the engines have been built at least once. Distinguishes "not started yet" (iOS
-    /// starts asynchronously) from "started and dead", which is what the recovery may act on.
-    /// Main-thread confined.
-    private var enginesAttempted = false
-    /// A rebuild is already on the main queue — one device switch produces a burst of triggers
-    /// and they must collapse into one restart. Main-thread confined.
-    private var rebuildQueued = false
-    /// `systemUptime` of the last rebuild, so a device that renegotiates in a loop cannot spin
-    /// the session. Main-thread confined.
-    private var lastRebuildAt: TimeInterval = 0
-    /// Let the burst of triggers from one switch land before rebuilding.
-    private static let rebuildDebounce: TimeInterval = 0.15
-    /// Floor between two rebuilds.
-    private static let rebuildFloor: TimeInterval = 0.5
-    /// Retries when a rebuild's `start()` loses the race with a device that is still going away
-    /// (0.3 s, 0.6 s, 1.2 s). A failed rebuild leaves no engine to post the next notification,
-    /// so this ladder — and, on macOS, the HAL listener — is all that stands between a mistimed
-    /// switch and a silent session.
-    private static let rebuildAttempts = 3
 
     public init(connection: PunktfunkConnection) {
         self.connection = connection
@@ -139,15 +82,6 @@ public final class SessionAudio {
     /// Engine teardown still belongs to stop().
     deinit {
         flag.stop()
-        // The observers only hold self weakly, so we can be deinited with them still registered;
-        // drop them here too rather than leaking them when an owner skips stop().
-        deviceWatcher?.stop()
-        #if !os(macOS)
-        if let routeObserver { NotificationCenter.default.removeObserver(routeObserver) }
-        if let mediaResetObserver {
-            NotificationCenter.default.removeObserver(mediaResetObserver)
-        }
-        #endif
     }
 
     /// Start playback (and, if enabled+authorized, the mic uplink). Empty UIDs = system default
@@ -157,22 +91,9 @@ public final class SessionAudio {
     /// a later main-queue hop (gated by `!flag.isStopped`) — so playback is live shortly after, not
     /// on return. The mic may start later still if the permission prompt is pending.
     /// `echoCancel` picks the engine topology — see the header note and `wantsCombined`.
-    ///
-    /// `videoLatency` is the session's END-TO-END latency meter (capture→on-glass). Pass it to arm
-    /// A/V sync: it is the only thing that tells the audio plane where the picture actually is, and
-    /// without it the ring keeps today's free-running behaviour. Omit it for a playback-only or
-    /// stage-1 session, where no such figure is measured.
     public func start(
-        speakerUID: String, micUID: String, micChannel: Int, micEnabled: Bool, echoCancel: Bool,
-        videoLatency: LatencyMeter? = nil
+        speakerUID: String, micUID: String, micChannel: Int, micEnabled: Bool, echoCancel: Bool
     ) {
-        self.videoLatency = videoLatency
-        // Before any engine exists: the recovery watches the hardware, not the engines, and the
-        // config it rebuilds from has to be recorded whether or not this start succeeds.
-        startConfig = StartConfig(
-            speakerUID: speakerUID, micUID: micUID, micChannel: micChannel,
-            micEnabled: micEnabled, echoCancel: echoCancel)
-        installDeviceChangeRecovery(micEnabled: micEnabled)
         #if os(macOS)
         // No AVAudioSession on macOS — start the engines directly (caller's thread, as before).
         startEngines(
@@ -203,37 +124,11 @@ public final class SessionAudio {
         do {
             #if os(iOS)
             if micEnabled {
-                // NO .defaultToSpeaker here, deliberately. It reads like "prefer the speaker over
-                // the earpiece", and the comment that used to sit here claimed headphones and
-                // Bluetooth still won. That is true of WIRED headphones and false of Bluetooth —
-                // a cable is the one way to test this and see the right answer. It is an
-                // OVERRIDE, and it outranks an A2DP route: with it set, every Bluetooth headset
-                // lost the stream to the phone's own speaker. That is the 0.25 field report ("no
-                // audio over Bluetooth ... plays through speakers if Mic input is enabled") — mic
-                // and echo cancellation both default to ON, so this branch is the DEFAULT path
-                // and every Bluetooth listener hit it; turning the mic off was the accidental
-                // workaround, because that lands on `.playback` below, which routes to A2DP
-                // happily.
-                //
-                // The earpiece problem it was reaching for is real, so it is solved after
-                // activation instead, against the route we were ACTUALLY given —
-                // see `steerBuiltInOutputToSpeaker`.
-                //
-                // `.allowBluetoothA2DP` alone, also deliberately: adding `.allowBluetooth` would
-                // make a headset's MIC usable, but it buys that by dragging the whole route onto
-                // HFP/SCO and collapsing game audio to narrowband. High-quality A2DP output plus
-                // the built-in mic is the better trade for a game-streaming client.
-                // `.mixWithOthers`, both branches: without it this session is EXCLUSIVE — merely
-                // activating it paused the user's Music at connect, and Music's RESUME took the
-                // session right back, which read as "stream audio stops when I resume Music"
-                // (field report; the interruption observer below is the other half of that fix).
-                // A game stream mixing over someone's playlist is the behavior a console has,
-                // and what this client's peers do. The trade is real but right: a mixable
-                // session is nobody's Now Playing app, so the lock screen shows the music, not
-                // the stream — which is exactly how it should read.
+                // .defaultToSpeaker: .playAndRecord otherwise routes to the iPhone EARPIECE; only
+                // affects the built-in route (headphones/BT still win).
                 try session.setCategory(
                     .playAndRecord, mode: .default,
-                    options: [.allowBluetoothA2DP, .mixWithOthers])
+                    options: [.allowBluetoothA2DP, .defaultToSpeaker])
                 // Uplink latency: ask for 5 ms IO quanta at the wire rate (the default ~10-23 ms
                 // quantum is most of the mic path's burst latency). Best-effort — the hardware
                 // has the final word (a Bluetooth route will ignore both), and whatever quantum
@@ -241,91 +136,24 @@ public final class SessionAudio {
                 try? session.setPreferredIOBufferDuration(0.005)
                 try? session.setPreferredSampleRate(48_000)
             } else {
-                try session.setCategory(.playback, mode: .default, options: [.mixWithOthers])
+                try session.setCategory(.playback, mode: .default)
             }
             #else // tvOS — no app-accessible mic
-            try session.setCategory(.playback, mode: .default, options: [.mixWithOthers])
+            try session.setCategory(.playback, mode: .default)
             #endif
             try session.setActive(true)
-            #if os(iOS)
-            // Only the `.playAndRecord` session can land on the earpiece, and only it accepts an
-            // output override — so the mic-off (`.playback`) path deliberately does neither.
-            // (The route OBSERVER that re-applies this per route is installed by
-            // `installDeviceChangeRecovery`, for every session — a `.playback` session steers
-            // nothing but still has engines a route change can stop.)
-            if micEnabled { steerBuiltInOutputToSpeaker(session) }
-            #endif
         } catch {
             log.warning("AVAudioSession setup failed: \(error.localizedDescription)")
         }
     }
     #endif
 
-    #if os(iOS)
-    /// `.playAndRecord` parks the BUILT-IN output on the earpiece — right for a phone call,
-    /// useless for a game. Move it to the speaker, but ONLY when the route we were actually given
-    /// is the receiver: anything external (Bluetooth, wired, CarPlay, AirPlay) is left strictly
-    /// alone. That "look first" is the whole difference between this and the `.defaultToSpeaker`
-    /// option it replaced, which forced the speaker unconditionally and so beat Bluetooth.
-    ///
-    /// Idempotent and cheap, so the route observer can simply call it again.
-    private func steerBuiltInOutputToSpeaker(_ session: AVAudioSession) {
-        // An override already in force shows up as `.builtInSpeaker`, not `.builtInReceiver`, so
-        // re-running this never fights its own previous result.
-        guard session.currentRoute.outputs.contains(where: { $0.portType == .builtInReceiver })
-        else { return }
-        do {
-            try session.overrideOutputAudioPort(.speaker)
-        } catch {
-            log.warning("could not move audio off the earpiece: \(error.localizedDescription)")
-        }
-    }
-
-    #endif
-
-    #if !os(macOS)
-    /// Routes change under a live session: a headset connects mid-stream, or disconnects and hands
-    /// the stream back to the built-in output. Two things follow from that.
-    ///
-    /// iOS drops an output override whenever the route changes — which is what lets a newly-
-    /// connected headset win — so the earpiece steer is a property of the CURRENT route and has to
-    /// be re-applied per route. Without it, dropping Bluetooth mid-stream lands the game on the
-    /// earpiece.
-    ///
-    /// And on every platform a route change can take the engines down with it (see
-    /// `installDeviceChangeRecovery`), which is why this is installed for `.playback` sessions and
-    /// on tvOS too, where there is no earpiece to steer away from.
-    private func installRouteObserver() {
-        let observer = NotificationCenter.default.addObserver(
-            forName: AVAudioSession.routeChangeNotification,
-            object: AVAudioSession.sharedInstance(), queue: nil
-        ) { [weak self] _ in
-            // Arrives on whatever thread AVFoundation posts it from, and the session API blocks
-            // on the audio server — so do the work on the shared session queue, like every
-            // other call into it.
-            SessionAudio.sessionQueue.async {
-                guard let self, !self.flag.isStopped else { return }
-                #if os(iOS)
-                self.steerBuiltInOutputToSpeaker(AVAudioSession.sharedInstance())
-                #endif
-                DispatchQueue.main.async { self.reviveStoppedEngines("the audio route changed") }
-            }
-        }
-        stateLock.lock()
-        let stale = routeObserver
-        routeObserver = observer
-        stateLock.unlock()
-        if let stale { NotificationCenter.default.removeObserver(stale) }
-    }
-    #endif
-
     /// Build + start the engines — combined (voice-processed) or split, per `wantsCombined` —
     /// with the mic uplink only when enabled + authorized. Main thread (engine setup); on
     /// iOS/tvOS the session is already active by the time this runs.
     private func startEngines(
         speakerUID: String, micUID: String, micChannel: Int, micEnabled: Bool, echoCancel: Bool
     ) {
-        enginesAttempted = true // even if every path below fails — see `reviveStoppedEngines`
         #if os(tvOS)
         // No app-accessible microphone input on tvOS — playback only.
         startPlayback(speakerUID: speakerUID)
@@ -399,34 +227,26 @@ public final class SessionAudio {
     public func stop() {
         flag.stop() // before taking the engines — see stateLock's comment
         stateLock.lock()
+        let capture = captureEngine
+        captureEngine = nil
+        let playback = playbackEngine
+        playbackEngine = nil
+        let combined = combinedEngine
+        combinedEngine = nil
         let wasDraining = drainStarted
         drainStarted = false
-        let watcher = deviceWatcher
-        deviceWatcher = nil
-        #if !os(macOS)
-        let route = routeObserver
-        routeObserver = nil
-        let mediaReset = mediaResetObserver
-        mediaResetObserver = nil
-        let interruption = interruptionObserver
-        interruptionObserver = nil
-        #endif
         stateLock.unlock()
-        // Every watcher goes before the engines do: a device change landing during teardown must
-        // not schedule a rebuild of a session we are in the middle of releasing. (`flag` already
-        // guards that, but not arming the trigger is better than catching it.) On iOS this is
-        // also ahead of the deactivate below, so a route change cannot re-steer a dying session.
-        watcher?.stop()
+        if let capture {
+            capture.inputNode.removeTap(onBus: 0)
+            capture.stop()
+        }
+        playback?.stop()
+        if let combined {
+            combined.inputNode.removeTap(onBus: 0)
+            combined.stop()
+        }
         #if !os(macOS)
-        if let route { NotificationCenter.default.removeObserver(route) }
-        if let mediaReset { NotificationCenter.default.removeObserver(mediaReset) }
-        if let interruption { NotificationCenter.default.removeObserver(interruption) }
-        #endif
-        tearDownEngines()
-        #if !os(macOS)
-        // Release the session. (A mixable session interrupts nobody, so the resume cue below is
-        // now a courtesy for the edge where an OLD non-mixable install interrupted something —
-        // harmless either way, and deactivating promptly is still what orders a reconnect.) Like
+        // Release the session so audio we interrupted (Music, podcasts) gets its resume cue. Like
         // activation, setActive is synchronous/blocking — run it on the shared serial session queue
         // (off the main thread). Enqueued HERE — engines already stopped, and BEFORE the drain wait
         // below — so across a reconnect it lands ahead of the next session's activate on the shared
@@ -445,267 +265,6 @@ public final class SessionAudio {
         }
     }
 
-    /// Stop and release every engine we own, leaving the ring, the drain thread, the observers and
-    /// the audio session alone — the teardown half shared by `stop()` and a rebuild. Safe from any
-    /// thread; the engines are taken under the lock before any of them is touched.
-    private func tearDownEngines() {
-        stateLock.lock()
-        let capture = captureEngine
-        captureEngine = nil
-        let playback = playbackEngine
-        playbackEngine = nil
-        let combined = combinedEngine
-        combinedEngine = nil
-        stateLock.unlock()
-        if let capture {
-            capture.inputNode.removeTap(onBus: 0)
-            capture.stop()
-        }
-        playback?.stop()
-        if let combined {
-            combined.inputNode.removeTap(onBus: 0)
-            combined.stop()
-        }
-    }
-
-    // MARK: - Device changes
-
-    /// An AVAudioEngine does not follow the audio hardware. When the output device changes under a
-    /// running engine — AirPods taken out of an ear, a headset unplugged, the default switched in
-    /// System Settings — the engine's IO unit sees the new hardware, THE ENGINE STOPS ITSELF, and
-    /// it posts `AVAudioEngineConfigurationChange`. It stays stopped until somebody starts it
-    /// again. Nothing here ever did, so from that moment the session rendered silence: no audio on
-    /// the speakers the stream had just moved to, and none in the AirPods when they went back in
-    /// (that is a second stop, not a recovery), until the whole stream was restarted. Measured on
-    /// this exact topology: render callbacks go from ~94/s to zero the instant the default output
-    /// device changes, and both restarting the same engine and building a fresh one resume them.
-    ///
-    /// Three triggers feed one rebuild, because no single one of them covers the ground:
-    ///
-    ///  - the engine notification, everywhere — the direct signal, but only an engine that still
-    ///    EXISTS can post it, so it cannot report a rebuild that failed to start;
-    ///  - the HAL default-output-device listener, macOS — independent of any engine and of the
-    ///    engine's topology. It is what makes the recovery work for the voice-processing engine
-    ///    (mic + echo cancellation, the DEFAULT macOS configuration) without having to assume that
-    ///    a VPIO engine posts the notification the plain one demonstrably does;
-    ///  - the route-change and media-services-reset notifications, iOS/tvOS, where the session and
-    ///    not the device is what moves.
-    ///
-    /// `micEnabled` only decides whether the mic-bearing session observers are worth installing.
-    /// Main thread.
-    private func installDeviceChangeRecovery(micEnabled: Bool) {
-        stateLock.lock()
-        let already = deviceWatcher != nil
-        stateLock.unlock()
-        guard !already else { return } // a second start() on one SessionAudio: keep the first set
-
-        let watcher = AudioDeviceWatcher(
-            isOurs: { [weak self] posted in self?.ownsEngine(posted) ?? false },
-            onChange: { [weak self] reason in self?.hardwareMoved(reason) })
-        stateLock.lock()
-        deviceWatcher = watcher
-        stateLock.unlock()
-        watcher.start()
-
-        #if !os(macOS)
-        installRouteObserver()
-        installMediaResetObserver(micEnabled: micEnabled)
-        installInterruptionObserver(micEnabled: micEnabled)
-        #endif
-    }
-
-    /// Is `posted` one of the engines this session currently owns? A retired engine posts one last
-    /// configuration change as it is torn down, and another AVAudioEngine in the process is none of
-    /// our business — identity only, the object is never resurrected.
-    private func ownsEngine(_ posted: AnyObject?) -> Bool {
-        stateLock.lock()
-        defer { stateLock.unlock() }
-        return posted === playbackEngine || posted === captureEngine || posted === combinedEngine
-    }
-
-    /// The hardware moved (main queue, from `AudioDeviceWatcher`). Both reasons ask the same
-    /// question — is playback still where it should be — but they answer it differently: an engine
-    /// that told us it stopped is definitive, while the default device moving might not concern us
-    /// at all.
-    private func hardwareMoved(_ reason: AudioDeviceWatcher.Reason) {
-        guard !flag.isStopped else { return }
-        switch reason {
-        case .engineConfiguration:
-            scheduleEngineRebuild(reason: reason.rawValue)
-        case .defaultOutputDevice:
-            #if os(macOS)
-            defaultOutputChanged()
-            #else
-            break // the watcher only raises this one on macOS
-            #endif
-        }
-    }
-
-    /// Restart the engines if — and only if — playback is down. The conservative trigger: it is
-    /// what a route change (iOS/tvOS) and the macOS backstop get to do, since a HEALTHY engine
-    /// that followed the change on its own must not be interrupted for it.
-    ///
-    /// Gated on a start having been ATTEMPTED rather than on an engine existing, which is the
-    /// difference between recovering a session whose very first `startPlayback` failed — no
-    /// output device at the moment it connected — and leaving it silent for good. On iOS the same
-    /// flag keeps this from racing the asynchronous start, where no engine yet is normal.
-    private func reviveStoppedEngines(_ reason: String) {
-        guard !flag.isStopped, enginesAttempted, !playbackIsLive else { return }
-        scheduleEngineRebuild(reason: "playback is stopped and \(reason)")
-    }
-
-    /// Is the render side actually running? Both engines can carry it (`combinedEngine` when the
-    /// voice processor is engaged, `playbackEngine` otherwise). Taken out from under `stateLock`
-    /// before asking AVAudioEngine anything — the lock guards our handles, not the framework.
-    private var playbackIsLive: Bool {
-        stateLock.lock()
-        let playback = playbackEngine
-        let combined = combinedEngine
-        stateLock.unlock()
-        return (playback?.isRunning ?? false) || (combined?.isRunning ?? false)
-    }
-
-    /// Coalesce: one device switch produces a burst — the old device leaving, the default moving,
-    /// the new device settling, and each engine we own posting its own change — and one rebuild
-    /// serves all of it. The floor between rebuilds keeps a device that renegotiates in a loop
-    /// from spinning the session. Main thread.
-    private func scheduleEngineRebuild(reason: String) {
-        guard !rebuildQueued else { return }
-        rebuildQueued = true
-        let since = ProcessInfo.processInfo.systemUptime - lastRebuildAt
-        let delay = max(Self.rebuildDebounce, Self.rebuildFloor - since)
-        log.info("\(reason) — restarting the audio engines in \(Int(delay * 1000)) ms")
-        DispatchQueue.main.asyncAfter(deadline: .now() + delay) { [weak self] in
-            self?.rebuildEngines(attempt: 0)
-        }
-    }
-
-    /// Put back the topology this session was started with, on whatever hardware is there now.
-    ///
-    /// A full rebuild rather than a `start()` on the stopped engine, because the mic side has to
-    /// follow too: `installMicTap` reads the input's live format, and the voice processor
-    /// renegotiates its own. The RING is deliberately not touched — it is the one thing carried
-    /// across (`makePlaybackChain` reuses it, `startDrain` is idempotent), so the drain thread
-    /// keeps decoding right through the switch and its overflow policy has already dropped
-    /// everything that went stale while the engine was down.
-    private func rebuildEngines(attempt: Int) {
-        rebuildQueued = false
-        guard !flag.isStopped, let config = startConfig else { return }
-        lastRebuildAt = ProcessInfo.processInfo.systemUptime
-        tearDownEngines()
-        startEngines(
-            speakerUID: config.speakerUID, micUID: config.micUID, micChannel: config.micChannel,
-            micEnabled: config.micEnabled, echoCancel: config.echoCancel)
-
-        // Did playback actually come back? A device caught mid-transition can refuse to start, and
-        // a rebuild that fails leaves no engine to post the next notification — so this is the one
-        // path that must not just give up. (`startEngines` has logged the reason already.)
-        if playbackIsLive {
-            log.info("audio engines restarted on the current device")
-            return
-        }
-        guard attempt < Self.rebuildAttempts else {
-            #if os(macOS)
-            log.error("""
-                audio did not come back after the device change — the default-output watcher will \
-                try again when a device appears
-                """)
-            #else
-            log.error("audio did not come back after the route change")
-            #endif
-            return
-        }
-        rebuildQueued = true // holds off a trigger that would only race this ladder
-        let delay = Self.rebuildDebounce * Double(1 << (attempt + 1))
-        DispatchQueue.main.asyncAfter(deadline: .now() + delay) { [weak self] in
-            self?.rebuildEngines(attempt: attempt + 1)
-        }
-    }
-
-    #if os(macOS)
-    /// The system's output device moved. Rebuild only when it actually concerns this session: the
-    /// engine is gone or stopped, or it is playing to a device that is no longer the one we should
-    /// be on. Somebody changing the default while we are pinned to a named speaker is none of our
-    /// business, and rebuilding for it would cost an audible gap for nothing. Main queue (the
-    /// listener block is registered against it).
-    private func defaultOutputChanged() {
-        guard !flag.isStopped, let config = startConfig else { return }
-        stateLock.lock()
-        let engine = combinedEngine ?? playbackEngine
-        stateLock.unlock()
-        guard let engine, engine.isRunning, let unit = engine.outputNode.audioUnit,
-              let playingOn = Self.currentDevice(of: unit)
-        else {
-            // Nothing is playing. If an engine was expected at all, this is the backstop firing.
-            reviveStoppedEngines("the default output device moved")
-            return
-        }
-        // Empty UID = follow the system default; a pinned UID only moves if that device itself
-        // came or went, which `deviceID(forUID:)` reports by resolving to a different ID or none.
-        let shouldBeOn = config.speakerUID.isEmpty
-            ? AudioDevices.defaultOutputDevice()
-            : AudioDevices.deviceID(forUID: config.speakerUID)
-        guard let shouldBeOn, shouldBeOn != playingOn else { return }
-        scheduleEngineRebuild(reason: "the output device changed under the session")
-    }
-    #endif
-
-    #if !os(macOS)
-    /// The audio server can die and restart. It takes the session's configuration and every engine
-    /// with it, and the documented recovery is to build all of it again — the same rebuild a route
-    /// change uses, with the session activation back in front of it.
-    private func installMediaResetObserver(micEnabled: Bool) {
-        let observer = NotificationCenter.default.addObserver(
-            forName: AVAudioSession.mediaServicesWereResetNotification, object: nil, queue: nil
-        ) { [weak self] _ in
-            SessionAudio.sessionQueue.async {
-                guard let self, !self.flag.isStopped else { return }
-                self.activateAudioSession(micEnabled: micEnabled)
-                DispatchQueue.main.async {
-                    self.scheduleEngineRebuild(reason: "the audio services were reset")
-                }
-            }
-        }
-        stateLock.lock()
-        let stale = mediaResetObserver
-        mediaResetObserver = observer
-        stateLock.unlock()
-        if let stale { NotificationCenter.default.removeObserver(stale) }
-    }
-
-    /// Interruptions still happen to a mixable session — a phone call, Siri, an app that claims
-    /// a NON-mixable session of its own. iOS stops the engines, and when the interruption ends it
-    /// restarts NOTHING by itself; before this observer the stream just stayed silent (under the
-    /// old exclusive category, Music itself was such an interrupter, which is how "resume Music,
-    /// lose the stream" was ever possible). Reactivate and revive on `.ended` — unconditionally,
-    /// not only when iOS hints `.shouldResume`: a live stream is the one case where the user's
-    /// intent to keep hearing it is not in doubt, and `reviveStoppedEngines` already declines
-    /// when playback never went down.
-    private func installInterruptionObserver(micEnabled: Bool) {
-        let observer = NotificationCenter.default.addObserver(
-            forName: AVAudioSession.interruptionNotification,
-            object: AVAudioSession.sharedInstance(), queue: nil
-        ) { [weak self] note in
-            guard let raw = note.userInfo?[AVAudioSessionInterruptionTypeKey] as? UInt,
-                  AVAudioSession.InterruptionType(rawValue: raw) == .ended else { return }
-            SessionAudio.sessionQueue.async {
-                guard let self, !self.flag.isStopped else { return }
-                // The full activation, not a bare `setActive`: an interruption can drop the
-                // category configuration too, and on iOS the earpiece steer is per-route.
-                self.activateAudioSession(micEnabled: micEnabled)
-                DispatchQueue.main.async {
-                    self.reviveStoppedEngines("an audio interruption ended")
-                }
-            }
-        }
-        stateLock.lock()
-        let stale = interruptionObserver
-        interruptionObserver = observer
-        stateLock.unlock()
-        if let stale { NotificationCenter.default.removeObserver(stale) }
-    }
-    #endif
-
     /// Silence the mic uplink (no room audio leaves the device) or restore it. THE one muting
     /// mechanism: the owner composes its reasons — the user's in-stream mute and the background
     /// keep-alive's privacy mute — into one effective state and passes that here, so neither can
@@ -746,46 +305,6 @@ public final class SessionAudio {
         }
     }
 
-    // MARK: - Stats
-
-    /// The playback plane's two latency numbers, for the stats overlay.
-    ///
-    /// Both, never just the depth: a deep ring on a jittery link is CORRECT behaviour — the
-    /// adaptive floor put it there because the link kept starving — and only the offset separates
-    /// that from a ring that is simply holding audio late. Before this pair existed the plane
-    /// published nothing any surface could render (depth and target lived in a periodic log line),
-    /// and a field investigation into "the audio delay seems way too high" ran all the way to its
-    /// conclusion without either number.
-    public struct Stats: Sendable {
-        /// Decoded audio queued ahead of the speaker (ms).
-        public let bufferMS: Int
-        /// The A/V sync loop's smoothed offset (ms): positive = audio playing BEHIND the picture.
-        /// `0` before the loop has evidence, with sync unwired, or genuinely aligned.
-        public let avOffsetMS: Int
-    }
-
-    /// A snapshot of `Stats`, or nil before playback starts. Main thread (`ring` is main-confined;
-    /// the ring's own numbers are taken under its lock, so they describe one instant).
-    public var stats: Stats? {
-        guard let s = ring?.stats else { return nil }
-        return Stats(bufferMS: s.bufferedMS, avOffsetMS: s.avOffsetMS)
-    }
-
-    #if os(macOS)
-    /// Whether playback is rendering, and the device it is rendering to. The device-change
-    /// recovery has exactly one observable signature from outside — "running again, on the device
-    /// the system just moved to" — and nothing else here could tell the two halves apart: a
-    /// stopped engine can still name the old device, and a retargeted one can still be stopped.
-    /// Used by `AudioDeviceSwitchTests`.
-    var playbackState: (running: Bool, device: AudioDeviceID?) {
-        stateLock.lock()
-        let engine = combinedEngine ?? playbackEngine
-        stateLock.unlock()
-        guard let engine else { return (false, nil) }
-        return (engine.isRunning, engine.outputNode.audioUnit.flatMap(Self.currentDevice(of:)))
-    }
-    #endif
-
     // MARK: - Playback (host → speaker)
 
     /// The playback jitter ring + the source node draining it — shared by the plain playback
@@ -882,25 +401,9 @@ public final class SessionAudio {
         }
         drainStarted = true
         stateLock.unlock()
-        // A/V sync. This thread is the only place that holds all three ingredients at once: the
-        // packet's host capture `ptsNs`, the ring depth, and the video plane's end-to-end figure.
-        // `ptsNs` was decoded into `AudioPCM` and then dropped on the floor right here for the
-        // plane's entire existence, which is why audio ran at whatever depth its jitter ring
-        // happened to settle at and nothing ever placed it against the picture.
-        //
-        // The escape hatch mirrors the Rust clients': a field regression in a loop that steers
-        // PLAYBACK should be bisectable without a rebuild. macOS honours it from the environment;
-        // elsewhere it simply never trips, which is the same as today's behaviour.
-        let syncEnabled = !["1", "true"].contains(
-            ProcessInfo.processInfo.environment["PUNKTFUNK_NO_AV_SYNC"] ?? "")
-        // nil disarms the loop entirely — no reference, no correction (see `videoLatency`).
-        let videoLatency = syncEnabled ? self.videoLatency : nil
-        if !syncEnabled { log.info("A/V sync disabled by PUNKTFUNK_NO_AV_SYNC") }
-        let channels = Int(connection.resolvedAudioChannels)
         let thread = Thread { [connection, flag, drainDone] in
             defer { drainDone.signal() }
             var drained = 0
-            var av = AvSync(channels: channels)
             // Decode happens IN-CORE (libopus multistream) — AudioToolbox's Opus path is
             // stereo-only — and is handed back as interleaved f32 PCM in wire channel order.
             // Per-iteration autorelease pool: no runloop on this thread (see Stage2Pipeline).
@@ -914,25 +417,6 @@ public final class SessionAudio {
                     return false // session closed
                 }
                 guard let pcm, pcm.frameCount > 0 else { return true }
-                // Place this frame against the picture it belongs with BEFORE queueing it: the
-                // depth read here is everything that must still play first, which is exactly what
-                // delays it. Skipped wholesale when no meter was wired, so an un-armed session
-                // does not even read the ring.
-                if let videoLatency {
-                    let depth = ring.bufferedSamples
-                    var ts = timespec()
-                    clock_gettime(CLOCK_REALTIME, &ts)
-                    let nowNs = Int64(ts.tv_sec) * 1_000_000_000 + Int64(ts.tv_nsec)
-                    // Half a second of tolerance on the reference: long enough to ride out a
-                    // stalled or hitching present path, short enough that a backgrounded session
-                    // (video decode dropped, audio still playing) stops steering almost at once.
-                    av.observe(AvSync.Observation(
-                        ptsNs: pcm.ptsNs, nowLocalNs: nowNs,
-                        clockOffsetNs: connection.clockOffsetNs, bufferedAhead: depth,
-                        videoE2eNs: videoLatency.latestSample(asOfNs: nowNs, maxAgeMs: 500)))
-                    ring.setSyncTarget(av.desiredDepth(currentDepth: depth))
-                    ring.noteAvOffset(av.offsetMS)
-                }
                 pcm.samples.withUnsafeBufferPointer { p in
                     if let base = p.baseAddress {
                         ring.write(base, count: pcm.frameCount * pcm.channels)
@@ -946,7 +430,7 @@ public final class SessionAudio {
                 if drained % 2_000 == 0 {
                     let s = ring.stats
                     log.info(
-                        "audio: buffer_ms=\(s.bufferedMS) target_ms=\(s.targetMS) underruns=\(s.underruns) drift_sheds=\(s.sheds) av_offset_ms=\(s.avOffsetMS)"
+                        "audio: buffer_ms=\(s.bufferedMS) target_ms=\(s.targetMS) underruns=\(s.underruns) drift_sheds=\(s.sheds)"
                     )
                 }
                 return true
@@ -999,52 +483,19 @@ public final class SessionAudio {
         }
         engine.attach(source)
         engine.connect(source, to: engine.mainMixerNode, format: format)
-
-        // The capture side must be PULLED, and only the render graph pulls anything. An input
-        // node carrying nothing but a tap is not part of that graph, so on the combined engine
-        // nobody drove it: the IO unit came up (the recording indicator lit for a beat, then went
-        // out as the input went idle) and NOT ONE BUFFER ever reached the tap — no error, no
-        // failed start, just a session that quietly sent no microphone at all. Routing the input
-        // through a silent sink puts it in the graph, which is what Apple's own voice-processing
-        // sample does. The split path never needed it: a capture-only engine has the input node
-        // AS its graph, so it is pulled by definition — which is why this only broke when the
-        // combined topology became the default.
-        //
-        // `outputVolume = 0` on the sink: the mic has to reach the graph, never the speaker. At
-        // any audible volume this is a microphone wired straight to the earpiece.
-        let micSink = AVAudioMixerNode()
-        engine.attach(micSink)
-        micSink.outputVolume = 0
-        engine.connect(engine.inputNode, to: micSink, format: nil)
-        engine.connect(micSink, to: engine.mainMixerNode, format: nil)
-
-        // BEFORE the tap reads a format. Enabling voice processing swaps the engine's IO unit
-        // for the VPIO one and renegotiates its formats, and until the engine is prepared the
-        // input node can still report the pre-swap state — 0 Hz / 0 channels included, which
-        // `installMicTap` (correctly) refuses as "no usable input device". Preparing first means
-        // the chain is built against what the voice processor will actually emit.
-        engine.prepare()
-        guard installMicTap(on: engine.inputNode, micUID: micUID, micChannel: micChannel) else {
-            // Mic chain unavailable on the VOICE-PROCESSED engine (logged). The mic outranks the
-            // echo cancellation, so fall back to the split path — its own engine, no voice
-            // processor, the topology that shipped before AEC existed — rather than dropping the
-            // uplink for the rest of the session. (The sibling failure above, where the voice
-            // processor won't engage at all, already does exactly this; this arm used to give up
-            // on the mic instead, which is how a whole session could go silent uplink-only.)
-            engine.stop()
+        guard installMicTap(on: input, micUID: micUID, micChannel: micChannel) else {
+            // Mic chain unavailable (logged) — keep the session audible on the plain playback
+            // engine rather than playing through an idle voice processor.
             startPlayback(speakerUID: speakerUID)
-            startCapture(micUID: micUID, micChannel: micChannel)
             return
         }
+        engine.prepare()
         do {
             try engine.start()
         } catch {
             log.error("combined engine failed to start: \(error.localizedDescription)")
-            engine.inputNode.removeTap(onBus: 0)
-            engine.stop()
-            // Same rule: a working mic without echo cancellation beats no mic at all.
-            startPlayback(speakerUID: speakerUID)
-            startCapture(micUID: micUID, micChannel: micChannel)
+            input.removeTap(onBus: 0)
+            startPlayback(speakerUID: speakerUID) // no echo cancellation beats no audio
             return
         }
         stateLock.lock()
@@ -1082,16 +533,8 @@ public final class SessionAudio {
             }
         }
         #endif
-        // Prepared before the tap reads a format, for the same reason the combined path does it:
-        // a node that hasn't been through `prepare()` can still report the pre-negotiation
-        // format (0 Hz / 0 channels on a device that is perfectly fine), which reads downstream
-        // as "no microphone".
+        guard installMicTap(on: input, micUID: micUID, micChannel: micChannel) else { return }
         engine.prepare()
-        guard installMicTap(on: engine.inputNode, micUID: micUID, micChannel: micChannel) else {
-            log.error("mic uplink unavailable — this session sends no microphone audio")
-            engine.stop()
-            return
-        }
         do {
             try engine.start()
         } catch {

clients/apple/Sources/PunktfunkKit/Connection/ArtCache.swift

@@ -1,116 +0,0 @@
-// On-disk cache for library cover art.
-//
-// Posters are the bulk of what the library screen transfers and they essentially never change, so
-// re-fetching them on every visit is pure waste — the Windows client has cached them on disk for
-// this reason and Apple did not. It matters more now that host art rides `MgmtTransport`: a cache
-// hit costs no connection at all.
-//
-// Lives in the CACHES directory on purpose: every byte here is re-derivable from the host, so the
-// system is welcome to evict it under storage pressure. Entries are keyed by the SHA-256 of the
-// absolute URL, which covers both host-proxy paths and store CDN URLs without either colliding.
-//
-// Deliberately free of any Network.framework / PunktfunkCore dependency, so it can be unit-tested
-// against a temporary directory.
-
-import CryptoKit
-import Foundation
-
-/// A size- and age-bounded blob cache. An actor so disk work stays off whichever thread the
-/// SwiftUI poster view happens to be on, and so pruning can never race a write.
-actor ArtCache {
-    private let directory: URL
-    private let maxBytes: Int
-    private let maxAge: TimeInterval
-    private let fileManager = FileManager.default
-
-    /// `directory` is created on demand. Defaults: 128 MB — a 200-title library of 600×900
-    /// capsules lands far under that — and 30 days, which only matters for art a host later
-    /// replaces.
-    init(directory: URL, maxBytes: Int = 128 * 1024 * 1024, maxAge: TimeInterval = 30 * 24 * 3600) {
-        self.directory = directory
-        self.maxBytes = maxBytes
-        self.maxAge = maxAge
-    }
-
-    /// The app's standard location, or nil if the caches directory is unavailable (in which case
-    /// callers simply run without a cache rather than failing).
-    static func standard() -> ArtCache? {
-        guard let caches = FileManager.default.urls(
-            for: .cachesDirectory, in: .userDomainMask).first
-        else { return nil }
-        return ArtCache(directory: caches.appendingPathComponent("PunktfunkArt", isDirectory: true))
-    }
-
-    func data(for url: URL) -> Data? {
-        let file = path(for: url)
-        guard let data = try? Data(contentsOf: file) else { return nil }
-        // Age out stale art rather than serving it forever.
-        if let modified = modificationDate(of: file), Date().timeIntervalSince(modified) > maxAge {
-            try? fileManager.removeItem(at: file)
-            return nil
-        }
-        // Touch, so eviction can order by last USE rather than last write.
-        try? fileManager.setAttributes([.modificationDate: Date()], ofItemAtPath: file.path)
-        return data
-    }
-
-    func store(_ data: Data, for url: URL) {
-        // An empty body is not art, and a `data:` URL is already inline — caching either is a
-        // pure loss.
-        guard !data.isEmpty, url.scheme?.lowercased() != "data" else { return }
-        do {
-            try fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
-            try data.write(to: path(for: url), options: .atomic)
-        } catch {
-            return // a cache that can't write is a slow cache, not a broken app
-        }
-        prune()
-    }
-
-    /// Drop the oldest entries until the directory fits the budget. Also removes anything past
-    /// `maxAge` so a cache that is under budget still doesn't hoard stale art forever.
-    func prune() {
-        let keys: [URLResourceKey] = [.contentModificationDateKey, .fileSizeKey]
-        guard let entries = try? fileManager.contentsOfDirectory(
-            at: directory, includingPropertiesForKeys: keys, options: .skipsHiddenFiles)
-        else { return }
-
-        var files: [(url: URL, date: Date, size: Int)] = []
-        var total = 0
-        let now = Date()
-        for entry in entries {
-            let values = try? entry.resourceValues(forKeys: Set(keys))
-            let date = values?.contentModificationDate ?? .distantPast
-            let size = values?.fileSize ?? 0
-            if now.timeIntervalSince(date) > maxAge {
-                try? fileManager.removeItem(at: entry)
-                continue
-            }
-            files.append((entry, date, size))
-            total += size
-        }
-        guard total > maxBytes else { return }
-
-        // Oldest first — `data(for:)` touches on read, so this is least-recently-USED.
-        for file in files.sorted(by: { $0.date < $1.date }) {
-            guard total > maxBytes else { break }
-            try? fileManager.removeItem(at: file.url)
-            total -= file.size
-        }
-    }
-
-    /// Wipe the cache — for a "clear cached data" affordance, and for tests.
-    func clear() {
-        try? fileManager.removeItem(at: directory)
-    }
-
-    private func path(for url: URL) -> URL {
-        let digest = SHA256.hash(data: Data(url.absoluteString.utf8))
-        let name = digest.map { String(format: "%02x", $0) }.joined()
-        return directory.appendingPathComponent(name, isDirectory: false)
-    }
-
-    private func modificationDate(of file: URL) -> Date? {
-        (try? file.resourceValues(forKeys: [.contentModificationDateKey]))?.contentModificationDate
-    }
-}

clients/apple/Sources/PunktfunkKit/Connection/ClientTLS.swift

@@ -18,6 +18,9 @@
 import CryptoKit
 import Foundation
 import Security
+import os
+
+private let tlsLog = Logger(subsystem: "io.unom.punktfunk", category: "library-tls")
 
 enum ClientTLS {
     enum TLSError: LocalizedError {
@@ -131,8 +134,62 @@ enum ClientTLS {
     }
 }
 
-// The URLSession pinning delegate that used to live here is gone: the management API now speaks
-// over `MgmtTransport` (Network.framework), which states the same trust rule in a
-// `sec_protocol_options_set_verify_block` and — unlike the URL loading system — is not subject to
-// App Transport Security. That is what lets ATS stay ON for the cover-art CDN fetches, which are
-// the only URLSession traffic left in the app. See MgmtTransport.swift for the full rationale.
+/// URLSession delegate that pins the host's self-signed cert (by the fingerprint the client
+/// already trusts) and presents the client identity for the mTLS client-cert challenge — but ONLY
+/// for challenges from `host`:`port` (the punktfunk host itself). A session built with this
+/// delegate is safe to reuse for OTHER origins too (e.g. a GOG/Heroic/Xbox cover-art CDN): a
+/// non-matching origin falls through to `.performDefaultHandling`, i.e. normal system trust
+/// evaluation and no client cert — exactly what `URLSession.shared` would have done. Without the
+/// host scoping, pinning would reject every external origin's cert (its fingerprint never matches
+/// the host's) and the client identity would leak to servers that didn't ask for it.
+final class LibraryTLSDelegate: NSObject, URLSessionDelegate {
+    private let identity: SecIdentity
+    private let pinnedHostFingerprint: Data? // SHA-256 of the host cert DER; nil = accept any (TOFU)
+    private let host: String
+    private let port: Int
+
+    init(identity: SecIdentity, pinnedHostFingerprint: Data?, host: String, port: UInt16) {
+        self.identity = identity
+        self.pinnedHostFingerprint = pinnedHostFingerprint
+        self.host = host
+        self.port = Int(port)
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        didReceive challenge: URLAuthenticationChallenge,
+        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+    ) {
+        let space = challenge.protectionSpace
+        guard space.host == host, space.port == port else {
+            completionHandler(.performDefaultHandling, nil)
+            return
+        }
+        switch space.authenticationMethod {
+        case NSURLAuthenticationMethodServerTrust:
+            // Pin the host cert by fingerprint — the host is self-signed (the client trusts it the
+            // same way the QUIC session does). No pin yet (TOFU) → accept the presented leaf.
+            guard let trust = space.serverTrust,
+                  let leaf = (SecTrustCopyCertificateChain(trust) as? [SecCertificate])?.first
+            else {
+                completionHandler(.cancelAuthenticationChallenge, nil)
+                return
+            }
+            let der = SecCertificateCopyData(leaf) as Data
+            let fp = Data(SHA256.hash(data: der))
+            if let pinned = pinnedHostFingerprint, pinned != fp {
+                tlsLog.warning("library: host cert fingerprint mismatch — refusing")
+                completionHandler(.cancelAuthenticationChallenge, nil)
+                return
+            }
+            completionHandler(.useCredential, URLCredential(trust: trust))
+
+        case NSURLAuthenticationMethodClientCertificate:
+            completionHandler(.useCredential,
+                URLCredential(identity: identity, certificates: nil, persistence: .forSession))
+
+        default:
+            completionHandler(.performDefaultHandling, nil)
+        }
+    }
+}