feat(tools/display-disturb): adl-emul — AMD connector-emulation probe (software HPD dummy)

The standby-sink stall program's §3 dead-end list marked ADL EmulationMode
'likely Pro-gated' on field hearsay, with 'probe once, log rc' as the owed
falsification — never run. Three RX 9070 XT field cases later (ASUS
VG32VQ1B/DP, Odyssey G60SD/DP, LG UltraGear 32GS95UE/HDMI), this is that
probe, shippable to reporters: read-only caps/board-layout/connection-state
walk by default, --lock pins the live EDID + ADL_EMUL_MODE_ALWAYS on
occupied connectors (the software HPD-holding dummy), --unlock restores.
Every call prints the bench's epoch_ms correlation line with the decoded
ADL rc — ADL_ERR_NOT_SUPPORTED(-8) vs ADL_OK on consumer Adrenalin is the
Pro-gating answer, and a --lock run during a stream with the sink asleep
is the direct A/B for the metronomic stall class.

atiadlxx.dll is bound dynamically (absent = clean exit 2), structs mirror
adl_structures.h verbatim, and the probe touches only connectors the
board-layout walk enumerated. Gates: check/clippy -D warnings (msvc
cross-target) + fmt clean; native stub unaffected.

Cargo.lock

@@ -2893,7 +2893,6 @@ dependencies = [
  "ureq",
  "wasapi",
  "windows 0.62.2 (git+https://github.com/microsoft/windows-rs?rev=acb5a1a7441033d9312b16842af02eb0c2b403dc)",
- "winreg",
 ]
 
 [[package]]
@@ -3347,8 +3346,6 @@ dependencies = [
  "opus",
  "punktfunk-core",
  "tracing",
- "uac-host",
- "usbfs-iso",
 ]
 
 [[package]]
@@ -4988,14 +4985,6 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
-[[package]]
-name = "uac-host"
-version = "0.1.0"
-source = "git+https://github.com/unom-io/usbfs-iso?rev=f3de1fd62cec271d07f45664dc464f23e423e721#f3de1fd62cec271d07f45664dc464f23e423e721"
-dependencies = [
- "usbfs-iso",
-]
-
 [[package]]
 name = "uds_windows"
 version = "1.2.1"
@@ -5075,14 +5064,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "usbfs-iso"
-version = "0.1.0"
-source = "git+https://github.com/unom-io/usbfs-iso?rev=f3de1fd62cec271d07f45664dc464f23e423e721#f3de1fd62cec271d07f45664dc464f23e423e721"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "usbip-sim"
 version = "0.8.0"

clients/android/app/src/main/kotlin/io/unom/punktfunk/ControllersScreen.kt

@@ -410,68 +410,17 @@ private fun DsRow(usbDev: android.hardware.usb.UsbDevice) {
                         Text("Grant USB access")
                     }
                 }
-                else -> {
-                    Text(
-                        if (model == DsDevice.Model.DUALSHOCK4) {
-                            "Ready — captured at stream start: rumble, lightbar and gyro are " +
-                                "driven directly."
-                        } else {
-                            "Ready — captured at stream start: rumble, adaptive triggers, lightbar " +
-                                "and gyro are driven directly."
-                        },
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                    // Pad-audio self test. Deliberately reachable WITHOUT a stream: it exists to
-                    // answer "can this phone drive this pad's audio endpoint at all", and gating
-                    // that behind a live session would make it depend on the very thing one wants
-                    // to rule out when a session misbehaves. DualSense only — the DS4 has no
-                    // 4-channel haptics device.
-                    if (model != DsDevice.Model.DUALSHOCK4) {
-                        var testing by remember { mutableStateOf(false) }
-                        var result by remember { mutableStateOf<String?>(null) }
-                        result?.let {
-                            Text(
-                                it,
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                        OutlinedButton(
-                            enabled = !testing,
-                            onClick = {
-                                testing = true
-                                result = null
-                                Thread({
-                                    // Its OWN connection: the renderer's descriptor must never be
-                                    // shared with another transfer engine, and that applies to
-                                    // this test as much as to the real path.
-                                    val conn = runCatching { usbManager.openDevice(usbDev) }.getOrNull()
-                                    val fd = conn?.fileDescriptor ?: -1
-                                    val r = if (fd >= 0) {
-                                        io.unom.punktfunk.kit.NativeBridge.nativePadAudioSelfTest(fd, 3, 60)
-                                    } else {
-                                        -1
-                                    }
-                                    conn?.close()
-                                    val msg = when {
-                                        r > 0 -> "Haptics test passed — $r frames to the pad."
-                                        r == -1 -> "Could not open the pad's audio interface. " +
-                                            "Some kernels refuse it; the pad still works normally."
-                                        r == -2 -> "The audio stream stopped part-way."
-                                        else -> "The stream opened but no audio reached the pad."
-                                    }
-                                    android.os.Handler(android.os.Looper.getMainLooper()).post {
-                                        result = msg
-                                        testing = false
-                                    }
-                                }, "pf-pad-selftest-ui").start()
-                            },
-                        ) {
-                            Text(if (testing) "Testing…" else "Test haptics")
-                        }
-                    }
-                }
+                else -> Text(
+                    if (model == DsDevice.Model.DUALSHOCK4) {
+                        "Ready — captured at stream start: rumble, lightbar and gyro are " +
+                            "driven directly."
+                    } else {
+                        "Ready — captured at stream start: rumble, adaptive triggers, lightbar " +
+                            "and gyro are driven directly."
+                    },
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
             }
         }
     }

clients/android/app/src/main/kotlin/io/unom/punktfunk/HostConnect.kt

@@ -84,9 +84,6 @@ suspend fun connectToHost(
             // The host's approval-list / trust-store label for this device — the same
             // Build.MODEL convention the pairing dialogs use for nativePair.
             Build.MODEL ?: "Android",
-            // Tier-A pad audio: ask for the 0xD1 plane only when a setting would render it, so a
-            // user with it off does not make the host provision endpoints it will never feed.
-            settings.padHaptics || settings.padSpeaker,
         )
     }
 }

clients/android/app/src/main/kotlin/io/unom/punktfunk/Settings.kt

@@ -170,26 +170,6 @@ data class Settings(
      */
     val dsCapture: Boolean = true,
 
-    /**
-     * Render the host's DualSense **voice-coil haptics** on a captured USB pad (tier A).
-     *
-     * The pad's own 4-channel audio device carries them, driven directly over usbfs — Android's
-     * audio framework denylists that device by VID/PID, so there is no supported route to it. The
-     * two kinds are arbitrated rather than mixed, and on evidence: wire rumble is suppressed only
-     * while haptics frames are actually arriving, so a title that drives classic rumble and sends
-     * no haptics audio keeps rumbling. Off, or on an uncaptured/Bluetooth pad, the pad stays on
-     * ordinary rumble (tier C), which on this client already drives the same actuators.
-     */
-    val padHaptics: Boolean = true,
-
-    /**
-     * Render the pad's **built-in speaker** on a captured USB pad. Independent of [padHaptics] —
-     * the host sends the two as separate streams and either can play alone. Off by default: the
-     * speaker is a small, easily-startling loudspeaker in the user's hands, and unlike haptics it
-     * duplicates audio they are already hearing.
-     */
-    val padSpeaker: Boolean = false,
-
     /**
      * How a physical mouse drives the host — the cross-client mouse model (see [MouseMode]).
      * [MouseMode.DESKTOP] (default here) points absolutely; [MouseMode.CAPTURE] locks the pointer
@@ -291,8 +271,6 @@ class SettingsStore(context: Context) {
         rumbleOnPhone = prefs.getBoolean(K_RUMBLE_ON_PHONE, false),
         sc2Capture = prefs.getBoolean(K_SC2_CAPTURE, true),
         dsCapture = prefs.getBoolean(K_DS_CAPTURE, true),
-        padHaptics = prefs.getBoolean(K_PAD_HAPTICS, true),
-        padSpeaker = prefs.getBoolean(K_PAD_SPEAKER, false),
         mouseMode = prefs.getString(K_MOUSE_MODE, null)
             ?.let { name -> MouseMode.entries.firstOrNull { it.storedName == name } }
             // Migration: the pre-enum Boolean "pointer_capture" (true = lock the pointer). Its
@@ -330,8 +308,6 @@ class SettingsStore(context: Context) {
             .putBoolean(K_RUMBLE_ON_PHONE, s.rumbleOnPhone)
             .putBoolean(K_SC2_CAPTURE, s.sc2Capture)
             .putBoolean(K_DS_CAPTURE, s.dsCapture)
-            .putBoolean(K_PAD_HAPTICS, s.padHaptics)
-            .putBoolean(K_PAD_SPEAKER, s.padSpeaker)
             .putString(K_MOUSE_MODE, s.mouseMode.storedName)
             .putBoolean(K_INVERT_SCROLL, s.invertScroll)
             .apply()
@@ -379,8 +355,6 @@ class SettingsStore(context: Context) {
         const val K_RUMBLE_ON_PHONE = "rumble_on_phone"
         const val K_SC2_CAPTURE = "sc2_capture"
         const val K_DS_CAPTURE = "ds_capture"
-        const val K_PAD_HAPTICS = "pad_haptics"
-        const val K_PAD_SPEAKER = "pad_speaker"
         const val K_MOUSE_MODE = "mouse_mode"
 
         /** Legacy Boolean the [K_MOUSE_MODE] enum replaced — read once for migration, never written. */

clients/android/app/src/main/kotlin/io/unom/punktfunk/SettingsScreen.kt

@@ -896,22 +896,6 @@ private fun ControllerSettings(s: Settings, update: (Settings) -> Unit, onOpenCo
                 enabled = s.gamepadForwarding,
                 onCheckedChange = { on -> update(s.copy(dsCapture = on)) },
             )
-            // Both only ever apply to a captured pad, so they follow that row and gate on it.
-            ToggleRow(
-                title = "Controller haptics",
-                subtitle = "Play the host's fine-grained DualSense haptics on the pad itself — " +
-                    "the pad keeps ordinary rumble for games that don't send them",
-                checked = s.padHaptics,
-                enabled = s.gamepadForwarding && s.dsCapture,
-                onCheckedChange = { on -> update(s.copy(padHaptics = on)) },
-            )
-            ToggleRow(
-                title = "Controller speaker",
-                subtitle = "Play audio the game sends to the controller's own speaker",
-                checked = s.padSpeaker,
-                enabled = s.gamepadForwarding && s.dsCapture,
-                onCheckedChange = { on -> update(s.copy(padSpeaker = on)) },
-            )
         }
     }
 }

clients/android/app/src/main/kotlin/io/unom/punktfunk/StreamScreen.kt

@@ -507,28 +507,6 @@ fun StreamScreen(session: ActiveSession, onDisconnect: () -> Unit) {
         var dsUsbReceiver: BroadcastReceiver? = null
         if (ds != null) {
             feedback.sink = ds
-            // Tier-A pad audio: render the host's 0xD1 streams on the pad's own 4-channel USB
-            // audio device. Bound here rather than inside DsCapture because the session handle
-            // lives at this layer; DsCapture decides WHEN (it knows the wire index and the link
-            // lifetime), this decides WHETHER.
-            if (initialSettings.padHaptics || initialSettings.padSpeaker) {
-                ds.padAudio = object : DsCapture.PadAudioHook {
-                    override fun start(pad: Int, fd: Int) {
-                        val ok = NativeBridge.nativeStartPadAudio(
-                            handle,
-                            pad,
-                            fd,
-                            initialSettings.padHaptics,
-                            initialSettings.padSpeaker,
-                        )
-                        Log.i("punktfunk", "pad audio on pad $pad: ${if (ok) "started" else "unavailable"}")
-                    }
-
-                    // Returns only once the render thread is joined — DsCapture calls this before
-                    // closing the connection whose descriptor that thread borrows.
-                    override fun stop(pad: Int) = NativeBridge.nativeStopPadAudio(handle, pad)
-                }
-            }
             val usbManager = context.getSystemService(Context.USB_SERVICE) as UsbManager
             val usbDev = ds.findUsbDevice()
             when {

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/DsCapture.kt

@@ -23,9 +23,8 @@ import android.view.InputDevice
  * Input: parse ([DsDevice.parseState]) → typed mirror on an [GamepadRouter.ExternalPad] (buttons
  * diffed, axes on-change — the exit chord participates like any pad) + the rich plane (touch
  * normalized to the wire's 0..65535 screen space on-change; motion forwarded per report in raw
- * device units, the wire's contract). The wire slot is claimed when the capture engages, with the
- * first parsed report as the fallback for a claim that found no free index, and freed on
- * unplug/[stop], so indices never leak.
+ * device units, the wire's contract). The wire slot is claimed lazily on the FIRST parsed report
+ * and freed on unplug/[stop], so indices never leak.
  *
  * Feedback: implements [GamepadFeedback.PadFeedbackSink] — rumble / trigger / lightbar / player
  * LED events addressed to this pad's wire index become USB output reports on the physical pad
@@ -79,33 +78,6 @@ class DsCapture(
     @Volatile
     var onActiveChanged: ((active: Boolean) -> Unit)? = null
 
-    /**
-     * Tier-A pad audio, bound by the app layer (which owns the session handle).
-     *
-     * [start] is called once the router has assigned this pad a wire index, which the host uses to
-     * address the `0xD1` stream. [stop] is called **before** the USB link closes — on [stop] and on
-     * unplug alike — and must not return until nothing is still writing to the descriptor.
-     */
-    interface PadAudioHook {
-        fun start(pad: Int, fd: Int)
-        fun stop(pad: Int)
-    }
-
-    @Volatile
-    var padAudio: PadAudioHook? = null
-
-    /** True once [PadAudioHook.start] has run for the current capture, so it fires exactly once. */
-    @Volatile private var padAudioStarted = false
-
-    /**
-     * The renderer's OWN connection to the pad.
-     *
-     * It must not share [usb]'s descriptor: two transfer engines on one usbfs descriptor reap each
-     * other's completions (see [HidUsbLink.openAuxConnection]), which strands both the HID reader
-     * and the audio ring. Closed only after the hook's stop has returned.
-     */
-    @Volatile private var padAudioConn: android.hardware.usb.UsbDeviceConnection? = null
-
     val isActive: Boolean get() = model != null
 
     /** First attached Sony USB pad, for the permission flow. Needs no permission to enumerate. */
@@ -133,17 +105,12 @@ class DsCapture(
         // (the same init hid-playstation/SDL send on open).
         if (m != DsDevice.Model.DUALSHOCK4) usb.writeRaw(0, DsDevice.ds5InitReport(m))
         Log.i(TAG, "Sony pad captured over USB: PID=0x%04x model=%s".format(dev.productId, m))
-        ensureSlot(m)
         onActiveChanged?.invoke(true)
         return true
     }
 
     /** Stop the link and free the wire slot (host tears the virtual pad down). Idempotent. */
     fun stop() {
-        // Before anything touches the link: the pad-audio renderer borrows this connection's
-        // descriptor, and `usb.stop()` closes it. The hook does not return until its thread is
-        // joined, so ordering this first is what makes the borrow sound.
-        stopPadAudio()
         val m = model
         if (m != null) {
             // The interfaces are about to release with the kernel driver still detached — a
@@ -169,112 +136,16 @@ class DsCapture(
     private fun onReport(report: ByteArray, len: Int) {
         val m = model ?: return
         if (!DsDevice.parseState(m, report, len, state)) return
-        // Normally claimed already, at capture time; this is the retry for a capture that engaged
-        // while every wire index was taken.
-        val p = pad ?: ensureSlot(m) ?: return // all 16 taken — drop until one frees
+        val p = pad ?: router.openExternal(m.pref)?.also {
+            pad = it
+            Log.i(TAG, "captured $m → wire pad ${it.index}")
+        } ?: return // all 16 wire indices taken — drop until one frees
         mirrorTyped(p)
         mirrorRich(p, m)
     }
 
-    /**
-     * Claim this capture's wire slot and start pad audio on it. Idempotent; null when all 16
-     * indices are taken.
-     *
-     * Claimed when the capture engages rather than on the first report, because a pad that reports
-     * nothing is still a pad: with the lazy claim, a captured-but-silent pad left the host with no
-     * arrival, hence no virtual pad, no pad-audio capability and so no `0xD1` — a renderer sitting
-     * at zero frames, indistinguishable from a broken pipeline (it took a physical replug to
-     * clear). Callable from the main thread (capture start) and the link thread (the fallback).
-     */
-    @Synchronized
-    private fun ensureSlot(m: DsDevice.Model): GamepadRouter.ExternalPad? {
-        pad?.let { return it }
-        val p = router.openExternal(m.pref) ?: return null
-        pad = p
-        Log.i(TAG, "captured $m → wire pad ${p.index}")
-        // The wire index exists from here on, and the host addresses pad audio by it.
-        startPadAudio(p.index)
-        return p
-    }
-
-    /** Hand the renderer its own descriptor. Caller holds the monitor; fires once per capture. */
-    private fun startPadAudio(index: Int) {
-        val hook = padAudio ?: return
-        if (padAudioStarted) return
-        // A dedicated connection, NOT usb.fileDescriptor — see padAudioConn.
-        val conn = usb.openAuxConnection()
-        val fd = conn?.fileDescriptor ?: -1
-        if (fd < 0) {
-            conn?.close()
-            Log.w(TAG, "pad audio: could not open a second USB connection")
-            return
-        }
-        padAudioConn = conn
-        padAudioStarted = true
-        // Real-world self test, opt-in: `adb shell setprop debug.punktfunk.pad_audio_selftest 3`
-        // drives the voice coils for N seconds through the actual client path before the renderer
-        // takes over — the one check that proves the descriptor, the interface claim and the write
-        // path all work on THIS device, without needing a host to be streaming. Same convention as
-        // debug.punktfunk.force_parts.
-        val secs = runCatching {
-            Class.forName("android.os.SystemProperties")
-                .getMethod("get", String::class.java, String::class.java)
-                .invoke(null, "debug.punktfunk.pad_audio_selftest", "0") as String
-        }.getOrNull()?.toIntOrNull() ?: 0
-        if (secs > 0) {
-            // Diagnostic mode: the self test OWNS this descriptor for the capture, and the renderer
-            // must not also drive it — two engines on one usbfs descriptor reap each other's
-            // completions, which is precisely the fault this test exists to expose.
-            Thread({
-                val r = NativeBridge.nativePadAudioSelfTest(fd, secs, 60)
-                Log.i(TAG, "pad audio self-test → ${if (r > 0) "PASS ($r frames)" else "FAIL ($r)"}")
-            }, "pf-pad-selftest").start()
-        } else {
-            // B6: hand the coils back before the first haptics frame. Any rumble earlier in this
-            // session asserted HAPTICS_SELECT, which firmware-mutes them, and nothing else ever
-            // clears it — so without this the stream renders into a muted actuator and looks for
-            // all the world like the host is sending nothing.
-            restoreAudioHaptics()
-            hook.start(index, fd)
-        }
-    }
-
-    /**
-     * B6: clear the rumble/haptics-select bits so the pad's voice coils answer the audio-haptics
-     * path again. EP0-direct, like the other out-of-band writes here: this has to land even when
-     * the interrupt-OUT queue is busy or draining, and it is idempotent.
-     */
-    private fun restoreAudioHaptics() {
-        val m = model ?: return
-        if (m == DsDevice.Model.DUALSHOCK4) return // no voice coils, no audio-haptics path
-        if (!usb.writeControl(DsDevice.ds5AudioHapticsReport(m))) {
-            Log.w(TAG, "pad audio: could not hand the coils back to audio haptics")
-        }
-    }
-
-    /**
-     * Stop the renderer, then close the connection whose descriptor it borrows — in that order.
-     *
-     * Runs on [stop] and on unplug alike. Skipping it on unplug left the render thread writing to a
-     * descriptor whose device was gone, leaked the connection, and — because the started flag stayed
-     * set and the native tier-A registry stayed armed for that index — cost the pad both its pad
-     * audio and its wire rumble on the way back in.
-     */
-    @Synchronized
-    private fun stopPadAudio() {
-        if (!padAudioStarted) return
-        padAudioStarted = false
-        // The hook's stop joins the render thread, so nothing is using the descriptor once it
-        // returns — only then is it safe to close the connection that owns it.
-        pad?.let { padAudio?.stop(it.index) }
-        padAudioConn?.close()
-        padAudioConn = null
-    }
-
     private fun onLinkClosed() {
         Log.i(TAG, "Sony USB link closed (unplug)")
-        // Before releaseSlot(), which forgets the wire index the renderer is addressed by.
-        stopPadAudio()
         disarmBackstop()
         val wasActive = model != null
         model = null
@@ -367,10 +238,6 @@ class DsCapture(
             // write — as this used to — meant a discarded stop left the motors running with
             // nothing scheduled to try again; a USB pad holds its last level until told zero.
             if (sent) disarmBackstop() else armBackstop(STOP_RETRY_MS)
-            // B6: the stop report just re-asserted HAPTICS_SELECT on its way past, so if a
-            // haptics stream is live the coils it drives were muted by the very write that
-            // silenced the motors. Give them back.
-            if (sent && padAudioStarted) restoreAudioHaptics()
         }
     }
 

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/DsDevice.kt

@@ -276,21 +276,6 @@ object DsDevice {
      * the classic compat-vibration path AND `VIBRATION2` (firmware ≥ 2.24's full-range replot;
      * older firmware ignores the unknown flag2 bit) — the host parser accepts either.
      */
-    /**
-     * B6: hand the voice coils back to the audio-haptics path.
-     *
-     * Every [ds5RumbleReport] asserts `HAPTICS_SELECT` (flag0 bit1), which is SDL's
-     * "disable audio haptics" bit — the firmware mutes the coils the 0xD1 haptics stream drives.
-     * Until now NOTHING ever cleared it again, so a single rumble anywhere in a session left tier-A
-     * haptics silent for the rest of that pad's life, with no error and nothing in a log.
-     *
-     * The undo is a report whose flag0 has BOTH bits clear (SDL's own comment: "Leaving emulated
-     * rumble bits off will restore audio haptics"). No other valid flag is set, so nothing else
-     * about the pad's state is touched. Mirrors `Ds5Feedback::audio_haptics_packet` on the desktop
-     * client, which is the same packet one transport over.
-     */
-    fun ds5AudioHapticsReport(model: Model): ByteArray = newDs5(model)
-
     fun ds5RumbleReport(model: Model, low: Int, high: Int): ByteArray = newDs5(model).also {
         it[1] = (DS5_FLAG0_COMPAT_VIBRATION or DS5_FLAG0_HAPTICS_SELECT).toByte()
         it[39] = DS5_FLAG2_VIBRATION2.toByte()

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/HidUsbLink.kt

@@ -98,40 +98,6 @@ class HidUsbLink(
     /** First attached matching device, or null. Does not need USB permission to enumerate. */
     fun findDevice(): UsbDevice? = usb.deviceList.values.firstOrNull(config.deviceMatch)
 
-    /**
-     * Open a SECOND connection to the same device, for a consumer that needs its own descriptor.
-     *
-     * **Not a convenience — a correctness requirement.** `UsbDeviceConnection.requestWait()`
-     * returns *any* completed request on that connection, and the same is true of the usbfs reap
-     * ioctl underneath it: two independent transfer engines sharing one descriptor steal each
-     * other's completions. This link's reader owns its connection exclusively (see the note on
-     * [outQueue]), so anything else driving transfers on this device — the isochronous audio
-     * renderer — must open its own.
-     *
-     * usbfs allows the same device to be opened many times, and claims are per (descriptor,
-     * interface), so a claim made on this connection does not conflict with one made on that.
-     *
-     * The caller owns the returned connection and must close it.
-     */
-    fun openAuxConnection(): UsbDeviceConnection? {
-        val dev = device ?: return null
-        return usb.openDevice(dev)
-    }
-
-    /**
-     * The open connection's usbfs file descriptor, or -1 when the link is not running.
-     *
-     * Handed to native code that drives interfaces this link deliberately does NOT claim — the
-     * pad's isochronous audio endpoint (see `pad_audio` on the native side), which Android's own
-     * USB API cannot reach because `UsbRequest` rejects anything that is not bulk or interrupt.
-     * usbfs claims are per interface, so a native claim of the audio interface leaves this link's
-     * HID claim untouched.
-     *
-     * **The borrower must stop using it before [stop] runs**: closing the connection while a
-     * transfer is in flight pulls the descriptor out from under the kernel.
-     */
-    val fileDescriptor: Int get() = connection?.fileDescriptor ?: -1
-
     /**
      * Claim [dev]'s controller interface(s) and start the read loop. The caller has already
      * obtained USB permission. Returns false when nothing could be claimed.

clients/android/kit/src/main/kotlin/io/unom/punktfunk/kit/NativeBridge.kt

@@ -69,10 +69,6 @@ object NativeBridge {
          *  list and trust store show for it, same convention as [nativePair]'s `name`. `null`/blank ⇒
          *  the host falls back to a fingerprint-derived "device abcd1234" label. */
         deviceName: String?,
-        /** Advertise `CLIENT_CAP_PAD_AUDIO` — the SESSION-level negotiation for the 0xD1 per-pad
-         *  DualSense plane. Without it the host never sets `HOST_CAP_PAD_AUDIO` and emits nothing,
-         *  so a captured pad's own render capabilities would have nothing to gate. */
-        padAudioOk: Boolean,
     ): Long
 
     /** 64-hex SHA-256 of the cert the host presented on [handle]; valid after a successful connect. */
@@ -336,46 +332,6 @@ object NativeBridge {
      */
     external fun nativeSetMicMuted(handle: Long, muted: Boolean)
 
-    /**
-     * Start tier-A DualSense pad audio: render the host's `0xD1` streams on the pad's own
-     * 4-channel USB audio device.
-     *
-     * [fd] is an open [android.hardware.usb.UsbDeviceConnection]'s file descriptor. Native code
-     * **borrows** it — it claims the pad's audio interface through usbfs (which leaves any HID
-     * claim on the same device alone) and never closes the descriptor. The caller must keep the
-     * connection open until [nativeStopPadAudio] returns.
-     *
-     * This also declares the pad's render capability to the host; without it no `0xD1` is sent.
-     *
-     * Returns false when there is nothing to render. A kernel that refuses the interface claim is
-     * NOT reported here — the renderer discovers that on its own thread and the session simply
-     * carries on without tier A, because some OEM kernels refuse and no app-side fix exists.
-     */
-    external fun nativeStartPadAudio(
-        handle: Long,
-        pad: Int,
-        fd: Int,
-        haptics: Boolean,
-        speaker: Boolean,
-    ): Boolean
-
-    /**
-     * Stop tier-A pad audio and join its render thread, and hand the pad back to wire rumble.
-     *
-     * Returns only once the thread is joined — so the `UsbDeviceConnection` may be closed as soon
-     * as this returns, and not before.
-     */
-    external fun nativeStopPadAudio(handle: Long, pad: Int)
-
-    /**
-     * Drive the pad with a test tone through the real render path — no host, no session.
-     *
-     * [fd] must come from a connection **nothing else is driving transfers on**: two engines on
-     * one usbfs descriptor reap each other's completions. Blocks for roughly [seconds]; run it off
-     * the main thread. Returns sample frames written, or negative on failure.
-     */
-    external fun nativePadAudioSelfTest(fd: Int, seconds: Int, hz: Int): Int
-
     /**
      * Is a mic capture actually RUNNING — i.e. did [nativeStartMic] open a stream, and has
      * [nativeStopMic] not been called since? Offer the in-stream mute control on THIS rather than

clients/android/native/Cargo.toml

@@ -64,14 +64,6 @@ libc = "0.2"
 # host + Linux client use. audiopus_sys vendors libopus (pure C) and builds it static via cmake —
 # the cargo-ndk build sets LIBOPUS_STATIC=1/LIBOPUS_NO_PKG=1 so it links the bundled lib, not the host's.
 opus = "0.3"
-# Tier-A pad audio (WP9). Android's audio framework denylists the DualSense's output by VID/PID,
-# so the pad's isochronous endpoint is driven directly on the fd `UsbDeviceConnection` hands over.
-# Our own crates, developed openly because the hole they fill — isochronous USB in Rust — is an
-# ecosystem-wide one: https://github.com/unom-io/usbfs-iso
-# Pinned by revision rather than floating: this is a transport under a real-time deadline and it
-# should move when we choose to. Becomes a plain version dependency once the crates are published.
-uac-host = { git = "https://github.com/unom-io/usbfs-iso", rev = "f3de1fd62cec271d07f45664dc464f23e423e721" }
-usbfs-iso = { git = "https://github.com/unom-io/usbfs-iso", rev = "f3de1fd62cec271d07f45664dc464f23e423e721" }
 
 [lints]
 workspace = true

clients/android/native/src/feedback.rs

@@ -77,14 +77,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeNextRumble(
         // handle.
         let h = unsafe { &*(handle as *const SessionHandle) };
         match h.client.next_rumble_command(PULL_TIMEOUT) {
-            // A pad whose coils are ACTIVELY being driven by the 0xD1 haptics stream must not see
-            // wire rumble: `DsDevice` sets `valid_flag0` bit 1 (`HAPTICS_SELECT`) on every rumble
-            // write, and that bit disables the audio-haptics path — so one replayed command would
-            // mute the coils the stream is driving. Gating on *arrival of haptics frames* rather
-            // than on "a stream is open" is what keeps a rumble-only title working: it renders no
-            // haptics audio, so the host emits nothing on 0xD1 and the pad keeps its rumble.
-            // Dropping it here rather than in Kotlin keeps the rule next to the reason.
-            Ok(cmd) if crate::pad_audio::haptics_owns_coils((cmd.pad & 0xF) as u8) => -1,
             Ok(cmd) => pack_rumble(cmd.pad, cmd.low, cmd.high, cmd.backstop_ms),
             Err(_) => -1, // NoFrame (timeout) or Closed — Kotlin loops on its running flag
         }
@@ -182,11 +174,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeNextHidout(
                 out[3..n].copy_from_slice(&data);
                 n
             }
-            HidOutput::AudioCtl { .. } => {
-                // DS5 pad-audio routing/volumes — no Android replay path yet (the 0xD1 sample
-                // plane isn't rendered here either); drop it like TrackpadHaptic.
-                return -1;
-            }
         };
         n as jint
     })

clients/android/native/src/lib.rs

@@ -37,8 +37,6 @@ mod discovery;
 mod feedback;
 #[cfg(target_os = "android")]
 mod mic;
-/// Tier-A DualSense pad audio: the 0xD1 plane rendered on the pad's own USB endpoint.
-mod pad_audio;
 mod session;
 mod stats;
 // Ungated like `discovery`: pure `jni` + `punktfunk_core::wol` (no Android framework), so it links

clients/android/native/src/session/connect.rs

@@ -145,7 +145,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeConnect<'lo
     timeout_ms: jint,
     launch: JString<'local>,
     device_name: JString<'local>,
-    pad_audio_ok: jboolean,
 ) -> jlong {
     let host: String = match env.get_string(&host) {
         Ok(s) => s.into(),
@@ -269,16 +268,7 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeConnect<'lo
         // CLIENT_CAP_PHASE_LOCK is honest: the async decode loop's presenter feeds
         // report_phase (advisory in v1 — the host arms on report receipt — but the Hello
         // should say what the client does).
-        // CLIENT_CAP_PAD_AUDIO is the SESSION-level negotiation, separate from the per-pad
-        // arrival bits: without it the host never sets HOST_CAP_PAD_AUDIO and never emits 0xD1,
-        // so declaring a pad's render caps later would have nothing to gate. Gated on the
-        // settings so a user with pad audio off does not make the host provision endpoints.
-        punktfunk_core::quic::CLIENT_CAP_PHASE_LOCK
-            | if pad_audio_ok != 0 {
-                punktfunk_core::quic::CLIENT_CAP_PAD_AUDIO
-            } else {
-                0
-            },
+        punktfunk_core::quic::CLIENT_CAP_PHASE_LOCK,
         // Slice-progressive delivery, by decoder truth (Kotlin probes FEATURE_PartialFrame on
         // every decoder this device would use; `debug.punktfunk.force_parts` overrides for the
         // on-glass experiment): AU prefixes then arrive as `Frame::part` pieces and the decode
@@ -301,8 +291,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeConnect<'lo
                 audio: Mutex::new(None),
                 #[cfg(target_os = "android")]
                 mic: Mutex::new(None),
-                #[cfg(target_os = "android")]
-                pad_audio: Mutex::new(None),
                 // A fresh session is never muted (mute is per-session UI state, not a setting).
                 mic_muted: Arc::new(std::sync::atomic::AtomicBool::new(false)),
             };

clients/android/native/src/session/mod.rs

@@ -61,11 +61,6 @@ pub(crate) struct SessionHandle {
     audio: Mutex<Option<crate::audio::AudioPlayback>>,
     #[cfg(target_os = "android")]
     mic: Mutex<Option<crate::mic::MicCapture>>,
-    /// Tier-A DualSense pad audio (the 0xD1 plane), started by `nativeStartPadAudio` once Kotlin
-    /// has claimed the pad's audio interface and handed its descriptor over. Session-lifetime and
-    /// `Option` because a session may have no wired DualSense at all, which is the common case.
-    #[cfg(target_os = "android")]
-    pub(crate) pad_audio: Mutex<Option<crate::pad_audio::PadAudio>>,
     /// In-stream mic mute, set via `nativeSetMicMuted` and read per 10 ms frame by the mic's
     /// encode loop ([`crate::mic`]). Session-lifetime rather than per-[`crate::mic::MicCapture`]
     /// for the same reason the stats gate is: the mic stops and restarts across a surface
@@ -104,14 +99,6 @@ impl SessionHandle {
     fn stop_mic(&self) {
         let _ = self.mic.lock().unwrap().take();
     }
-
-    /// Stop pad audio. Dropping the [`crate::pad_audio::PadAudio`] joins its render thread, which
-    /// is what guarantees nothing is still writing to the descriptor when Kotlin closes the
-    /// `UsbDeviceConnection`. Idempotent.
-    #[cfg(target_os = "android")]
-    pub(crate) fn stop_pad_audio(&self) {
-        let _ = self.pad_audio.lock().unwrap().take();
-    }
 }
 
 impl Drop for SessionHandle {
@@ -121,8 +108,6 @@ impl Drop for SessionHandle {
         self.stop_audio();
         #[cfg(target_os = "android")]
         self.stop_mic();
-        #[cfg(target_os = "android")]
-        self.stop_pad_audio();
     }
 }
 

clients/android/native/src/session/planes.rs

@@ -460,111 +460,6 @@ pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopMic(
     })
 }
 
-/// `NativeBridge.nativeStartPadAudio(handle, pad, fd, haptics, speaker): Boolean` — start tier-A
-/// DualSense pad audio on a descriptor Kotlin has already obtained.
-///
-/// `fd` comes from `UsbDeviceConnection.getFileDescriptor()` **after** claiming the pad's audio
-/// streaming interface. Kotlin owns that connection and **must keep it open until
-/// `nativeStopPadAudio` returns**: the renderer borrows the descriptor and never closes it, so
-/// closing early would pull it out from under an in-flight isochronous transfer.
-///
-/// Returns `false` when there is nothing to render (both kinds disabled) or the thread would not
-/// start. A kernel that refuses the interface claim is NOT reported here — the renderer discovers
-/// that on its own thread and degrades to tier C, because some OEM kernels refuse and there is no
-/// app-side fix worth blocking a session on.
-#[no_mangle]
-#[cfg(target_os = "android")]
-pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStartPadAudio(
-    _env: JNIEnv,
-    _this: JObject,
-    handle: jlong,
-    pad: jni::sys::jint,
-    fd: jni::sys::jint,
-    haptics: jboolean,
-    speaker: jboolean,
-) -> jboolean {
-    jni_guard(0, || {
-        if handle == 0 || fd < 0 || !(0..16).contains(&pad) {
-            return 0;
-        }
-        // SAFETY: live handle per the nativeConnect/nativeClose contract.
-        let h = unsafe { &*(handle as *const SessionHandle) };
-        // Replace any previous renderer first: dropping it joins the old thread, so two of them
-        // can never hold the same descriptor at once.
-        h.stop_pad_audio();
-        // The capability declaration and the rumble suppression are NOT done here: the renderer
-        // makes both only once its USB stream actually opens (see `pad_audio::render`). Doing them
-        // at spawn time would, on a kernel that refuses the interface claim, take the pad off wire
-        // rumble and give it nothing in return — no haptics of any kind.
-        match crate::pad_audio::start(
-            std::sync::Arc::clone(&h.client),
-            pad as u8,
-            fd,
-            haptics != 0,
-            speaker != 0,
-        ) {
-            Some(p) => {
-                *h.pad_audio.lock().unwrap() = Some(p);
-                1
-            }
-            None => 0,
-        }
-    })
-}
-
-/// `NativeBridge.nativePadAudioSelfTest(fd, seconds, hz): Int` — drive the pad directly with a
-/// tone through the real client render path, with no host and no session involved.
-///
-/// The check a standalone harness cannot make: it owns its descriptor by construction, so it can
-/// never reveal that the client handed the renderer a descriptor something else was already
-/// driving. Returns sample frames written, or negative on failure (see `pad_audio::SelfTest`).
-#[no_mangle]
-#[cfg(target_os = "android")]
-pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativePadAudioSelfTest(
-    _env: JNIEnv,
-    _this: JObject,
-    fd: jni::sys::jint,
-    seconds: jni::sys::jint,
-    hz: jni::sys::jint,
-) -> jni::sys::jint {
-    jni_guard(-1, || {
-        if fd < 0 {
-            return -1;
-        }
-        // SAFETY: Kotlin holds the owning UsbDeviceConnection open across this call and drives no
-        // other transfers on it (it opens a dedicated connection for exactly this).
-        unsafe { crate::pad_audio::self_test(fd, seconds, hz) }
-    })
-}
-
-/// `NativeBridge.nativeStopPadAudio(handle, pad)` — stop tier-A pad audio and join its thread.
-///
-/// Returns only once the render thread is joined, which is the point: Kotlin may close the
-/// `UsbDeviceConnection` as soon as this returns and not before.
-#[no_mangle]
-#[cfg(target_os = "android")]
-pub extern "system" fn Java_io_unom_punktfunk_kit_NativeBridge_nativeStopPadAudio(
-    _env: JNIEnv,
-    _this: JObject,
-    handle: jlong,
-    pad: jni::sys::jint,
-) {
-    jni_guard((), || {
-        if handle != 0 {
-            // SAFETY: live handle per the nativeConnect/nativeClose contract.
-            let h = unsafe { &*(handle as *const SessionHandle) };
-            h.stop_pad_audio();
-            if (0..16).contains(&pad) {
-                // Withdraw the capability and hand the pad back to wire rumble, in that order:
-                // the host stops sending 0xD1 before tier C resumes, so the two never overlap.
-                h.client.set_pad_audio_caps(pad as u8, 0);
-                crate::pad_audio::set_tier_a(pad as u8, false);
-                crate::pad_audio::clear_haptics_liveness(pad as u8);
-            }
-        }
-    })
-}
-
 /// `NativeBridge.nativeSetMicMuted(handle, muted)` — mute/unmute the mic uplink mid-stream.
 ///
 /// Muting deliberately does NOT stop the capture: the AAudio input stream, the input-preset rung

clients/session/src/main.rs

@@ -286,12 +286,6 @@ mod session_main {
         // Spawned at first params-build so it exists for --connect AND console launches.
         #[cfg(unix)]
         crate::ctl_socket::spawn(gamepad.clone());
-        // Pad-audio prefs to OUR gamepad service (same reasoning as the pin above): tier-A
-        // slots declare their render caps at open time, which happens on attach — after this.
-        gamepad.set_pad_audio_prefs(
-            settings.pad_haptics,
-            pf_client_core::pad_audio::speaker_active(&settings.pad_speaker),
-        );
         let mode = Mode {
             width: if settings.width == 0 {
                 native.width
@@ -395,11 +389,6 @@ mod session_main {
             cursor_forward: settings.mouse_mode() == trust::MouseMode::Desktop,
             mic_enabled: settings.mic_enabled,
             echo_cancel: settings.echo_cancel,
-            // Pad audio (0xD1): the DualSense haptics/speaker render settings. The gamepad
-            // service learns the same prefs below so tier-A slots declare their render caps
-            // at open; the session pump gates CLIENT_CAP_PAD_AUDIO + the renderer on these.
-            pad_haptics: settings.pad_haptics,
-            pad_speaker: settings.pad_speaker.clone(),
             clipboard,
             // The Settings preference (auto → VAAPI where it exists; the presenter
             // demotes to software on boxes whose Vulkan can't import the dmabufs).

crates/pf-client-core/Cargo.toml

@@ -57,10 +57,6 @@ sdl3 = { version = "0.18", features = ["hidapi"] }
 
 [target.'cfg(windows)'.dependencies]
 wasapi = "0.23"
-# Pad-audio correlation (pad_audio.rs): the HID devnode's ContainerID and a render endpoint's
-# stamped PKEY_Device_ContainerId both live in the registry — read-only, which sidesteps COM
-# property stores entirely (the same version the host pins).
-winreg = "0.56"
 sdl3 = { version = "0.18", features = ["hidapi", "build-from-source"] }
 # D3D11VA decode (video_d3d11.rs): device/adapter selection, DXVA probes, and the shared
 # NT-handle hand-off ring. Same pinned rev as clients/windows so the workspace builds ONE

crates/pf-client-core/src/audio_wasapi.rs

@@ -98,43 +98,13 @@ pub fn devices() -> Result<(Vec<AudioDevice>, Vec<AudioDevice>)> {
 /// Settings device pickers via session main), or the OS default. A picked device that's
 /// gone (unplugged USB DAC, remote session) falls back to the default with a warning —
 /// audio keeps working, like the PipeWire twin's `target.object` behavior.
-/// Resolve an active endpoint by id WITHOUT `DeviceEnumerator::get_device`.
-///
-/// That helper builds its argument as `PCWSTR::from_raw(HSTRING::from(id).as_ptr())` — the
-/// `HSTRING` is a temporary, dropped at the end of that statement, so `GetDevice` reads freed
-/// memory and misses ids that are perfectly valid. Scanning the active collection touches only
-/// safe crate APIs, so it cannot regress the same way. (`punktfunk-host` fixes the same bug with
-/// raw COM instead; this crate cannot, because it pins a different `windows` revision than
-/// `wasapi` does, making the two `IMMDevice` types incompatible.)
-pub(crate) fn device_by_id(
-    enumerator: &DeviceEnumerator,
-    direction: &Direction,
-    id: &str,
-) -> Result<wasapi::Device> {
-    let devices = enumerator
-        .get_device_collection(direction)
-        .map_err(|e| anyhow!("enumerate {direction:?} endpoints: {e}"))?;
-    let count = devices
-        .get_nbr_devices()
-        .map_err(|e| anyhow!("endpoint count: {e}"))?;
-    for i in 0..count {
-        let dev = devices
-            .get_device_at_index(i)
-            .map_err(|e| anyhow!("endpoint {i}: {e}"))?;
-        if dev.get_id().is_ok_and(|got| got == id) {
-            return Ok(dev);
-        }
-    }
-    anyhow::bail!("no active {direction:?} endpoint with id {id}")
-}
-
 fn pick_device(
     enumerator: &DeviceEnumerator,
     direction: &Direction,
     var: &str,
 ) -> Result<wasapi::Device> {
     if let Some(id) = std::env::var(var).ok().filter(|v| !v.is_empty()) {
-        match device_by_id(enumerator, direction, &id) {
+        match enumerator.get_device(&id) {
             Ok(d) => {
                 tracing::info!(
                     var,

crates/pf-client-core/src/gamepad.rs

@@ -369,14 +369,8 @@ enum Ctl {
     Pin(Option<String>),
     KindOverride(GamepadPref),
     Forwarding(bool),
-    SystemButtons {
-        forward_raw: bool,
-        gesture: bool,
-    },
+    SystemButtons { forward_raw: bool, gesture: bool },
     TapButton(u32),
-    /// Which pad-audio streams the session's settings want rendered (bit0 = haptics, bit1 =
-    /// speaker) — the settings half of the per-pad tier-A capability declared at slot open.
-    PadAudioPrefs(u8),
     MenuMode(bool),
     MenuRumble(MenuPulse),
 }
@@ -579,18 +573,6 @@ impl GamepadService {
         let _ = self.ctl.send(Ctl::TapButton(wire::BTN_MISC1));
     }
 
-    /// Declare which pad-audio streams this session's settings want rendered (`haptics` =
-    /// [`Settings::pad_haptics`](crate::trust::Settings::pad_haptics), `speaker` =
-    /// `pad_speaker == "pad"` via [`crate::pad_audio::speaker_active`]). Drives the per-pad
-    /// tier-A capability bits declared to the core at slot open — a WIRED DualSense/Edge
-    /// declares exactly these; every other pad declares 0. Call before [`Self::attach`],
-    /// like [`Self::set_kind_override`]: slots declare at open time. Defaults to "nothing"
-    /// for an embedder that never calls it, keeping the wire bytes exactly as before.
-    pub fn set_pad_audio_prefs(&self, haptics: bool, speaker: bool) {
-        let bits = (haptics as u8) | ((speaker as u8) << 1);
-        let _ = self.ctl.send(Ctl::PadAudioPrefs(bits));
-    }
-
     pub fn attach(&self, connector: Arc<NativeClient>) {
         let _ = self.ctl.send(Ctl::Attach(connector));
     }
@@ -764,8 +746,6 @@ impl Ds5Feedback {
     /// The USB report offsets these are derived from — see the type doc. Kept beside the derived
     /// values so the subtraction is visible at the point of definition.
     const REPORT_ID_LEN: usize = 1;
-    /// The audio-control region (`ucHeadphoneVolume`…`ucAudioMuteBits`): report byte 5.
-    const AUDIO: usize = 5 - Self::REPORT_ID_LEN;
     const RIGHT_TRIGGER: usize = 11 - Self::REPORT_ID_LEN;
     const LEFT_TRIGGER: usize = 22 - Self::REPORT_ID_LEN;
     const PAD_LIGHTS: usize = 44 - Self::REPORT_ID_LEN;
@@ -802,29 +782,6 @@ impl Ds5Feedback {
         p[Self::PAD_LIGHTS] = bits & 0x1F;
         p
     }
-
-    /// The one-shot tier-A activation packet — the SDL disable-bit trap undone. `p[0]`
-    /// (`ucEnableBits1`) bit0 = "enable rumble emulation" and bit1 = "disable audio haptics"
-    /// (SDL_hidapi_ps5.c); SDL sets BOTH whenever its rumble path runs, which mutes the very
-    /// voice coils the 0xD1 haptics stream drives. Per SDL's own comment — "Leaving emulated
-    /// rumble bits off will restore audio haptics" — a packet with those bits CLEARED (and no
-    /// other valid flag, so nothing else is touched) puts the pad back on audio haptics.
-    fn audio_haptics_packet() -> [u8; 47] {
-        [0u8; 47]
-    }
-
-    /// Fold a host [`HidOutput::AudioCtl`] into an effects packet: `raw` is DS5 output report
-    /// `0x02` bytes 5..=10 verbatim → struct offsets 4..=9 ([`Self::AUDIO`] — headphone/
-    /// speaker/mic volumes + routing), and `p[0]` re-asserts the report's audio-valid flags
-    /// (`flags` bits1..4 = report `flag0` bits 4..7). `flags` bit0 (haptics-select, `flag0`
-    /// bit1 = SDL's "disable audio haptics") is deliberately NOT replayed: bits 0/1 stay
-    /// clear so the pad's audio haptics stay live (see [`audio_haptics_packet`]).
-    fn audio_ctl_packet(flags: u8, raw: &[u8; 6]) -> [u8; 47] {
-        let mut p = [0u8; 47];
-        p[0] = (flags & 0x1E) << 3;
-        p[Self::AUDIO..Self::AUDIO + 6].copy_from_slice(raw);
-        p
-    }
 }
 
 /// One forwarded controller during an attached session: the open SDL handle, its stable wire
@@ -861,14 +818,6 @@ struct Slot {
     /// Hold-Select→guide state ([`SelectGesture`]) — only fed while the worker's
     /// `guide_gesture` policy is on.
     gesture: SelectGesture,
-    /// Pad-audio render capabilities declared for this slot (bit0 = haptics, bit1 = speaker
-    /// — the [`NativeClient::set_pad_audio_caps`] bits). Nonzero only for a tier-A pad (a
-    /// WIRED DualSense/Edge, see [`crate::pad_audio::is_tier_a_ds5`]) under matching
-    /// settings; bit0 set additionally suppresses wire rumble for this slot (the SDL
-    /// disable-bit trap — see [`Worker::render_feedback`]).
-    audio_caps: u8,
-    /// The wire-rumble-suppressed notice fired for this slot (log once, not per command).
-    rumble_suppressed_logged: bool,
 }
 
 impl Slot {
@@ -885,8 +834,6 @@ impl Slot {
             held_clicks: [false; 2],
             last_accel: [0; 3],
             gesture: SelectGesture::default(),
-            audio_caps: 0,
-            rumble_suppressed_logged: false,
         }
     }
 
@@ -1024,10 +971,6 @@ struct Worker {
     /// Releases owed for synthetic taps ([`Ctl::TapButton`]): `(pad, bit, due)` — the
     /// down went out on receipt, the up goes out from the poll once `due` passes.
     synthetic_ups: Vec<(u8, u32, Instant)>,
-    /// Pad-audio streams the session's settings want rendered (bit0 = haptics, bit1 =
-    /// speaker — [`GamepadService::set_pad_audio_prefs`]). `0` (the default) until an embedder
-    /// declares some: tier-A detection then never runs and every arrival stays caps-less.
-    pad_audio_prefs: u8,
     attached: Option<Arc<NativeClient>>,
     /// Raises the UI escape signal; the escape chord fires it once per press.
     escape_tx: async_channel::Sender<()>,
@@ -1233,18 +1176,11 @@ impl Worker {
             Ok(pad) => {
                 let mut slot = Slot::new(id, index, pref, pad);
                 Self::set_slot_sensors(&mut slot, true);
-                slot.audio_caps = self.pad_audio_caps_for(id, &slot.pad);
                 // Declare this pad's kind BEFORE any of its input, so the host builds a matching
                 // virtual device (mixed types — pad 0 a DualSense, pad 1 an Xbox pad). The core
                 // re-sends it a few times against datagram loss; an older host ignores it and
                 // uses the session-default kind.
                 if let Some(c) = &self.attached {
-                    // Pad-audio render caps go in FIRST — the core ORs them into this (and
-                    // every re-sent) arrival's flags bits 8/9 toward a capable host. ALWAYS
-                    // set (0 for non-tier-A): wire indices are reused within a connection, so
-                    // a tier-A slot that closes must not leave its bits behind for the next
-                    // pad on the same index (the set_rumble_quirks rule).
-                    c.set_pad_audio_caps(index, slot.audio_caps);
                     send(
                         c,
                         InputKind::GamepadArrival,
@@ -1267,27 +1203,6 @@ impl Worker {
                     };
                     c.set_rumble_quirks(index as u16, quirks);
                 }
-                if slot.audio_caps != 0 {
-                    if slot.audio_caps & 0x01 != 0 {
-                        // Tier-A haptics activation: the SDL disable-bit trap. SDL's DS5
-                        // driver sets ucEnableBits1 0x01|0x02 ("enable rumble emulation" +
-                        // "disable audio haptics") whenever its rumble path runs — which
-                        // would MUTE the voice coils the 0xD1 stream drives. One effects
-                        // packet with those bits CLEARED puts the pad back on audio haptics
-                        // ("Leaving emulated rumble bits off will restore audio haptics" —
-                        // SDL_hidapi_ps5.c); wire rumble for this slot is suppressed in
-                        // render_feedback so SDL never re-arms them.
-                        let _ = slot.pad.send_effect(&Ds5Feedback::audio_haptics_packet());
-                    }
-                    // Hand the pad to the session's renderer worker. Windows correlation
-                    // needs the HID interface path; Linux matches the sink by signature.
-                    crate::pad_audio::register_tier_a(index, slot.pad.path());
-                    tracing::info!(
-                        index,
-                        caps = slot.audio_caps,
-                        "tier-A DualSense: pad-audio render caps declared"
-                    );
-                }
                 tracing::info!(
                     id,
                     index,
@@ -1301,35 +1216,6 @@ impl Worker {
         }
     }
 
-    /// This pad's pad-audio render capabilities (the bits [`NativeClient::set_pad_audio_caps`]
-    /// takes): the settings prefs for a tier-A pad — a physical DualSense/Edge (by VID:PID,
-    /// never the DECLARED kind: the stream renders on the controller in the user's hands) on
-    /// a WIRED connection — and `0` for everything else (tier B/C are out of scope). Wired
-    /// comes from `SDL_GetGamepadConnectionState`; when SDL answers Unknown, the pad's 4-ch
-    /// audio sibling existing is the fallback signal (Bluetooth exposes no audio device).
-    fn pad_audio_caps_for(&self, id: u32, pad: &sdl3::gamepad::Gamepad) -> u8 {
-        if self.pad_audio_prefs == 0 {
-            return 0; // nothing wanted — skip the (possibly probing) wired check entirely
-        }
-        let jid = sdl3::sys::joystick::SDL_JoystickID(id);
-        let vid = self.subsystem.vendor_for_id(jid).unwrap_or(0);
-        let pid = self.subsystem.product_for_id(jid).unwrap_or(0);
-        if !crate::pad_audio::is_tier_a_ds5(vid, pid, true) {
-            return 0; // not a DualSense/Edge — no wired check needed
-        }
-        use sdl3::joystick::ConnectionState;
-        let wired = match pad.connection_state() {
-            Ok(ConnectionState::Wired) => true,
-            Ok(ConnectionState::Wireless) => false,
-            _ => crate::pad_audio::wired_audio_sibling(pad.path().as_deref()),
-        };
-        if crate::pad_audio::is_tier_a_ds5(vid, pid, wired) {
-            self.pad_audio_prefs
-        } else {
-            0
-        }
-    }
-
     /// Flush a slot's held wire state (so nothing sticks down host-side) and drop it — closing
     /// the SDL handle. The flush only emits wire events, so it is safe even when the device is
     /// already gone (unplug).
@@ -1347,11 +1233,6 @@ impl Worker {
             send(&c, InputKind::GamepadRemove, 0, 0, self.slots[i].index);
         }
         let slot = self.slots.remove(i);
-        if slot.audio_caps != 0 {
-            // Take the pad back from the pad-audio renderer (its device-gone path then
-            // re-correlates — and finds nothing until a tier-A pad registers again).
-            crate::pad_audio::unregister_tier_a(slot.index);
-        }
         tracing::info!(
             id = slot.id,
             index = slot.index,
@@ -1773,7 +1654,6 @@ impl Worker {
                         set_valve_hidapi(false);
                     }
                 }
-                Ok(Ctl::PadAudioPrefs(bits)) => self.pad_audio_prefs = bits & 0x03,
                 Ok(Ctl::MenuMode(on)) => {
                     self.menu_mode = on;
                     if on {
@@ -2086,20 +1966,6 @@ impl Worker {
         // first; the physical silence backstop is in `close_slot_at`).
         while let Ok(cmd) = connector.next_rumble_command(Duration::ZERO) {
             if let Some(slot) = self.slots.iter_mut().find(|s| s.index as u16 == cmd.pad) {
-                // The SDL disable-bit trap: ANY SDL rumble write sets ucEnableBits1
-                // 0x01|0x02, muting the very voice coils the 0xD1 haptics stream drives —
-                // so a slot with tier-A haptics active never issues wire rumble (the stream
-                // carries the feedback; the game's rumble is in its haptics mix).
-                if slot.audio_caps & 0x01 != 0 {
-                    if !slot.rumble_suppressed_logged {
-                        slot.rumble_suppressed_logged = true;
-                        tracing::info!(
-                            pad = slot.index,
-                            "wire rumble suppressed — the pad-audio haptics stream carries feedback"
-                        );
-                    }
-                    continue;
-                }
                 Self::issue_rumble(slot, cmd.low, cmd.high, cmd.backstop_ms);
             }
         }
@@ -2137,27 +2003,13 @@ impl Worker {
                         .pad
                         .send_effect(&Ds5Feedback::trigger_packet(which, effect));
                 }
-                // The audio-control region of a DS5 output report a game wrote host-side
-                // (volumes + routing; the SAMPLES ride 0xD1) — folded back into the physical
-                // pad's effects packet, but only where a tier-A renderer is actually live
-                // (`audio_caps`): replaying speaker volumes at a pad whose audio device
-                // nothing streams to would just mute/blast a future session's start state.
-                // Non-tier-A pads keep dropping it (the pre-pad-audio behaviour).
-                HidOutput::AudioCtl { flags, raw, .. } if is_ds && slot.audio_caps != 0 => {
-                    let _ = slot
-                        .pad
-                        .send_effect(&Ds5Feedback::audio_ctl_packet(flags, &raw));
-                }
                 // Deliberately unhandled, listed rather than left to a bare `_` so a new
                 // variant cannot join them silently: adaptive triggers exist only on a
                 // DualSense, and the trackpad-haptic / raw-passthrough planes are DS-specific
-                // and carried by `send_effect` above when the pad is one. `AudioCtl` lands here
-                // only when the guarded arm above declined it — a non-DualSense pad, or one with
-                // no live tier-A renderer — which is the pre-pad-audio behaviour: drop it.
+                // and carried by `send_effect` above when the pad is one.
                 HidOutput::Trigger { .. }
                 | HidOutput::TrackpadHaptic { .. }
-                | HidOutput::HidRaw { .. }
-                | HidOutput::AudioCtl { .. } => {}
+                | HidOutput::HidRaw { .. } => {}
             }
         }
     }
@@ -2196,9 +2048,6 @@ fn hidout_pad(h: &HidOutput) -> u8 {
         | HidOutput::Trigger { pad, .. }
         | HidOutput::TrackpadHaptic { pad, .. }
         | HidOutput::HidRaw { pad, .. } => *pad,
-        // AudioCtl's pad is the plane's only u16. `HidOutput::decode` rejects anything at or
-        // above MAX_PADS (B27), so by the time one reaches here the narrowing is lossless.
-        HidOutput::AudioCtl { pad, .. } => *pad as u8,
     }
 }
 
@@ -2226,7 +2075,6 @@ impl Worker {
             system_forward: true,
             guide_gesture: false,
             synthetic_ups: Vec::new(),
-            pad_audio_prefs: 0,
             attached: None,
             escape_tx,
             disconnect_tx,
@@ -2672,44 +2520,6 @@ mod slot_tests {
             }),
             6
         );
-        // AudioCtl's wire pad is u16; the index space is 0..MAX_PADS end to end.
-        assert_eq!(
-            hidout_pad(&HidOutput::AudioCtl {
-                pad: 7,
-                flags: 0,
-                raw: [0; 6]
-            }),
-            7
-        );
-    }
-
-    /// The AudioCtl fold: the 6 raw bytes (DS5 report 0x02 bytes 5..=10) land at effect-struct
-    /// offsets 4..=9, the report's audio-valid flags (AudioCtl.flags bits1..4) come back as
-    /// p[0] bits 4..7, and the rumble-emulation / disable-audio-haptics bits (p[0] bits 0/1)
-    /// stay CLEAR — setting either would mute the voice coils the 0xD1 stream drives.
-    #[test]
-    fn audio_ctl_folds_report_bytes_into_effect_offsets() {
-        let raw = [0x50, 0x60, 0x70, 0x05, 0x11, 0x22];
-        // flags 0b1_0111: haptics-select (bit0) + audio-valid bits 1/2/4 of the condensed form.
-        let p = Ds5Feedback::audio_ctl_packet(0b1_0111, &raw);
-        assert_eq!(&p[4..10], &raw, "report bytes 5..=10 → struct 4..=9");
-        // bits1..4 (0b1011) → flag0 bits 4..7.
-        assert_eq!(p[0], 0b1011_0000);
-        assert_eq!(
-            p[0] & 0x03,
-            0,
-            "haptics-select must NOT replay into p[0] bits 0/1"
-        );
-        // Nothing else is touched: no trigger/LED enable bits, no stray bytes.
-        assert!(p[1..4].iter().all(|&b| b == 0));
-        assert!(p[10..].iter().all(|&b| b == 0));
-        // No audio-valid flags condenses to no enable bits (raw still carried verbatim).
-        let p = Ds5Feedback::audio_ctl_packet(0b0_0001, &raw);
-        assert_eq!(p[0], 0);
-        assert_eq!(&p[4..10], &raw);
-        // The tier-A activation packet is the all-clear: every enable bit off — per
-        // SDL_hidapi_ps5.c, leaving the emulated-rumble bits off restores audio haptics.
-        assert_eq!(Ds5Feedback::audio_haptics_packet(), [0u8; 47]);
     }
 }
 

crates/pf-client-core/src/lib.rs

@@ -47,11 +47,6 @@ pub mod os;
 // Client settings profiles: the override catalog + the one connect-time resolver
 // (design/client-settings-profiles.md §4). Sits beside `trust`, which owns the host records
 // the bindings live on.
-// Pad audio (the 0xD1 plane): DualSense voice-coil haptics + speaker rendered on the wired
-// physical pad's own 4-ch audio device — correlation, the per-session renderer worker, and
-// the tier-A pad registry the gamepad worker feeds it through.
-#[cfg(any(target_os = "linux", windows))]
-pub mod pad_audio;
 #[cfg(any(target_os = "linux", windows))]
 pub mod profiles;
 #[cfg(any(target_os = "linux", windows))]

crates/pf-client-core/src/session.rs

@@ -44,14 +44,6 @@ pub struct SessionParams {
     /// Run the uplink through the platform's echo cancellation ([`Settings::echo_cancel`]).
     /// Ignored when `mic_enabled` is false; `PUNKTFUNK_NO_AEC=1` overrides it off.
     pub echo_cancel: bool,
-    /// Render the host's per-pad DualSense voice-coil haptics stream (0xD1 kind 0) on a wired
-    /// physical DualSense ([`crate::trust::Settings::pad_haptics`]). With `pad_speaker` it
-    /// gates the `CLIENT_CAP_PAD_AUDIO` advertisement and the pad-audio renderer thread.
-    pub pad_haptics: bool,
-    /// Where the DualSense built-in-speaker stream (0xD1 kind 1) goes: `"pad"` | `"mix"` |
-    /// `"off"` ([`crate::trust::Settings::pad_speaker`]; `"mix"` is a TODO that renders as
-    /// off — see [`crate::pad_audio::speaker_active`]).
-    pub pad_speaker: String,
     /// Share the clipboard with this host (the per-host `KnownHost::clipboard_sync`). The
     /// bridge additionally needs the host to advertise `HOST_CAP_CLIPBOARD`.
     pub clipboard: bool,
@@ -364,11 +356,6 @@ fn pump(
             );
         }
     }
-    // Pad audio (0xD1): advertise only when the settings could render a stream — the per-pad
-    // tier-A detection at slot open (gamepad.rs) still decides which pads declare render caps
-    // on their arrivals, so this bit alone changes nothing without a wired DualSense.
-    let pad_speaker_on = crate::pad_audio::speaker_active(&params.pad_speaker);
-    let pad_audio_on = params.pad_haptics || pad_speaker_on;
     let connector = match NativeClient::connect(
         &params.host,
         params.port,
@@ -392,11 +379,6 @@ fn pump(
             0
         }) | (if params.phase_lock {
             punktfunk_core::quic::CLIENT_CAP_PHASE_LOCK
-        } else {
-            0
-            // PAD_AUDIO: the embedder can render per-pad DualSense haptics/speaker (see above).
-        }) | (if pad_audio_on {
-            punktfunk_core::quic::CLIENT_CAP_PAD_AUDIO
         } else {
             0
         }),
@@ -519,20 +501,6 @@ fn pump(
     // app-lifetime service's job (the UI attaches it on Connected). Audio runs on its own
     // thread (one puller per plane), blocking on the audio queue like the Apple client.
     let audio_thread = spawn_audio(connector.clone(), stop.clone());
-    // Pad audio (0xD1): its own drain thread (that plane's single consumer), spawned whenever
-    // the settings could render. The output device is opened LAZILY once frames actually
-    // arrive — which only happens after a tier-A pad declared render caps on its arrival — so
-    // a session without a wired DualSense costs one idle 10 ms poll loop.
-    let pad_audio_thread = pad_audio_on
-        .then(|| {
-            crate::pad_audio::spawn(
-                connector.clone(),
-                stop.clone(),
-                params.pad_haptics,
-                pad_speaker_on,
-            )
-        })
-        .flatten();
     // The shared clipboard (design/clipboard-and-file-transfer.md §5): its own thread, since
     // `next_clip` blocks and the OS clipboard calls can wait on other apps. Returns straight
     // away when the host has no clipboard capability, so spawning is unconditional.
@@ -1098,9 +1066,6 @@ fn pump(
     if let Some(t) = audio_thread {
         let _ = t.join(); // exits within its 100 ms pull timeout once `stop` is set
     }
-    if let Some(t) = pad_audio_thread {
-        let _ = t.join(); // exits within its 10 ms pull timeout once `stop` is set
-    }
     if let Some(t) = clipboard_thread {
         let _ = t.join(); // exits within its next_clip wait once `stop` is set
     }

crates/pf-client-core/src/trust.rs

@@ -1024,21 +1024,6 @@ pub struct Settings {
     /// `PUNKTFUNK_AUDIO_SOURCE`).
     #[serde(default)]
     pub mic_device: String,
-    /// Render the host's per-pad DualSense voice-coil haptics stream (the 0xD1 plane, kind 0)
-    /// on a WIRED physical DualSense's own audio device (tier A — Bluetooth pads expose no
-    /// audio device). Gates the `CLIENT_CAP_PAD_AUDIO` advertisement and the per-pad arrival
-    /// capability bit; wire rumble is suppressed for a pad whose haptics stream is live (the
-    /// stream carries the feedback — see `gamepad.rs`, the SDL disable-bit trap). Default ON:
-    /// the capable-and-agreed negotiation means it changes nothing without a capable host AND
-    /// a wired DS5. `default` so pre-existing stores load with it on.
-    #[serde(default = "default_true")]
-    pub pad_haptics: bool,
-    /// Where the DualSense built-in-speaker stream (0xD1 kind 1) is rendered: `"pad"` (default
-    /// — the physical pad's own speaker), `"mix"` (fold it into the main stream audio — a
-    /// declared TODO that renders as `"off"` today; see `pad_audio::speaker_active`), or
-    /// `"off"`. `default` so pre-existing stores load as `"pad"`.
-    #[serde(default = "default_pad_speaker")]
-    pub pad_speaker: String,
     /// Match-window resolution policy (design/midstream-resolution-resize.md D1): the
     /// stream mode follows the session window — the connect asks for the window's pixel
     /// size and a mid-session resize renegotiates the host's virtual display + encoder
@@ -1086,10 +1071,6 @@ fn default_true() -> bool {
     true
 }
 
-fn default_pad_speaker() -> String {
-    "pad".into()
-}
-
 impl Settings {
     /// The stats-overlay tier, resolving pre-tier stores: an old `show_stats = false`
     /// reads as Off, everything else as Normal (≈ what the pre-tier overlay showed).
@@ -1198,8 +1179,6 @@ impl Default for Settings {
             invert_scroll: false,
             speaker_device: String::new(),
             mic_device: String::new(),
-            pad_haptics: true,
-            pad_speaker: "pad".into(),
             match_window: false,
             last_window_w: 0,
             last_window_h: 0,

crates/pf-inject/src/inject/hidout_dedup.rs

@@ -24,20 +24,14 @@ const RENEW_EVERY: Duration = Duration::from_millis(1000);
 /// bundles rumble + lightbar + player-LEDs + adaptive-triggers into one report, so a pad that is
 /// merely *rumbling* re-sends its (unchanged) lightbar / LED / trigger state on every output report.
 /// The managers already dedup rumble; this does the same for the rich [`HidOutput`] feedback so the
-/// 0xCD plane carries only genuine changes. State (`Led` / `PlayerLeds` / `Trigger` / `AudioCtl`)
-/// is deduped by value; a one-shot `TrackpadHaptic` pulse is always forwarded (each pulse must
-/// fire).
+/// 0xCD plane carries only genuine changes. State (`Led` / `PlayerLeds` / `Trigger`) is deduped by
+/// value; a one-shot `TrackpadHaptic` pulse is always forwarded (each pulse must fire).
 #[derive(Clone, Default)]
 pub struct HidoutDedup {
     led: Option<(u8, u8, u8)>,
     player_leds: Option<u8>,
     /// Last-forwarded adaptive-trigger effect per side: `[0]` = L2, `[1]` = R2.
     trigger: [Option<Vec<u8>>; 2],
-    /// Last-forwarded audio-control state (`flags` + the raw volume/routing bytes).
-    audio_ctl: Option<(u8, [u8; 6])>,
-    /// Once-per-pad-lifetime field-diagnosis flag: set after the first forwarded `AudioCtl`
-    /// carrying the haptics-select bit was logged (cleared with the rest on (re)plug).
-    haptics_select_logged: bool,
     /// When anything was last put on the wire for this pad. `None` = nothing latched yet, so
     /// there is nothing to renew. See [`RENEW_EVERY`].
     last_sent: Option<Instant>,
@@ -129,25 +123,6 @@ impl HidoutDedup {
             }
             // One-shot haptic pulse (Steam voice-coil) — state-less, always fires.
             HidOutput::TrackpadHaptic { .. } => true,
-            HidOutput::AudioCtl { pad, flags, raw } => {
-                let v = Some((*flags, *raw));
-                if self.audio_ctl == v {
-                    false
-                } else {
-                    // Field-diagnosis signal, once per pad lifetime: a title driving the DS5's
-                    // audio haptics (not plain rumble emulation, whose all-zero audio region
-                    // never reaches here) — the trace that tells "the game does audio haptics"
-                    // apart from "the client just doesn't render them".
-                    if flags & 0x01 != 0 && !self.haptics_select_logged {
-                        self.haptics_select_logged = true;
-                        tracing::info!(
-                            "DS5 title asserted haptics-select (audio haptics) pad={pad}"
-                        );
-                    }
-                    self.audio_ctl = v;
-                    true
-                }
-            }
             // Raw as-is passthrough reports must NEVER dedup: the physical device's firmware
             // watchdogs RELY on identical periodic refreshes (Triton rumble re-sent every ~40 ms
             // against a ~50 ms safety timeout, lizard-off every ~3 s) — dropping a repeat would
@@ -327,29 +302,4 @@ mod tests {
         // The pulse stamped the clock but latched no state, so the renewal has nothing to repeat.
         assert!(d.renewals(0, t + Duration::from_millis(1000)).is_empty());
     }
-
-    /// `AudioCtl` dedups by value like the other state kinds: an identical repeat (every output
-    /// report re-sends the unchanged audio region) is dropped, a flags-only or raw-only change
-    /// forwards again, and `clear` re-arms — including the once-per-pad haptics-select log flag.
-    #[test]
-    fn audio_ctl_dedups_by_value() {
-        let mut d = HidoutDedup::default();
-        let t = Instant::now();
-        let audio = |flags, vol| HidOutput::AudioCtl {
-            pad: 0,
-            flags,
-            raw: [vol, 0, 0, 0, 0, 0],
-        };
-        // Identical twice → exactly one emission.
-        assert!(d.should_forward(&audio(0x17, 0x50), t));
-        assert!(!d.should_forward(&audio(0x17, 0x50), t));
-        // Either half changing (flags, or the raw region) forwards again.
-        assert!(d.should_forward(&audio(0x16, 0x50), t));
-        assert!(d.should_forward(&audio(0x16, 0x60), t));
-        // The other kinds' state is untouched by audio traffic.
-        assert!(d.should_forward(&HidOutput::PlayerLeds { pad: 0, bits: 1 }, t));
-        // `clear` (pad re-plug) re-arms the value dedup.
-        d.clear();
-        assert!(d.should_forward(&audio(0x16, 0x60), t));
-    }
 }

crates/pf-inject/src/inject/proto/dualsense_proto.rs

@@ -535,7 +535,7 @@ pub mod out_report {
 
 /// Parse a DualSense USB output report (`0x02`) into a [`DsFeedback`], indexed off
 /// [`out_report`]. Only the well-understood fields (motor rumble, lightbar RGB, player LEDs) are
-/// surfaced — adaptive-trigger blocks and the audio-control region are forwarded raw for the client.
+/// surfaced — adaptive-trigger blocks are forwarded raw for the client.
 ///
 /// Every field is gated on the report's valid-flags (`valid_flag0` at data[1], `valid_flag1`
 /// at data[2]) — writers only set the bits for fields they mean to change (the rest is zeroed),
@@ -592,21 +592,6 @@ pub fn parse_ds_output(pad: u8, data: &[u8], fb: &mut DsFeedback) {
             });
         }
     }
-    // The audio-control region (bytes 5..=10: headphone/speaker/mic volumes + routing), for the
-    // pad-audio path. The wire flags condense the report's audio bits: bit0 = haptics-select
-    // (flag0 BIT1 — set on every SDL rumble write too, which is why it alone never triggers an
-    // emission), bits1..4 = flag0 bits 4..7 (the audio-valid flags gating the region). Emitted
-    // whenever an audio-valid flag is present or the region carries data; downstream dedup
-    // ([`crate::hidout_dedup`]) reduces the per-report repeats to genuine changes.
-    let raw: [u8; 6] = data[5..11].try_into().unwrap();
-    if flag0 & 0xF0 != 0 || raw != [0u8; 6] {
-        let flags = ((flag0 >> 1) & 0x01) | ((flag0 >> 3) & 0x1E);
-        fb.hidout.push(HidOutput::AudioCtl {
-            pad: pad.into(),
-            flags,
-            raw,
-        });
-    }
 }
 
 #[cfg(test)]
@@ -932,48 +917,6 @@ mod tests {
         assert_eq!(*DUALSENSE_EDGE_RDESC.last().unwrap(), 0xC0);
     }
 
-    /// A 0x02 report driving the pad's audio (haptics-select + audio-valid flags + the volume/
-    /// routing bytes) surfaces an `AudioCtl` with the exact raw region and the condensed flags;
-    /// a plain rumble write (haptics-select but a silent audio region — every SDL rumble) does
-    /// NOT — that is what `parse_output_respects_valid_flags` pins with its `hidout.is_empty()`.
-    #[test]
-    fn parse_output_surfaces_audio_ctl() {
-        let mut data = vec![0u8; 48];
-        data[0] = 0x02;
-        data[1] = 0xB2; // flag0: haptics-select (BIT1) + audio-valid bits 4/5/7
-        data[5] = 0x50; // headphone volume
-        data[6] = 0x60; // speaker volume
-        data[7] = 0x70; // mic volume
-        data[8] = 0x05; // audio routing / enable bits
-        let mut fb = DsFeedback::default();
-        parse_ds_output(3, &data, &mut fb);
-        // flags: bit0 = flag0 bit1, bits1..4 = flag0 bits 4..7 (0b1011 → 0b10110).
-        assert_eq!(
-            fb.hidout,
-            vec![HidOutput::AudioCtl {
-                pad: 3,
-                flags: 0b1_0111,
-                raw: [0x50, 0x60, 0x70, 0x05, 0x00, 0x00],
-            }]
-        );
-        // A non-zero audio region with NO audio-valid flags still surfaces (dedup collapses the
-        // repeats downstream) — some writers leave stale volumes gated off; the host side wants
-        // the honest bytes either way.
-        let mut data = vec![0u8; 48];
-        data[0] = 0x02;
-        data[9] = 0x01;
-        let mut fb = DsFeedback::default();
-        parse_ds_output(0, &data, &mut fb);
-        assert_eq!(
-            fb.hidout,
-            vec![HidOutput::AudioCtl {
-                pad: 0,
-                flags: 0,
-                raw: [0, 0, 0, 0, 0x01, 0],
-            }]
-        );
-    }
-
     /// A short / wrong-id report yields nothing.
     #[test]
     fn parse_output_rejects_garbage() {

crates/pf-inject/src/inject/uhid_manager.rs

@@ -518,7 +518,6 @@ mod tests {
             index: 2,
             kind: 1,
             capabilities: 0,
-            audio_caps: 0,
         });
         assert!(m.slots.get(2).is_some());
     }

crates/punktfunk-core/src/abi.rs

@@ -670,12 +670,6 @@ pub const PUNKTFUNK_HIDOUT_TRIGGER: u8 = 3;
 /// side (0 = right pad, 1 = left pad); `effect[0..6]` packs `amplitude` / `period` / `count` as
 /// little-endian `u16`s with `effect_len = 6`. Clients without trackpad coils drop it.
 pub const PUNKTFUNK_HIDOUT_TRACKPAD_HAPTIC: u8 = 4;
-/// `PunktfunkHidOutput::kind` — the audio-control region of a DS5 output report (pad-audio
-/// routing/volumes; the audio SAMPLES arrive via [`punktfunk_connection_next_pad_audio`]).
-/// `which` = the condensed audio flags (bit0 = haptics-select, bits1..4 = the report's
-/// audio-valid flags); `effect[0..6]` = bytes 5..=10 of the report verbatim
-/// (headphone/speaker/mic volumes + routing) with `effect_len = 6`. Forwarded change-only.
-pub const PUNKTFUNK_HIDOUT_AUDIO_CTL: u8 = 5;
 /// Capacity of `PunktfunkHidOutput::effect` (the DualSense trigger parameter block).
 pub const PUNKTFUNK_HID_EFFECT_MAX: u8 = 11;
 
@@ -768,17 +762,6 @@ impl PunktfunkHidOutput {
                 out.effect_len = 6;
             }
             HidOutput::HidRaw { .. } => return None,
-            HidOutput::AudioCtl { pad, flags, raw } => {
-                // Same packing idiom as TrackpadHaptic: `which` carries the flags byte,
-                // `effect[0..6]` the raw audio region. The u16 wire pad narrows losslessly
-                // because `HidOutput::decode` refuses one at or above `input::MAX_PADS` (B27) —
-                // it is enforced there, not merely assumed here.
-                out.kind = PUNKTFUNK_HIDOUT_AUDIO_CTL;
-                out.pad = *pad as u8;
-                out.which = *flags;
-                out.effect[0..6].copy_from_slice(raw);
-                out.effect_len = 6;
-            }
         }
         Some(out)
     }
@@ -1192,25 +1175,6 @@ pub const PUNKTFUNK_HOST_CAP_CLIPBOARD: u8 = 0x02;
 /// the client keeps its pen-as-touch fallback. (Mirrors `quic::HOST_CAP_PEN`;
 /// design/pen-tablet-input.md.)
 pub const PUNKTFUNK_HOST_CAP_PEN: u8 = 0x10;
-/// Host-capability bit in [`punktfunk_connection_host_caps`]: the host can capture per-gamepad
-/// audio (DualSense voice-coil haptics + speaker) and emit it on the 0xD1 plane toward pads
-/// declared capable via [`punktfunk_connection_set_pad_audio_caps`]. Set only when the client
-/// asked via [`PUNKTFUNK_CLIENT_CAP_PAD_AUDIO`]. (Mirrors `quic::HOST_CAP_PAD_AUDIO`.)
-pub const PUNKTFUNK_HOST_CAP_PAD_AUDIO: u8 = 0x40;
-
-/// Pad-audio `kind` ([`punktfunk_connection_next_pad_audio`]): the BACK channel pair — DualSense
-/// voice-coil haptics, 5 ms Opus frames. (Mirrors `quic::PAD_AUDIO_KIND_HAPTICS`.)
-pub const PUNKTFUNK_PAD_AUDIO_KIND_HAPTICS: u8 = 0;
-/// Pad-audio `kind`: the FRONT channel pair — the controller's built-in speaker, 10 ms Opus
-/// frames. (Mirrors `quic::PAD_AUDIO_KIND_SPEAKER`.)
-pub const PUNKTFUNK_PAD_AUDIO_KIND_SPEAKER: u8 = 1;
-
-/// [`punktfunk_connection_set_pad_audio_caps`] `audio_caps` bit: the pad renders the HAPTICS
-/// stream (a real DualSense's voice coils).
-pub const PUNKTFUNK_PAD_AUDIO_CAP_HAPTICS: u8 = 0x01;
-/// [`punktfunk_connection_set_pad_audio_caps`] `audio_caps` bit: the pad renders the SPEAKER
-/// stream.
-pub const PUNKTFUNK_PAD_AUDIO_CAP_SPEAKER: u8 = 0x02;
 
 // Keep the ABI cap bits in lockstep with the wire constants (compile-time guard against drift).
 #[cfg(feature = "quic")]
@@ -1225,20 +1189,6 @@ const _: () = {
     assert!(PUNKTFUNK_HOST_CAP_GAMEPAD_STATE == crate::quic::HOST_CAP_GAMEPAD_STATE);
     assert!(PUNKTFUNK_HOST_CAP_CLIPBOARD == crate::quic::HOST_CAP_CLIPBOARD);
     assert!(PUNKTFUNK_HOST_CAP_PEN == crate::quic::HOST_CAP_PEN);
-    assert!(PUNKTFUNK_HOST_CAP_PAD_AUDIO == crate::quic::HOST_CAP_PAD_AUDIO);
-    assert!(PUNKTFUNK_CLIENT_CAP_PAD_AUDIO == crate::quic::CLIENT_CAP_PAD_AUDIO);
-    assert!(PUNKTFUNK_PAD_AUDIO_KIND_HAPTICS == crate::quic::PAD_AUDIO_KIND_HAPTICS);
-    assert!(PUNKTFUNK_PAD_AUDIO_KIND_SPEAKER == crate::quic::PAD_AUDIO_KIND_SPEAKER);
-    // The setter's caps bits are the arrival flags bits 8/9 shifted down (the wire packing
-    // `input::encode_gamepad_arrival` applies).
-    assert!(
-        (PUNKTFUNK_PAD_AUDIO_CAP_HAPTICS as u32) << 8
-            == crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS
-    );
-    assert!(
-        (PUNKTFUNK_PAD_AUDIO_CAP_SPEAKER as u32) << 8
-            == crate::input::ARRIVAL_FLAG_PAD_AUDIO_SPEAKER
-    );
     assert!(PUNKTFUNK_PEN_IN_RANGE == crate::quic::PEN_IN_RANGE);
     assert!(PUNKTFUNK_PEN_TOUCHING == crate::quic::PEN_TOUCHING);
     assert!(PUNKTFUNK_PEN_BARREL1 == crate::quic::PEN_BARREL1);
@@ -1821,13 +1771,6 @@ pub const PUNKTFUNK_CLIENT_CAP_CURSOR: u8 = 0x01;
 /// forward-compatible.
 pub const PUNKTFUNK_CLIENT_CAP_PHASE_LOCK: u8 = 0x02;
 
-/// [`punktfunk_connect_ex9`] `client_caps` bit: the client understands the pad-audio plane
-/// (0xD1 — per-gamepad DualSense voice-coil haptics + speaker). The embedder MUST then drain
-/// [`punktfunk_connection_next_pad_audio`] and declare each capable pad via
-/// [`punktfunk_connection_set_pad_audio_caps`]; the host emits pad audio only when it answers
-/// with [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`]. (Mirrors `quic::CLIENT_CAP_PAD_AUDIO`.)
-pub const PUNKTFUNK_CLIENT_CAP_PAD_AUDIO: u8 = 0x08;
-
 /// Shared body of [`punktfunk_connect_ex7`] / [`punktfunk_connect_ex8`]: `status_out`
 /// (nullable) is written on EVERY path — `Ok`, the mapped [`PunktfunkError`],
 /// `InvalidArg` for bad arguments, `Panic` if the connect panicked.
@@ -2372,117 +2315,6 @@ pub unsafe extern "C" fn punktfunk_connection_next_audio_pcm(
     })
 }
 
-/// Pull the next pad-audio frame (0xD1) — one Opus frame of DualSense voice-coil haptics
-/// (`kind` = [`PUNKTFUNK_PAD_AUDIO_KIND_HAPTICS`], 5 ms) or built-in-speaker audio
-/// ([`PUNKTFUNK_PAD_AUDIO_KIND_SPEAKER`], 10 ms) for gamepad `*out_pad` — waiting up to
-/// `timeout_ms`. The payload is COPIED into `buf` (no borrow-until-next-call slot); the return
-/// value is its length in bytes, `0` = nothing this poll (timeout — or a DTX/oversized frame,
-/// both of which an embedder treats the same way), `-1` = the session ended (or an invalid
-/// handle/buffer). All pads/kinds share one queue — fan out by `*out_pad`/`*out_kind` to
-/// per-actuator Opus decoders. A frame larger than `buf_len` is dropped like the timeout case
-/// (the plane is lossy by design; any real Opus frame fits a 1500-byte buffer). Only a session
-/// connected with [`PUNKTFUNK_CLIENT_CAP_PAD_AUDIO`] against a
-/// [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`] host — with the pad declared via
-/// [`punktfunk_connection_set_pad_audio_caps`] — ever receives any. Drain from a dedicated
-/// thread (one puller, may run alongside the other planes' pullers).
-///
-/// # Safety
-/// `c` is a valid connection handle; the `out_*` pointers are writable (NULLs are skipped);
-/// `buf` is writable for `buf_len` bytes.
-#[cfg(feature = "quic")]
-#[no_mangle]
-pub unsafe extern "C" fn punktfunk_connection_next_pad_audio(
-    c: *mut PunktfunkConnection,
-    out_pad: *mut u8,
-    out_kind: *mut u8,
-    out_seq: *mut u32,
-    out_pts_ns: *mut u64,
-    buf: *mut u8,
-    buf_len: usize,
-    timeout_ms: u32,
-) -> i32 {
-    let r = std::panic::catch_unwind(AssertUnwindSafe(|| {
-        // SAFETY: per the ABI contract - an opaque handle from a `*_new`/`*_pair` that the caller
-        // has not yet freed, or null, which `as_mut`/`as_ref` reports as `None` and the `match`
-        // here handles.
-        let c = match unsafe { c.as_ref() } {
-            Some(c) => c,
-            None => return -1,
-        };
-        if buf.is_null() && buf_len != 0 {
-            return -1;
-        }
-        match c
-            .inner
-            .next_pad_audio(std::time::Duration::from_millis(timeout_ms as u64))
-        {
-            Some(f) => {
-                if f.opus.is_empty() || f.opus.len() > buf_len {
-                    // DTX silence (skipped like the audio-PCM path — decoding an empty payload
-                    // as loss would synthesize concealment) or doesn't fit — report "nothing
-                    // this poll" (the next_hidout HidRaw-skip precedent; truncated Opus would
-                    // be undecodable anyway).
-                    return 0;
-                }
-                // SAFETY: per the ABI contract - each out-param below is OPTIONAL, so it is null-
-                // checked before it is written; `buf` is a caller-owned writable region of
-                // `buf_len` bytes and the copy length was just bounds-checked against it.
-                unsafe {
-                    if !out_pad.is_null() {
-                        *out_pad = f.pad;
-                    }
-                    if !out_kind.is_null() {
-                        *out_kind = f.kind;
-                    }
-                    if !out_seq.is_null() {
-                        *out_seq = f.seq;
-                    }
-                    if !out_pts_ns.is_null() {
-                        *out_pts_ns = f.pts_ns;
-                    }
-                    std::ptr::copy_nonoverlapping(f.opus.as_ptr(), buf, f.opus.len());
-                }
-                f.opus.len() as i32
-            }
-            // `None` folds timeout and closed; the shutdown flag tells them apart so the
-            // embedder's plane loop can exit instead of polling a dead session forever.
-            None if c.inner.is_session_ended() => -1,
-            None => 0,
-        }
-    }));
-    r.unwrap_or(-1)
-}
-
-/// Declare wire pad `pad`'s pad-audio render capabilities (`audio_caps`: OR of
-/// [`PUNKTFUNK_PAD_AUDIO_CAP_HAPTICS`] / [`PUNKTFUNK_PAD_AUDIO_CAP_SPEAKER`]) — how a client
-/// tells the host WHICH pads can actually play the 0xD1 streams. Call at controller attach,
-/// BEFORE the pad's arrival event is sent (the [`punktfunk_connection_set_rumble_quirks`]
-/// timing): the core folds the bits into the arrival's flags (bits 8/9), and only toward a
-/// [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`] host — never calling this leaves the wire bytes exactly as
-/// before. Latest-wins per pad; unknown bits are masked off.
-///
-/// # Safety
-/// `c` is a valid connection handle. Callable from any thread.
-#[cfg(feature = "quic")]
-#[no_mangle]
-pub unsafe extern "C" fn punktfunk_connection_set_pad_audio_caps(
-    c: *mut PunktfunkConnection,
-    pad: u8,
-    audio_caps: u8,
-) -> PunktfunkStatus {
-    guard(|| {
-        // SAFETY: per the ABI contract - an opaque handle from a `*_new`/`*_pair` that the caller
-        // has not yet freed, or null, which `as_mut`/`as_ref` reports as `None` and the `match`
-        // here handles.
-        let c = match unsafe { c.as_ref() } {
-            Some(c) => c,
-            None => return PunktfunkStatus::NullPointer,
-        };
-        c.inner.set_pad_audio_caps(pad, audio_caps);
-        PunktfunkStatus::Ok
-    })
-}
-
 /// Pull the next rumble (force-feedback) update, waiting up to `timeout_ms`. Amplitudes
 /// are 0..0xFFFF (`low` = low-frequency motor, `high` = high-frequency), `(0, 0)` = stop.
 /// Same timeout/closed semantics as [`punktfunk_connection_next_audio`].
@@ -4585,36 +4417,3 @@ pub unsafe extern "C" fn punktfunk_reanchor_gate_is_holding(
         PunktfunkStatus::Ok
     })
 }
-
-#[cfg(all(test, feature = "quic"))]
-mod tests {
-    use super::*;
-
-    /// The `AudioCtl` → `PunktfunkHidOutput` mapping: kind 5, pad narrowed, `which` carries the
-    /// flags byte, `effect[0..6]` the raw audio region with `effect_len = 6` (the TrackpadHaptic
-    /// packing idiom — no struct growth, so the size guard above stays at 19).
-    #[test]
-    fn hidout_abi_maps_audio_ctl() {
-        let out = PunktfunkHidOutput::from_hid(&crate::quic::HidOutput::AudioCtl {
-            pad: 3,
-            flags: 0x17,
-            raw: [0x50, 0x60, 0x70, 0x05, 0, 0],
-        })
-        .unwrap();
-        assert_eq!(out.kind, PUNKTFUNK_HIDOUT_AUDIO_CTL);
-        assert_eq!(out.pad, 3);
-        assert_eq!(out.which, 0x17);
-        assert_eq!(out.effect_len, 6);
-        assert_eq!(out.effect[..6], [0x50, 0x60, 0x70, 0x05, 0, 0]);
-        assert_eq!(out.effect[6..], [0; 5]);
-        // A raw passthrough report still has no C representation (skipped at the pull site).
-        assert!(
-            PunktfunkHidOutput::from_hid(&crate::quic::HidOutput::HidRaw {
-                pad: 0,
-                kind: 0,
-                data: vec![0x80],
-            })
-            .is_none()
-        );
-    }
-}

crates/punktfunk-core/src/abr.rs

@@ -159,17 +159,6 @@ const CAP_REPROBE_WINDOWS_MAX: u32 = 128;
 /// choke again at the same place, and only backoffs at a climbed-to rate can agree within the
 /// band (a cascade's second backoff sits at ×0.7 of the first: outside it by construction).
 const DECODE_CAP_SIMILAR_DIV: u32 = 8;
-/// A deciding window that DELIVERED under `current / STARVED_DELIVERY_DIV` is STARVED: the
-/// stream barely flowed (a host-side capture stall, an outage, a mid-window pause), so whatever
-/// distress the window carries — a flush, a keyframe-ask burst — is starvation-shaped, not
-/// rate-shaped, and the decoder decoded almost nothing at the nominal rate. Such a window may
-/// still back off (real damage deserves the safe response) but must never be a decode-knee
-/// sample: latching `current_kbps` off a starved window teaches a phantom decoder cap at
-/// whatever rate the stall interrupted (the periodic-capture-stall field case: every 5 s cycle
-/// offers another pair of "backoffs" at the same rate — a bogus latch that then fights the
-/// re-probe ladder for minutes). Deliberately far below the ×¾ utilization bar climbs require:
-/// the band between them is ambiguous and keeps today's behavior.
-const STARVED_DELIVERY_DIV: u32 = 4;
 /// Rolling window (in 750 ms report windows, ~30 s) whose minimum mean is the OWD baseline.
 /// Long enough to remember the uncongested floor, short enough to follow genuine path changes.
 const BASELINE_WINDOWS: usize = 40;
@@ -708,10 +697,6 @@ impl BitrateController {
                 || self.streak_decode_windows >= BAD_WINDOWS_TO_DECREASE
                 || (recovery_kf >= RECOVERY_KF_BAD && loss_ppm < HEAVY_LOSS_PPM)
                 || (flushed && (decode_bad || decode_mean_us.is_none()));
-            // Starved deciding window (see [`STARVED_DELIVERY_DIV`]): the stream barely flowed,
-            // so the window says nothing about what the decoder can hold at this rate.
-            let starved =
-                (actual_kbps as u64) * (STARVED_DELIVERY_DIV as u64) < self.current_kbps as u64;
             if !self.climb_since_backoff {
                 // Still draining the previous backoff: the host acks a ×0.7 request in ~100 ms,
                 // so this window's rate is one the decoder never choked at while keeping up —
@@ -723,17 +708,6 @@ impl BitrateController {
                     "adaptive bitrate: backoff without an intervening climb — draining the \
                      previous choke, not a knee sample"
                 );
-            } else if starved {
-                // Same "not a knee sample either way" treatment as the draining arm: neither
-                // latch against a starved window nor let it erase the reference a real knee
-                // set — the next genuine choke at that rate must still find its pair.
-                tracing::debug!(
-                    at_kbps = self.current_kbps,
-                    actual_kbps,
-                    reference_kbps = self.decode_backoff_kbps,
-                    "adaptive bitrate: backoff in a starved window (delivery a fraction of \
-                     the target) — starvation-shaped distress, not a knee sample"
-                );
             } else if decode_evidence {
                 let rate = self.current_kbps;
                 let similar = self.decode_backoff_kbps > 0
@@ -2110,100 +2084,6 @@ mod tests {
         rate - rate / 16
     }
 
-    /// One capture-stall-shaped window at the current rate: almost nothing delivered
-    /// (current/10), nothing decoded, no loss — but a jump-to-live flush and a keyframe-ask
-    /// storm (the stall edge's damage signature). SEVERE, so it backs off; STARVED, so it must
-    /// never be a knee sample.
-    fn stall_choke(c: &mut BitrateController, start: Instant, tick: &mut u32) -> Option<u32> {
-        *tick += 2;
-        let r = c.on_window(
-            ticks(start, *tick),
-            0,
-            0,
-            None,
-            None,
-            None,
-            c.current_kbps / 10,
-            true,
-            RECOVERY_KF_SEVERE,
-        );
-        *tick += 1;
-        r
-    }
-
-    #[test]
-    fn capture_stall_windows_never_latch_a_decode_cap() {
-        // The periodic-capture-stall field case (RDNA4 standby-sink, 5 s cycle): every stall
-        // edge offers another flush + kf-storm "backoff" at the SAME rate — without the starved
-        // guard that pair latches a phantom decoder knee at whatever rate the display driver
-        // happened to interrupt, and the session then fights the re-probe ladder for minutes.
-        let mut c = BitrateController::new(240_000);
-        c.set_ceiling(900_000);
-        let start = Instant::now();
-        let mut t = 0;
-        for _ in 0..4 {
-            calm_window(&mut c, ticks(start, t));
-            t += 1;
-        }
-        climb_to(&mut c, start, &mut t, 400_000);
-        let at = c.current_kbps;
-        let r1 = stall_choke(&mut c, start, &mut t).expect("stall damage still backs off");
-        assert!(
-            c.decode_cap_kbps.is_none(),
-            "one starved window must not latch"
-        );
-        assert_eq!(
-            c.decode_backoff_kbps, 0,
-            "a starved window is not a knee sample — no reference recorded"
-        );
-        c.on_ack(r1);
-        climb_to(&mut c, start, &mut t, at - at / DECODE_CAP_SIMILAR_DIV);
-        let r2 = stall_choke(&mut c, start, &mut t).expect("second stall edge backs off too");
-        c.on_ack(r2);
-        assert!(
-            c.decode_cap_kbps.is_none(),
-            "a starved pair at the same rate must not latch a phantom knee"
-        );
-    }
-
-    #[test]
-    fn starved_window_preserves_the_knee_reference() {
-        // A REAL knee sample, then a stall edge, then the genuine re-climb choke: the starved
-        // window in the middle must neither latch nor ERASE the reference the real choke set —
-        // the genuine pair must still find each other around it.
-        let mut c = BitrateController::new(500_000);
-        c.set_ceiling(900_000);
-        let start = Instant::now();
-        let mut t = 0;
-        for _ in 0..4 {
-            calm_window(&mut c, ticks(start, t));
-            t += 1;
-        }
-        let knee = c.current_kbps;
-        let r1 = choke(&mut c, start, &mut t).expect("real choke backs off");
-        assert_eq!(
-            c.decode_backoff_kbps, knee,
-            "real choke records the reference"
-        );
-        c.on_ack(r1);
-        climb_to(&mut c, start, &mut t, knee - knee / DECODE_CAP_SIMILAR_DIV);
-        let r2 = stall_choke(&mut c, start, &mut t).expect("stall edge backs off");
-        assert_eq!(
-            c.decode_backoff_kbps, knee,
-            "the starved window must not erase the real reference"
-        );
-        assert!(c.decode_cap_kbps.is_none(), "and must not latch against it");
-        c.on_ack(r2);
-        climb_to(&mut c, start, &mut t, knee - knee / DECODE_CAP_SIMILAR_DIV);
-        let rate = c.current_kbps;
-        choke(&mut c, start, &mut t).expect("genuine re-climb choke backs off");
-        assert_eq!(
-            c.decode_cap_kbps,
-            Some(rate - rate / 16),
-            "the genuine pair still latches around the starved interruption"
-        );
-    }
-
     #[test]
     fn decode_cap_latches_when_the_reclimb_chokes_at_the_same_knee() {
         // The 1440p120 field sawtooth: a decoder knee (~500 Mbps) well under the (inflated)

crates/punktfunk-core/src/client/mod.rs

@@ -16,13 +16,11 @@ use crate::config::{CompositorPref, GamepadPref, Mode};
 use crate::error::{PunktfunkError, Result};
 use crate::input::InputEvent;
 use crate::quic::{
-    endpoint, ClipControl, ClipKind, ClipOffer, ColorInfo, HdrMeta, HidOutput, PadAudioFrame,
-    ProbeRequest, RfiRequest, RichInput,
+    endpoint, ClipControl, ClipKind, ClipOffer, ColorInfo, HdrMeta, HidOutput, ProbeRequest,
+    RfiRequest, RichInput,
 };
 use crate::session::Frame;
-use std::sync::atomic::{
-    AtomicBool, AtomicI64, AtomicU16, AtomicU32, AtomicU64, AtomicU8, Ordering,
-};
+use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU16, AtomicU32, AtomicU64, Ordering};
 use std::sync::mpsc::{Receiver, RecvTimeoutError};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
@@ -45,7 +43,7 @@ use self::control::{CtrlRequest, Negotiated};
 use self::frame_channel::{DecodeLatAcc, FrameChannel, FramePop};
 use self::planes::{
     RumbleUpdate, AUDIO_QUEUE, CLIP_EVENT_QUEUE, CURSOR_SHAPE_QUEUE, CURSOR_STATE_QUEUE,
-    HDR_META_QUEUE, HIDOUT_QUEUE, HOST_TIMING_QUEUE, PAD_AUDIO_QUEUE, RUMBLE_QUEUE,
+    HDR_META_QUEUE, HIDOUT_QUEUE, HOST_TIMING_QUEUE, RUMBLE_QUEUE,
 };
 use self::probe::ProbeState;
 use self::pump::run_pump;
@@ -124,14 +122,6 @@ pub struct NativeClient {
     rumble_sched: Arc<rumble::RumbleShared>,
     /// Inbound DualSense feedback (lightbar / player LEDs / adaptive triggers) — 0xCD datagrams.
     hidout: Mutex<Receiver<HidOutput>>,
-    /// Inbound pad audio (DualSense voice-coil haptics + speaker Opus frames) — 0xD1 datagrams.
-    /// Only a session that advertised [`quic::CLIENT_CAP_PAD_AUDIO`] against a
-    /// [`quic::HOST_CAP_PAD_AUDIO`] host ever receives any.
-    pad_audio: Mutex<Receiver<PadAudioFrame>>,
-    /// Per-pad pad-audio render capabilities (bit0 haptics, bit1 speaker), written by
-    /// [`NativeClient::set_pad_audio_caps`] and OR'd into outgoing gamepad-arrival flags
-    /// (bits 8/9) by the worker's input task — toward a `HOST_CAP_PAD_AUDIO` host only.
-    pad_audio_caps: Arc<[AtomicU8; crate::input::MAX_PADS]>,
     /// Inbound static HDR metadata (ST.2086 mastering + content light level) — 0xCE datagrams.
     hdr_meta: Mutex<Receiver<HdrMeta>>,
     /// Inbound per-AU host capture→send timings — 0xCF datagrams (the client always advertises
@@ -428,10 +418,6 @@ impl NativeClient {
         let rumble_sched = Arc::new(rumble::RumbleShared::new());
         let rumble_feed = rumble::RumbleFeed(rumble_sched.clone());
         let (hidout_tx, hidout_rx) = std::sync::mpsc::sync_channel::<HidOutput>(HIDOUT_QUEUE);
-        let (pad_audio_tx, pad_audio_rx) =
-            std::sync::mpsc::sync_channel::<PadAudioFrame>(PAD_AUDIO_QUEUE);
-        let pad_audio_caps: Arc<[AtomicU8; crate::input::MAX_PADS]> =
-            Arc::new(std::array::from_fn(|_| AtomicU8::new(0)));
         let (hdr_meta_tx, hdr_meta_rx) = std::sync::mpsc::sync_channel::<HdrMeta>(HDR_META_QUEUE);
         let (host_timing_tx, host_timing_rx) =
             std::sync::mpsc::sync_channel::<crate::quic::HostTiming>(HOST_TIMING_QUEUE);
@@ -473,7 +459,6 @@ impl NativeClient {
         let clock_offset_w = clock_offset.clone();
         let decode_lat_w = decode_lat.clone();
         let live_bitrate_w = live_bitrate.clone();
-        let pad_audio_caps_w = pad_audio_caps.clone();
         let ctrl_tx_pump = ctrl_tx.clone(); // the data-plane pump sends adaptive-FEC LossReports
         let worker = std::thread::Builder::new()
             .name("punktfunk-client".into())
@@ -523,8 +508,6 @@ impl NativeClient {
                     rumble_tx,
                     rumble_feed,
                     hidout_tx,
-                    pad_audio_tx,
-                    pad_audio_caps: pad_audio_caps_w,
                     hdr_meta_tx,
                     host_timing_tx,
                     cursor_shape_tx,
@@ -573,8 +556,6 @@ impl NativeClient {
             rumble: Mutex::new(rumble_rx),
             rumble_sched,
             hidout: Mutex::new(hidout_rx),
-            pad_audio: Mutex::new(pad_audio_rx),
-            pad_audio_caps,
             hdr_meta: Mutex::new(hdr_meta_rx),
             host_timing: Mutex::new(host_timing_rx),
             cursor_shape: Mutex::new(cursor_shape_rx),
@@ -1080,33 +1061,6 @@ impl NativeClient {
         }
     }
 
-    /// Pull the next pad-audio frame (0xD1): one Opus frame of DualSense voice-coil haptics
-    /// ([`quic::PAD_AUDIO_KIND_HAPTICS`], 5 ms) or built-in-speaker audio
-    /// ([`quic::PAD_AUDIO_KIND_SPEAKER`], 10 ms) for gamepad `pad`. All pads/kinds share the
-    /// queue — the embedder fans out by `pad`/`kind` to per-actuator Opus decoders. `None` on
-    /// timeout AND once the session ended ([`is_session_ended`](Self::is_session_ended)
-    /// distinguishes, and the plane is best-effort either way). Only a session that advertised
-    /// [`quic::CLIENT_CAP_PAD_AUDIO`] against a [`quic::HOST_CAP_PAD_AUDIO`] host — with the
-    /// pad's render caps declared via [`set_pad_audio_caps`](Self::set_pad_audio_caps) — ever
-    /// receives any. Drain on a dedicated thread like [`next_audio`](Self::next_audio); one
-    /// puller per the plane contract.
-    pub fn next_pad_audio(&self, timeout: Duration) -> Option<PadAudioFrame> {
-        self.pad_audio.lock().unwrap().recv_timeout(timeout).ok()
-    }
-
-    /// Declare wire pad `pad`'s pad-audio render capabilities: `audio_caps` bit0 = the pad can
-    /// play the HAPTICS stream (a real DualSense's voice coils), bit1 = the SPEAKER stream.
-    /// Call at controller attach, BEFORE the pad's arrival is sent (like
-    /// [`set_rumble_quirks`](Self::set_rumble_quirks)) — the worker ORs the bits into the
-    /// arrival's flags (bits 8/9), and only toward a [`quic::HOST_CAP_PAD_AUDIO`] host, so an
-    /// embedder that never calls this (or a host that can't capture pad audio) leaves the wire
-    /// bytes exactly as before. Latest-wins per pad; unknown bits are masked off.
-    pub fn set_pad_audio_caps(&self, pad: u8, audio_caps: u8) {
-        if let Some(slot) = self.pad_audio_caps.get(pad as usize) {
-            slot.store(audio_caps & 0x03, Ordering::Relaxed);
-        }
-    }
-
     /// Pull the next static HDR metadata update (ST.2086 mastering display + content light level)
     /// the host sent for an HDR session; same timeout/closed semantics as
     /// [`NativeClient::next_hidout`]. The host sends one near session start and re-sends it on

crates/punktfunk-core/src/client/planes.rs

@@ -20,12 +20,6 @@ pub(crate) type RumbleUpdate = (u16, u16, u16, Option<u16>);
 /// Same overflow discipline as rumble; the host re-sends on the next feedback change.
 pub(crate) const HIDOUT_QUEUE: usize = 32;
 
-/// Pad-audio frames (`0xD1` — DualSense voice-coil haptics + speaker) buffered for the embedder,
-/// ALL pads and kinds on one queue (the embedder fans out by `pad`/`kind`): 64 × 5 ms = 320 ms of
-/// slack on a haptics-only stream, the [`AUDIO_QUEUE`] discipline. A lagging embedder drops the
-/// newest frame (the renderer conceals the gap).
-pub(crate) const PAD_AUDIO_QUEUE: usize = 64;
-
 /// Static HDR metadata (ST.2086 mastering + content light level) buffered for the embedder. Tiny
 /// and low-rate (one on start, re-sent on mastering changes / keyframes); a small ring is ample.
 pub(crate) const HDR_META_QUEUE: usize = 8;

crates/punktfunk-core/src/client/pump.rs

@@ -50,8 +50,6 @@ pub(super) async fn run_pump(args: WorkerArgs) {
         rumble_tx,
         rumble_feed,
         hidout_tx,
-        pad_audio_tx,
-        pad_audio_caps,
         hdr_meta_tx,
         host_timing_tx,
         cursor_shape_tx,
@@ -94,17 +92,9 @@ pub(super) async fn run_pump(args: WorkerArgs) {
 
     // Input task: embedder events → uplink datagrams, with per-transition gamepad events
     // folded into idempotent seq-stamped snapshots toward a HOST_CAP_GAMEPAD_STATE host
-    // (see [`input_task`]). Pad-audio render caps ride arrival flags bits 8/9 ONLY toward a
-    // HOST_CAP_PAD_AUDIO host — an older host reads the whole flags word as the pad index.
+    // (see [`input_task`]).
     let gamepad_snapshots = host_caps & crate::quic::HOST_CAP_GAMEPAD_STATE != 0;
-    let pad_audio_arrivals = host_caps & crate::quic::HOST_CAP_PAD_AUDIO != 0;
-    tokio::spawn(input_task::run(
-        conn.clone(),
-        input_rx,
-        gamepad_snapshots,
-        pad_audio_arrivals,
-        pad_audio_caps,
-    ));
+    tokio::spawn(input_task::run(conn.clone(), input_rx, gamepad_snapshots));
 
     // Mic task: embedder Opus mic frames → 0xCB uplink datagrams (best-effort, dropped on loss).
     // Self-healing latency bound: every frame still queued once this task catches up is standing
@@ -176,7 +166,6 @@ pub(super) async fn run_pump(args: WorkerArgs) {
         rumble_tx,
         rumble_feed,
         hidout_tx,
-        pad_audio_tx,
         hdr_meta_tx,
         host_timing_tx,
         encode_lat.clone(),

crates/punktfunk-core/src/client/pump/datagram_task.rs

@@ -12,7 +12,6 @@ pub(super) async fn run(
     rumble_tx: std::sync::mpsc::SyncSender<RumbleUpdate>,
     rumble_feed: super::super::rumble::RumbleFeed,
     hidout_tx: std::sync::mpsc::SyncSender<crate::quic::HidOutput>,
-    pad_audio_tx: std::sync::mpsc::SyncSender<crate::quic::PadAudioFrame>,
     hdr_meta_tx: std::sync::mpsc::SyncSender<crate::quic::HdrMeta>,
     host_timing_tx: std::sync::mpsc::SyncSender<crate::quic::HostTiming>,
     // The ABR encode signal's accumulator (see [`EncodeLatAcc`]) — fed HERE, not off
@@ -101,11 +100,6 @@ pub(super) async fn run(
                     let _ = hidout_tx.try_send(h);
                 }
             }
-            Some(&crate::quic::PAD_AUDIO_MAGIC) => {
-                if let Some(f) = crate::quic::decode_pad_audio_datagram(&d) {
-                    let _ = pad_audio_tx.try_send(f);
-                }
-            }
             Some(&crate::quic::HDR_META_MAGIC) => {
                 if let Some(m) = crate::quic::decode_hdr_meta_datagram(&d) {
                     let _ = hdr_meta_tx.try_send(m);

crates/punktfunk-core/src/client/pump/input_task.rs

@@ -15,16 +15,8 @@ pub(super) async fn run(
     conn: quinn::Connection,
     mut input_rx: tokio::sync::mpsc::UnboundedReceiver<InputEvent>,
     gamepad_snapshots: bool,
-    // Whether the host advertised HOST_CAP_PAD_AUDIO: only then do arrivals carry the per-pad
-    // audio-render bits (flags 8/9) — an older host reads the whole flags word as the pad index,
-    // so unexpected high bits would make it drop the kind declaration entirely.
-    pad_audio: bool,
-    // Per-pad audio-render capabilities (bit0 haptics, bit1 speaker), fed by the embedder via
-    // [`NativeClient::set_pad_audio_caps`] and by arrival events already carrying the bits.
-    pad_audio_caps: std::sync::Arc<[std::sync::atomic::AtomicU8; crate::input::MAX_PADS]>,
 ) {
     use crate::input::{GamepadSnapshot, InputKind, MAX_PADS};
-    use std::sync::atomic::Ordering;
     // Touched pads only: an entry appears on the first gamepad event for that index, so the
     // refresh never conjures a virtual pad the embedder didn't drive.
     let mut pads: [Option<GamepadSnapshot>; MAX_PADS] = [None; MAX_PADS];
@@ -45,28 +37,6 @@ pub(super) async fn run(
     const ARRIVAL_RESENDS: u8 = 2;
     let mut arrival: [Option<u8>; MAX_PADS] = [None; MAX_PADS];
     let mut arrival_owed: [u8; MAX_PADS] = [0; MAX_PADS];
-    // An arrival's outgoing flags word: the pad index, plus the pad's audio-render bits (8/9)
-    // toward a HOST_CAP_PAD_AUDIO host. With no declared caps (or an older host) this is
-    // byte-identical to the plain index — the pre-pad-audio wire.
-    // B7: the caps a pad's LAST arrival actually carried. `set_pad_audio_caps` only stores into
-    // the registry — it cannot reach this task — so a declaration that lands after the arrival
-    // burst has drained (the renderer commits the trade only once its sink opens, which is well
-    // past the two 100 ms ticks) used to never reach the host at all: the client believed it had
-    // pad audio and the host emitted nothing on 0xD1, silently, forever. Comparing this against
-    // the live registry on every tick re-arms the burst by itself, with no new plumbing and no
-    // extra traffic when nothing changed.
-    let mut arrival_caps_sent: [u8; MAX_PADS] = [0; MAX_PADS];
-    let caps_now = |idx: usize| -> u8 {
-        if pad_audio {
-            pad_audio_caps[idx].load(Ordering::Relaxed)
-        } else {
-            0
-        }
-    };
-    let arrival_flags = |idx: usize| -> u32 {
-        let caps = caps_now(idx);
-        crate::input::encode_gamepad_arrival(idx as u8, caps)
-    };
     let mut refresh = tokio::time::interval(Duration::from_millis(100));
     refresh.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
     loop {
@@ -111,56 +81,30 @@ pub(super) async fn run(
                     let _ = conn.send_datagram(rem.encode().to_vec().into());
                     continue;
                 }
-                if gamepad_snapshots && ev.kind == InputKind::GamepadArrival {
-                    // The index is the LOW BYTE only — bits 8/9 may carry the pad's audio-render
-                    // caps (an embedder building raw events; the `set_pad_audio_caps` registry is
-                    // the usual source). Fold event-carried bits into the registry so the re-send
-                    // burst keeps them, then send with the negotiation-gated flags word.
-                    let (pad, ev_caps) = crate::input::decode_gamepad_arrival(ev.flags);
-                    let idx = pad as usize;
-                    if idx < MAX_PADS {
-                        if ev_caps != 0 {
-                            pad_audio_caps[idx].fetch_or(ev_caps, Ordering::Relaxed);
-                        }
-                        // Remember the declared kind (`code`) and forward it, arming a re-send
-                        // burst so the host learns it before the pad's first frame even under loss.
-                        arrival[idx] = Some(ev.code as u8);
-                        arrival_owed[idx] = ARRIVAL_RESENDS;
-                        arrival_caps_sent[idx] = caps_now(idx);
-                        let arr = crate::input::InputEvent {
-                            flags: arrival_flags(idx),
-                            ..ev
-                        };
-                        let _ = conn.send_datagram(arr.encode().to_vec().into());
-                        continue;
-                    }
+                if gamepad_snapshots && ev.kind == InputKind::GamepadArrival && idx < MAX_PADS {
+                    // Remember the declared kind (`code`) and forward it, arming a re-send burst
+                    // so the host learns it before the pad's first frame even under loss.
+                    arrival[idx] = Some(ev.code as u8);
+                    arrival_owed[idx] = ARRIVAL_RESENDS;
+                    let _ = conn.send_datagram(ev.encode().to_vec().into());
+                    continue;
                 }
                 let _ = conn.send_datagram(ev.encode().to_vec().into());
             }
             _ = refresh.tick() => {
                 for idx in 0..MAX_PADS {
-                    // B7: caps declared after the burst drained — re-announce this pad's arrival.
-                    // Only for a pad that HAS an arrival (so it is a live, declared controller),
-                    // and only when the value actually moved, so a steady session sends nothing.
-                    if arrival[idx].is_some()
-                        && arrival_owed[idx] == 0
-                        && caps_now(idx) != arrival_caps_sent[idx]
-                    {
-                        arrival_owed[idx] = ARRIVAL_RESENDS;
-                    }
                     // Re-send an owed kind declaration (independent of whether the pad has state
                     // yet — it may be idle-but-connected). Idempotent on the host.
                     if arrival_owed[idx] > 0 {
                         if let Some(kind) = arrival[idx] {
                             arrival_owed[idx] -= 1;
-                            arrival_caps_sent[idx] = caps_now(idx);
                             let arr = crate::input::InputEvent {
                                 kind: InputKind::GamepadArrival,
                                 _pad: [0; 3],
                                 code: kind as u32,
                                 x: 0,
                                 y: 0,
-                                flags: arrival_flags(idx),
+                                flags: idx as u32,
                             };
                             let _ = conn.send_datagram(arr.encode().to_vec().into());
                         } else {

crates/punktfunk-core/src/client/worker.rs

@@ -5,8 +5,8 @@ use crate::clipboard::{ClipCommand, ClipEventCore};
 use crate::config::{CompositorPref, GamepadPref, Mode};
 use crate::error::Result;
 use crate::input::InputEvent;
-use crate::quic::{HdrMeta, HidOutput, PadAudioFrame};
-use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32, AtomicU64, AtomicU8};
+use crate::quic::{HdrMeta, HidOutput};
+use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32, AtomicU64};
 use std::sync::mpsc::SyncSender;
 use std::sync::{Arc, Mutex};
 
@@ -43,14 +43,6 @@ pub(crate) struct WorkerArgs {
     /// closed, so the command API always observes connection teardown.
     pub(crate) rumble_feed: super::rumble::RumbleFeed,
     pub(crate) hidout_tx: SyncSender<HidOutput>,
-    /// Inbound pad-audio frames (`0xD1` — DualSense voice-coil haptics + speaker), drained by
-    /// [`NativeClient::next_pad_audio`].
-    pub(crate) pad_audio_tx: SyncSender<PadAudioFrame>,
-    /// Per-pad pad-audio render capabilities (bit0 haptics, bit1 speaker), written by
-    /// [`NativeClient::set_pad_audio_caps`] and OR'd into outgoing
-    /// [`GamepadArrival`](crate::input::InputKind::GamepadArrival) flags (bits 8/9) by the input
-    /// task — toward a `HOST_CAP_PAD_AUDIO` host only.
-    pub(crate) pad_audio_caps: Arc<[AtomicU8; crate::input::MAX_PADS]>,
     pub(crate) hdr_meta_tx: SyncSender<HdrMeta>,
     pub(crate) host_timing_tx: SyncSender<crate::quic::HostTiming>,
     pub(crate) cursor_shape_tx: SyncSender<crate::quic::CursorShape>,

crates/punktfunk-core/src/input.rs

@@ -64,11 +64,7 @@ pub enum InputKind {
     GamepadRemove = 13,
     /// Declares which controller KIND a pad presents so a session can MIX types (pad 0 a
     /// DualSense, pad 1 an Xbox pad). `code` = the [`GamepadPref`](crate::config::GamepadPref)
-    /// wire byte, `flags` = pad index in the low byte plus the pad's render capabilities in bits
-    /// 8/9 ([`ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/[`ARRIVAL_FLAG_PAD_AUDIO_SPEAKER`] — sent only
-    /// toward a [`HOST_CAP_PAD_AUDIO`](crate::quic::HOST_CAP_PAD_AUDIO) host, so an older host
-    /// keeps reading the whole word as the index; hosts decode via [`decode_gamepad_arrival`]).
-    /// Sent when the client opens a pad slot — before that pad's
+    /// wire byte, `flags` = pad index. Sent when the client opens a pad slot — before that pad's
     /// first input — and re-sent a few times against datagram loss (like [`GamepadRemove`]). The
     /// host resolves the kind to a buildable backend and routes that pad's virtual device to it; a
     /// pad the client never declares (an older client, or a fully-lost declaration) falls back to
@@ -101,34 +97,6 @@ pub fn decode_gamepad_remove(flags: u32) -> (u8, u8) {
     (flags as u8, (flags >> 24) as u8)
 }
 
-/// [`InputKind::GamepadArrival`] `flags` bit: this pad renders pad-audio HAPTICS — it is (or
-/// forwards to) a real DualSense whose voice-coil actuators can play the
-/// [`PAD_AUDIO_KIND_HAPTICS`](crate::quic::PAD_AUDIO_KIND_HAPTICS) stream. Rides above the pad
-/// index byte; sent only toward a [`HOST_CAP_PAD_AUDIO`](crate::quic::HOST_CAP_PAD_AUDIO) host
-/// (an older host reads the whole `flags` word as the index, so unexpected high bits would make
-/// it drop the declaration).
-pub const ARRIVAL_FLAG_PAD_AUDIO_HAPTICS: u32 = 1 << 8;
-/// [`InputKind::GamepadArrival`] `flags` bit: this pad renders pad-audio SPEAKER — the
-/// [`PAD_AUDIO_KIND_SPEAKER`](crate::quic::PAD_AUDIO_KIND_SPEAKER) stream. Same wire discipline
-/// as [`ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`].
-pub const ARRIVAL_FLAG_PAD_AUDIO_SPEAKER: u32 = 1 << 9;
-
-/// Pack a [`InputKind::GamepadArrival`] `flags` word: the pad index in the low byte plus
-/// `audio_caps` (bit0 = haptics, bit1 = speaker) as bits 8/9. `audio_caps = 0` reproduces the
-/// pre-pad-audio wire bytes exactly.
-pub fn encode_gamepad_arrival(pad: u8, audio_caps: u8) -> u32 {
-    (pad as u32) | (((audio_caps & 0x03) as u32) << 8)
-}
-
-/// Unpack a [`InputKind::GamepadArrival`] `flags` word into `(pad, audio_caps)`. The pad index
-/// is `flags & 0xFF` — hosts MUST mask rather than take the whole word, or a capability bit
-/// reads as a phantom index; `audio_caps` is bits 8/9 (bit0 = haptics, bit1 = speaker — the
-/// [`ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/[`ARRIVAL_FLAG_PAD_AUDIO_SPEAKER`] bits shifted down).
-/// An old-format word (index only) yields `audio_caps = 0`.
-pub fn decode_gamepad_arrival(flags: u32) -> (u8, u8) {
-    (flags as u8, ((flags >> 8) & 0x03) as u8)
-}
-
 /// The gamepad wire contract for [`InputKind::GamepadButton`]/[`InputKind::GamepadAxis`].
 ///
 /// Everything follows the GameStream/XInput conventions end to end: buttons reuse
@@ -380,11 +348,6 @@ pub enum GamepadEvent {
         kind: u8,
         /// LI_CCAP_* bits (0x02 = rumble).
         capabilities: u16,
-        /// Pad-audio render capabilities from a NATIVE-plane arrival's `flags` bits 8/9
-        /// (bit0 = haptics, bit1 = speaker — see [`decode_gamepad_arrival`]). NOT a GameStream
-        /// LI_CCAP bit (that vocabulary lives in `capabilities`); the GameStream plane cannot
-        /// express pad audio and always sets `0`, as does an old client.
-        audio_caps: u8,
     },
 }
 
@@ -480,31 +443,6 @@ mod tests {
         assert_eq!((pad, seq), (9, 123));
     }
 
-    #[test]
-    fn gamepad_arrival_flags_roundtrip() {
-        // The capability bits ride bits 8/9; the index stays the low byte.
-        for (pad, caps) in [(0u8, 0u8), (3, 0b01), (15, 0b10), (7, 0b11)] {
-            let flags = encode_gamepad_arrival(pad, caps);
-            assert_eq!(decode_gamepad_arrival(flags), (pad, caps));
-            assert_eq!(flags & 0xFF, pad as u32);
-        }
-        assert_eq!(
-            encode_gamepad_arrival(2, 0b11),
-            2 | ARRIVAL_FLAG_PAD_AUDIO_HAPTICS | ARRIVAL_FLAG_PAD_AUDIO_SPEAKER
-        );
-        // Old-format compat both ways: a caps-less word (an old client, or a new one toward an
-        // old host) is byte-identical to the plain index, and decodes with caps 0.
-        assert_eq!(encode_gamepad_arrival(5, 0), 5);
-        assert_eq!(decode_gamepad_arrival(5), (5, 0));
-        // Undefined high bits (a future extension) never leak into the index OR the caps.
-        assert_eq!(
-            decode_gamepad_arrival(0xFFFF_0000 | (0b01 << 8) | 9),
-            (9, 1)
-        );
-        // encode masks unknown caps bits, so a sloppy embedder can't corrupt the index space.
-        assert_eq!(encode_gamepad_arrival(1, 0xFF), 1 | (0b11 << 8));
-    }
-
     #[test]
     fn gamepad_snapshot_roundtrip() {
         let s = GamepadSnapshot {

crates/punktfunk-core/src/lib.rs

@@ -132,13 +132,7 @@ pub use stats::Stats;
 /// says what it says — so v15 is the floor that *guarantees* them: at or above it the surface is
 /// present, below it an embedder must probe for the symbol. Purely a version statement; no code
 /// changed with this bump, and no wire change, so [`WIRE_VERSION`] is unchanged.
-/// v16: added the pad-audio client surface — `punktfunk_connection_next_pad_audio` (the 0xD1
-/// per-gamepad DualSense haptics/speaker plane) + `punktfunk_connection_set_pad_audio_caps` and
-/// the `PUNKTFUNK_CLIENT_CAP_PAD_AUDIO` / `PUNKTFUNK_HOST_CAP_PAD_AUDIO` mirrors. Additive and
-/// capability-gated end to end: the wire grows a new datagram tag (0xD1) an old client never
-/// receives (double-gated caps), a new 0xCD kind (0x06, dropped as unknown by old clients) and
-/// arrival flag bits 8/9 sent only toward a capable host, so [`WIRE_VERSION`] is unchanged.
-pub const ABI_VERSION: u32 = 16;
+pub const ABI_VERSION: u32 = 15;
 
 /// The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
 /// Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**

crates/punktfunk-core/src/quic/caps.rs

@@ -121,15 +121,6 @@ pub const CLIENT_CAP_PHASE_LOCK: u8 = 0x02;
 /// clean, the client keeps receiving the plain `0xC9` plane — so a client may always set this bit.
 /// `0x04` — `0x01`/`0x02` are cursor / phase-lock.
 pub const CLIENT_CAP_AUDIO_RED: u8 = 0x04;
-/// [`Hello::client_caps`] bit: the client understands the pad-audio plane
-/// ([`PAD_AUDIO_MAGIC`](super::datagram::PAD_AUDIO_MAGIC), `0xD1`) — per-gamepad DualSense
-/// voice-coil haptics + speaker Opus frames, plus the [`HidOutput::AudioCtl`]
-/// (super::datagram::HidOutput) routing/volume events. Active only when the host answers with
-/// [`HOST_CAP_PAD_AUDIO`] AND the pad's arrival declared a renderer for the kind
-/// ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`) — the capable-and-agreed
-/// precedent, per pad; toward an older or incapable host nothing changes. `0x08` — `0x01` is [`CLIENT_CAP_CURSOR`],
-/// `0x02` is [`CLIENT_CAP_PHASE_LOCK`], `0x04` is [`CLIENT_CAP_AUDIO_RED`].
-pub const CLIENT_CAP_PAD_AUDIO: u8 = 0x08;
 
 /// [`Welcome::host_caps`] bit: the host CAN forward the cursor out-of-band (it captures cursor
 /// metadata separately from the frame — the Linux portal `SPA_META_Cursor` path; NOT gamescope,
@@ -163,16 +154,6 @@ pub const HOST_CAP_PEN: u8 = 0x10;
 /// unconditionally and treat this bit as "expect redundancy", not "only redundancy".
 /// `0x20` — `0x10` is [`HOST_CAP_PEN`], `0x08` is [`HOST_CAP_CURSOR`].
 pub const HOST_CAP_AUDIO_RED: u8 = 0x20;
-/// [`Welcome::host_caps`] bit: the host can capture pad audio — its virtual DualSense exposes
-/// the pad's audio endpoints (voice-coil haptics + speaker), so a game's per-pad audio can be
-/// captured and shipped on the [`PAD_AUDIO_MAGIC`](super::datagram::PAD_AUDIO_MAGIC) plane.
-/// Set only when the client asked via [`CLIENT_CAP_PAD_AUDIO`]; when both bits agree, a
-/// capable client marks its pads' render capabilities on their arrivals
-/// ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`) and the host emits `0xD1`
-/// toward exactly those pads. `0x40` — `0x20` is [`HOST_CAP_AUDIO_RED`], `0x10` is
-/// [`HOST_CAP_PEN`], `0x08` is [`HOST_CAP_CURSOR`], `0x04` is [`HOST_CAP_TEXT_INPUT`],
-/// `0x01`/`0x02` are gamepad-state / clipboard.
-pub const HOST_CAP_PAD_AUDIO: u8 = 0x40;
 
 /// [`Hello::video_codecs`] bit: the client can decode H.264 / AVC. The GPU-less **software**
 /// encode path (openh264) emits H.264, so a client that wants to stream from a software host MUST
@@ -356,28 +337,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn pad_audio_cap_bits_are_distinct() {
-        // The new pad-audio bits pack into the existing caps bytes without colliding with any
-        // taken bit (a collision would silently negotiate an unrelated feature).
-        assert_eq!(
-            CLIENT_CAP_PAD_AUDIO & (CLIENT_CAP_CURSOR | CLIENT_CAP_PHASE_LOCK),
-            0
-        );
-        assert_eq!(
-            HOST_CAP_PAD_AUDIO
-                & (HOST_CAP_GAMEPAD_STATE
-                    | HOST_CAP_CLIPBOARD
-                    | HOST_CAP_TEXT_INPUT
-                    | HOST_CAP_CURSOR
-                    | HOST_CAP_PEN),
-            0
-        );
-        // Single-bit values (a multi-bit cap would OR neighbours in).
-        assert_eq!(CLIENT_CAP_PAD_AUDIO.count_ones(), 1);
-        assert_eq!(HOST_CAP_PAD_AUDIO.count_ones(), 1);
-    }
-
     #[test]
     fn resolve_codec_canonicalizes_a_multi_bit_preference() {
         // A non-conformant peer may stuff its capability MASK into `preferred` — the result

crates/punktfunk-core/src/quic/datagram.rs

@@ -1,15 +1,12 @@
-//! The QUIC-datagram side planes, demultiplexed by their first byte (0xC9–0xD1):
-//! audio, rumble, mic uplink, rich input, HID output, HDR metadata, host timing,
-//! cursor state, pad audio.
+//! The QUIC-datagram side planes, demultiplexed by their first byte (0xC9–0xCF):
+//! audio, rumble, mic uplink, rich input, HID output, HDR metadata, host timing.
 
 /// Datagram wire tags. Video rides UDP; everything low-rate rides QUIC datagrams,
 /// demultiplexed by the first byte: input = [`crate::input::INPUT_MAGIC`] (0xC8, client→host),
 /// audio = [`AUDIO_MAGIC`] (0xC9, host→client), rumble = [`RUMBLE_MAGIC`] (0xCA, host→client),
 /// mic = [`MIC_MAGIC`] (0xCB, client→host), rich-input = [`RICH_INPUT_MAGIC`] (0xCC, client→host),
 /// HID-output = [`HIDOUT_MAGIC`] (0xCD, host→client), HDR metadata = [`HDR_META_MAGIC`]
-/// (0xCE, host→client), host timing = [`HOST_TIMING_MAGIC`] (0xCF, host→client), cursor state =
-/// [`CURSOR_STATE_MAGIC`] (0xD0, host→client), pad audio = [`PAD_AUDIO_MAGIC`] (0xD1,
-/// host→client).
+/// (0xCE, host→client).
 pub const AUDIO_MAGIC: u8 = 0xC9;
 pub const RUMBLE_MAGIC: u8 = 0xCA;
 /// Microphone uplink: the client's mic, Opus-encoded, client → host (the inverse of
@@ -419,7 +416,6 @@ const HIDOUT_PLAYER_LEDS: u8 = 0x02;
 const HIDOUT_TRIGGER: u8 = 0x03;
 const HIDOUT_TRACKPAD_HAPTIC: u8 = 0x04;
 const HIDOUT_HID_RAW: u8 = 0x05;
-const HIDOUT_AUDIO_CTL: u8 = 0x06;
 
 /// [`HidOutput::HidRaw`] `kind`: an OUTPUT report — what the host's hidraw client wrote with
 /// `write()`/`SDL_hid_write` (Triton rumble `0x80`, haptic pulse `0x81`, …). The client replays
@@ -468,16 +464,6 @@ pub enum HidOutput {
     /// hardware safety timeout, and settings (lizard/IMU) are refreshed every ~3 s against the
     /// firmware watchdog — a lost datagram heals on the next refresh.
     HidRaw { pad: u8, kind: u8, data: Vec<u8> },
-    /// The audio-control region of a DS5 output report `0x02` a game wrote to the host's virtual
-    /// pad — the routing/volume side of pad audio (the audio SAMPLES ride the [`PAD_AUDIO_MAGIC`]
-    /// plane). `raw` is bytes 5..=10 of the report verbatim (headphone/speaker/mic volumes +
-    /// audio routing); `flags` condenses the report's audio valid-flags: bit0 = haptics-select
-    /// (`valid_flag0` bit1 — the title asked for audio haptics on the voice coils), bits1..4 =
-    /// `valid_flag0` bits 4..7 (the audio-valid flags gating `raw`). Wire form
-    /// `[0xCD][0x06][u16 pad LE][u8 flags][6 raw bytes]`. Forwarded change-only (deduped by
-    /// value host-side, like `Led`/`Trigger`) — a merely-rumbling pad re-sends unchanged audio
-    /// state on every output report.
-    AudioCtl { pad: u16, flags: u8, raw: [u8; 6] },
 }
 
 impl HidOutput {
@@ -510,12 +496,6 @@ impl HidOutput {
                 out.extend_from_slice(&[HIDOUT_HID_RAW, *pad, *kind]);
                 out.extend_from_slice(&data[..data.len().min(HID_REPORT_MAX)]);
             }
-            HidOutput::AudioCtl { pad, flags, raw } => {
-                out.push(HIDOUT_AUDIO_CTL);
-                out.extend_from_slice(&pad.to_le_bytes());
-                out.push(*flags);
-                out.extend_from_slice(raw);
-            }
         }
         out
     }
@@ -560,22 +540,6 @@ impl HidOutput {
                 // Bounded: at most HID_REPORT_MAX bytes are kept from the (attacker-sized) tail.
                 data: b[4..b.len().min(4 + HID_REPORT_MAX)].to_vec(),
             }),
-            // B27: the pad is the only u16 index on this plane, and every consumer narrows it
-            // with `as u8` on the stated assumption that pads are 0..MAX_PADS. Nothing enforced
-            // that, so wire pad 256 silently ALIASED onto slot 0 — a malformed or hostile
-            // datagram steering a real controller's speaker volumes. Rejected here, at the one
-            // place the u16 exists, so the narrowings downstream are lossless by construction
-            // (the same fix R10 applied to the rumble plane).
-            HIDOUT_AUDIO_CTL
-                if b.len() >= 11
-                    && u16::from_le_bytes([b[2], b[3]]) < crate::input::MAX_PADS as u16 =>
-            {
-                Some(HidOutput::AudioCtl {
-                    pad: u16::from_le_bytes([b[2], b[3]]),
-                    flags: b[4],
-                    raw: b[5..11].try_into().unwrap(),
-                })
-            }
             _ => None,
         }
     }
@@ -834,72 +798,6 @@ pub fn decode_cursor_state_datagram(b: &[u8]) -> Option<CursorState> {
     })
 }
 
-/// Pad-audio datagram tag, host → client: per-gamepad audio a game routed
-/// to the host's virtual DualSense — voice-coil haptics and the built-in speaker — for the client
-/// to render on the matching real controller. Next tag after [`CURSOR_STATE_MAGIC`]. The
-/// per-pad AUDIO plane (Opus frames, the [`AUDIO_MAGIC`]/[`MIC_MAGIC`] shape plus pad + kind);
-/// the routing/volume CONTROL side rides [`HidOutput::AudioCtl`]. Emitted only when the session
-/// negotiated it ([`CLIENT_CAP_PAD_AUDIO`](super::caps::CLIENT_CAP_PAD_AUDIO) ∧
-/// [`HOST_CAP_PAD_AUDIO`](super::caps::HOST_CAP_PAD_AUDIO)) and the pad's arrival declared a
-/// renderer for the kind ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`).
-/// Best-effort like every audio datagram: a lost frame is a concealed gap, never state.
-pub const PAD_AUDIO_MAGIC: u8 = 0xD1;
-
-/// [`PadAudioFrame::kind`]: the BACK channel pair — the DualSense voice-coil actuators (audio
-/// haptics). 5 ms Opus frames, matching the [`AUDIO_MAGIC`] cadence: haptics are felt latency.
-pub const PAD_AUDIO_KIND_HAPTICS: u8 = 0;
-/// [`PadAudioFrame::kind`]: the FRONT channel pair — the controller's built-in speaker. 10 ms
-/// Opus frames (speaker content tolerates the extra buffering for the better coding efficiency).
-pub const PAD_AUDIO_KIND_SPEAKER: u8 = 1;
-
-/// Wire length of a pad-audio datagram header: tag + pad + kind + u32 seq + u64 pts = 15 bytes.
-const PAD_AUDIO_HEADER_LEN: usize = 1 + 1 + 1 + 4 + 8;
-
-/// One decoded pad-audio frame (owned — the client's plane queue stores it). `seq`/`pts_ns` are
-/// per-(pad, kind) counters from the host's capture clock, for gap concealment and lip-sync
-/// against the main audio plane.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PadAudioFrame {
-    /// Gamepad index (the wire pad space, same as rumble/HID-output).
-    pub pad: u8,
-    /// [`PAD_AUDIO_KIND_HAPTICS`] or [`PAD_AUDIO_KIND_SPEAKER`].
-    pub kind: u8,
-    pub seq: u32,
-    pub pts_ns: u64,
-    /// The raw Opus payload — feed it to an Opus decoder as one frame. Empty = DTX silence.
-    pub opus: Vec<u8>,
-}
-
-/// Pad-audio datagram, host → client:
-/// `[0xD1][u8 pad][u8 kind][u32 seq LE][u64 pts_ns LE][opus payload]` — the
-/// [`encode_audio_datagram`]/[`encode_mic_datagram`] layout with a pad + kind prefix, one Opus
-/// frame per datagram (5/10 ms — well under any MTU); QUIC already encrypts.
-pub fn encode_pad_audio_datagram(pad: u8, kind: u8, seq: u32, pts_ns: u64, opus: &[u8]) -> Vec<u8> {
-    let mut b = Vec::with_capacity(PAD_AUDIO_HEADER_LEN + opus.len());
-    b.push(PAD_AUDIO_MAGIC);
-    b.push(pad);
-    b.push(kind);
-    b.extend_from_slice(&seq.to_le_bytes());
-    b.extend_from_slice(&pts_ns.to_le_bytes());
-    b.extend_from_slice(opus);
-    b
-}
-
-/// Parse a pad-audio datagram → [`PadAudioFrame`]. `None` on bad tag/length (the fixed header
-/// length bounds every read before it happens).
-pub fn decode_pad_audio_datagram(buf: &[u8]) -> Option<PadAudioFrame> {
-    if buf.len() < PAD_AUDIO_HEADER_LEN || buf[0] != PAD_AUDIO_MAGIC {
-        return None;
-    }
-    Some(PadAudioFrame {
-        pad: buf[1],
-        kind: buf[2],
-        seq: u32::from_le_bytes(buf[3..7].try_into().unwrap()),
-        pts_ns: u64::from_le_bytes(buf[7..15].try_into().unwrap()),
-        opus: buf[15..].to_vec(),
-    })
-}
-
 #[cfg(test)]
 mod tests {
     use crate::quic::*;
@@ -1383,12 +1281,6 @@ mod tests {
                     f
                 },
             },
-            // The DS5 audio-control region (haptics-select + speaker volume asserted).
-            HidOutput::AudioCtl {
-                pad: 1,
-                flags: 0b0_0101,
-                raw: [0x50, 0x60, 0x70, 0x05, 0x00, 0x00],
-            },
         ];
         for ev in &cases {
             let d = ev.encode();
@@ -1407,92 +1299,6 @@ mod tests {
         )
         .is_none());
     }
-
-    #[test]
-    fn audio_ctl_wire_layout_and_truncation() {
-        // The exact 11-byte layout: [0xCD][0x06][u16 pad LE][u8 flags][6 raw bytes].
-        // The pad is deliberately a REPRESENTABLE one: this used to assert that 0x0201 (513)
-        // round-tripped, which pinned B27's aliasing in place as if it were the contract.
-        let a = HidOutput::AudioCtl {
-            pad: 0x000B,
-            flags: 0x17,
-            raw: [1, 2, 3, 4, 5, 6],
-        };
-        let d = a.encode();
-        assert_eq!(d, [0xCD, 0x06, 0x0B, 0x00, 0x17, 1, 2, 3, 4, 5, 6]);
-        assert_eq!(HidOutput::decode(&d), Some(a));
-        // Truncated buffers are rejected outright (fixed length — never a partial read).
-        for n in 2..d.len() {
-            assert_eq!(HidOutput::decode(&d[..n]), None);
-        }
-    }
-
-    #[test]
-    fn pad_audio_datagram_roundtrip_and_truncation() {
-        let opus = [0x5Au8; 61];
-        let d = encode_pad_audio_datagram(3, PAD_AUDIO_KIND_HAPTICS, 42, 9_999, &opus);
-        assert_eq!(d[0], PAD_AUDIO_MAGIC);
-        assert_eq!(d.len(), 15 + opus.len());
-        let f = decode_pad_audio_datagram(&d).unwrap();
-        assert_eq!((f.pad, f.kind, f.seq, f.pts_ns), (3, 0, 42, 9_999));
-        assert_eq!(f.opus, opus);
-        // Truncated headers are rejected outright (never partially read).
-        for n in 0..15 {
-            assert_eq!(decode_pad_audio_datagram(&d[..n]), None);
-        }
-        // Tag separation: a pad-audio datagram is not a session-audio/mic datagram and vice-versa.
-        assert!(decode_audio_datagram(&d).is_none());
-        assert!(decode_mic_datagram(&d).is_none());
-        assert!(decode_pad_audio_datagram(&encode_audio_datagram(1, 2, &opus)).is_none());
-        // Empty payload (DTX) is legal — header-only datagram.
-        let hdr = encode_pad_audio_datagram(0, PAD_AUDIO_KIND_SPEAKER, 0, 0, &[]);
-        assert_eq!(hdr.len(), 15);
-        assert!(decode_pad_audio_datagram(&hdr).unwrap().opus.is_empty());
-    }
-
-    /// B27: the pad is the only u16 index on the 0xCD plane and every consumer narrows it with
-    /// `as u8`. An out-of-range one used to alias onto a real slot instead of being refused —
-    /// wire pad 256 steering pad 0's speaker volumes.
-    #[test]
-    fn audio_ctl_rejects_a_pad_outside_the_index_space() {
-        let ok = HidOutput::AudioCtl {
-            pad: (crate::input::MAX_PADS - 1) as u16,
-            flags: 0x12,
-            raw: [1, 2, 3, 4, 5, 6],
-        };
-        assert_eq!(
-            HidOutput::decode(&ok.encode()),
-            Some(ok),
-            "the last valid pad must still decode"
-        );
-
-        // Anything at or above MAX_PADS is refused outright, not truncated.
-        for pad in [crate::input::MAX_PADS as u16, 256, u16::MAX] {
-            let d = HidOutput::AudioCtl {
-                pad,
-                flags: 0x12,
-                raw: [1, 2, 3, 4, 5, 6],
-            }
-            .encode();
-            assert_eq!(HidOutput::decode(&d), None, "pad {pad} must not decode");
-        }
-
-        // The specific alias the bug produced: 256 as u8 == 0.
-        let d = HidOutput::AudioCtl {
-            pad: 256,
-            flags: 0,
-            raw: [0; 6],
-        }
-        .encode();
-        assert!(
-            !matches!(
-                HidOutput::decode(&d),
-                Some(HidOutput::AudioCtl { pad: 0, .. })
-            ),
-            "wire pad 256 must never surface as pad 0"
-        );
-    }
-
     #[test]
     fn cursor_state_roundtrip() {
         for (flags, x, y) in [

crates/punktfunk-core/src/quic/mod.rs

@@ -25,7 +25,7 @@
 //! Split by concern (networking-audit deferred plan §3 — a pure move): `handshake` the
 //! positional Hello/Welcome/Start codecs, `caps` the capability/codec-negotiation
 //! vocabulary, `control` the typed control + clipboard messages, `pairing` the pairing
-//! message codecs with [`pake`] the SPAKE2 itself, `datagram` the 0xC9–0xD1 plane codecs,
+//! message codecs with [`pake`] the SPAKE2 itself, `datagram` the 0xC9–0xCF plane codecs,
 //! `pen` the stylus batch (0xCC kind 0x05) + host stroke tracker,
 //! [`io`] framed stream IO, `clock` skew estimation + mid-stream re-sync, [`endpoint`] the
 //! quinn constructors, [`clipstream`] the per-transfer clipboard fetch streams. Every item

crates/punktfunk-host/Cargo.toml

@@ -259,17 +259,6 @@ windows = { version = "0.62", features = [
     # CoCreateInstance(PolicyConfigClient) — set the default audio playback/recording endpoints via the
     # undocumented IPolicyConfig (audio/windows/audio_control.rs) so mic + desktop audio auto-wire.
     "Win32_System_Com",
-    # Pad-audio endpoint provisioning (audio/windows/pad_endpoint.rs): IMMDevice + IPropertyStore
-    # to stamp the DualSense identity onto the minted endpoints (PROPVARIANT lives in
-    # StructuredStorage and is gated on the Variant feature), DEVPKEY_Device_DriverInfPath to
-    # resolve the installed Steam Streaming Speakers INF, and raw Reg* calls behind the MMDevices
-    # ACL repair + the devnode's pad-index marker value.
-    "Win32_Media_Audio",
-    "Win32_UI_Shell_PropertiesSystem",
-    "Win32_System_Com_StructuredStorage",
-    "Win32_System_Variant",
-    "Win32_Devices_Properties",
-    "Win32_System_Registry",
     # SetUnhandledExceptionFilter + EXCEPTION_POINTERS — the last-resort native-crash logger
     # (src/windows/crash.rs); Kernel gates the CONTEXT type EXCEPTION_POINTERS embeds.
     "Win32_System_Diagnostics_Debug",

crates/punktfunk-host/src/audio.rs

@@ -183,12 +183,6 @@ pub fn open_virtual_mic(_channels: u32) -> Result<Box<dyn VirtualMic>> {
 mod audio_control;
 #[cfg(target_os = "linux")]
 mod linux;
-// DualSense pad-audio endpoint provisioning + loopback capture (design: pad haptics/audio).
-// pub(crate): the session layer queries endpoints by pad index and the CLI exposes the
-// `pad-endpoint` devtest.
-#[cfg(target_os = "windows")]
-#[path = "audio/windows/pad_endpoint.rs"]
-pub(crate) mod pad_endpoint;
 #[cfg(target_os = "windows")]
 #[path = "audio/windows/wasapi_cap.rs"]
 mod wasapi_cap;

crates/punktfunk-host/src/audio/windows/audio_control.rs

@@ -143,17 +143,6 @@ pub(crate) fn wire_now(set_playback: bool) -> Wiring {
     wire_now_full(set_playback).wiring
 }
 
-/// Endpoint ids among `renders` that are the host's own pad-audio endpoints — the exclusion
-/// data [`plan`] runs on. Detection lives in [`super::pad_endpoint`] (stamped PFDS container /
-/// devnode marker, registry-only reads); this is just the per-pass collection.
-fn pad_render_ids(renders: &[Endpoint]) -> Vec<String> {
-    renders
-        .iter()
-        .filter(|(_, id)| super::pad_endpoint::is_pad_render_endpoint(id))
-        .map(|(_, id)| id.clone())
-        .collect()
-}
-
 /// Enumerate endpoints, compute the assignment, apply the default-device changes (unless
 /// `PUNKTFUNK_KEEP_DEFAULT`), and return the plan for the caller to act on (mic target / loopback
 /// echo guard). `set_playback` — true only from the desktop-audio capture open — additionally
@@ -170,10 +159,6 @@ pub(crate) fn wire_now_full(set_playback: bool) -> WiredPlan {
     let want = std::env::var("PUNKTFUNK_MIC_DEVICE")
         .ok()
         .map(|s| s.to_lowercase());
-    // The host's own pad-audio ("DualSense speaker") endpoints, by id — the pure plan filters
-    // them out of every role. Identity is platform data (stamped container / devnode marker),
-    // so it is collected HERE and passed in, like the candidate lists themselves.
-    let pad_ids = pad_render_ids(&renders);
     // Mix formats are read only when we are actually going to park the playback default (i.e. a
     // desktop-audio capture is opening). The mic pump wires on every open while the host is idle
     // and does not care which loopback endpoint wins, so it must not pay an IAudioClient
@@ -194,7 +179,6 @@ pub(crate) fn wire_now_full(set_playback: bool) -> WiredPlan {
         // only count a *narrowing* verdict can be made against without guessing: an endpoint that
         // cannot carry stereo cannot carry 5.1 either.
         2,
-        &pad_ids,
     );
     let done = |wiring: Wiring| WiredPlan {
         wiring,
@@ -261,7 +245,7 @@ pub(crate) fn wire_now_full(set_playback: bool) -> WiredPlan {
     if let Some((mic_name, mic_id)) = &wiring.mic_render {
         if default_render_id().as_deref() == Some(mic_id.as_str()) {
             // Audible preference = the host_audio plan's loopback pick (real hardware first).
-            match plan(&renders, &captures, want.as_deref(), true, &pad_ids).loopback_render {
+            match plan(&renders, &captures, want.as_deref(), true).loopback_render {
                 Some((name, id)) => match set_default_endpoint(&id) {
                     Ok(()) => tracing::info!(mic = %mic_name, device = %name,
                         "default playback was the virtual-mic target — moved it so desktop \
@@ -318,10 +302,8 @@ fn park_marker_path() -> std::path::PathBuf {
     pf_paths::config_dir().join("audio-default.prev")
 }
 
-/// The current default RENDER endpoint id, if any. pub(crate): the pad-endpoint provisioning
-/// uses it for its default-device guard (a freshly minted pad endpoint must never stay the
-/// default playback device).
-pub(crate) fn default_render_id() -> Option<String> {
+/// The current default RENDER endpoint id, if any.
+fn default_render_id() -> Option<String> {
     wasapi::DeviceEnumerator::new()
         .ok()?
         .get_default_device(&Direction::Render)
@@ -448,13 +430,11 @@ pub(crate) fn restore_default_playback() {
 }
 
 /// Open a device by endpoint id, with a name for error context.
-///
-/// Resolves through [`super::pad_endpoint::open_wasapi_device`], NOT the `wasapi` crate's
-/// `DeviceEnumerator::get_device` — that one hands `GetDevice` a freed string (see the helper's
-/// docs), so it fails at random on ids that are perfectly valid.
 pub(crate) fn open_endpoint(ep: &Endpoint) -> Result<wasapi::Device> {
-    super::pad_endpoint::open_wasapi_device(&ep.1)
-        .map_err(|e| anyhow!("open endpoint {:?}: {e:#}", ep.0))
+    wasapi::DeviceEnumerator::new()
+        .map_err(|e| anyhow!("DeviceEnumerator: {e}"))?
+        .get_device(&ep.1)
+        .map_err(|e| anyhow!("open endpoint {:?}: {e}", ep.0))
 }
 
 // --- IPolicyConfig (undocumented): set a default audio endpoint by id, for all three roles. ---
@@ -501,9 +481,8 @@ const _: () = {
 
 /// Set `device_id` as the default audio endpoint for eConsole/eMultimedia/eCommunications via the
 /// undocumented `IPolicyConfig::SetDefaultEndpoint` (the call `mmsys.cpl` makes). Errs if any role
-/// fails. pub(crate): the pad-endpoint default-device guard restores the operator's default
-/// through the same machinery.
-pub(crate) fn set_default_endpoint(device_id: &str) -> Result<()> {
+/// fails.
+fn set_default_endpoint(device_id: &str) -> Result<()> {
     use windows::core::{IUnknown, Interface, GUID, PCWSTR};
     use windows::Win32::System::Com::{CoCreateInstance, CLSCTX_ALL};
 

crates/punktfunk-host/src/audio/windows/wasapi_cap.rs

@@ -511,7 +511,7 @@ fn capture_once(
     if assert_plan {
         if let Some(d) = seen_default.as_deref() {
             if d != dev_id {
-                match judge_default(wiring, d) {
+                match judge_default(&en, wiring, d) {
                     DefaultKind::Capturable(name) => {
                         tracing::info!(default = %name, planned = %dev_name,
                             "could not park the default playback on the planned endpoint — \
@@ -639,7 +639,7 @@ fn capture_once(
                             );
                             return Ok(Next::Reopen(TargetMode::Follow));
                         }
-                        match judge_default(wiring, &nid) {
+                        match judge_default(&en, wiring, &nid) {
                             DefaultKind::Capturable(name) => {
                                 audio_client.stop_stream().ok();
                                 tracing::info!(device = %name,
@@ -726,11 +726,8 @@ enum DefaultKind {
     Unknown,
 }
 
-/// Resolves through [`super::pad_endpoint::open_wasapi_device`], NOT the `wasapi` crate's
-/// `DeviceEnumerator::get_device` — that one hands `GetDevice` a freed string (see the helper's
-/// docs), and a spurious miss here silently downgrades a capturable default to `Unknown`.
-fn judge_default(wiring: &wiring_plan::Wiring, id: &str) -> DefaultKind {
-    let Ok(dev) = super::pad_endpoint::open_wasapi_device(id) else {
+fn judge_default(en: &DeviceEnumerator, wiring: &wiring_plan::Wiring, id: &str) -> DefaultKind {
+    let Ok(dev) = en.get_device(id) else {
         return DefaultKind::Unknown;
     };
     let name = dev.get_friendlyname().unwrap_or_default();
@@ -739,15 +736,7 @@ fn judge_default(wiring: &wiring_plan::Wiring, id: &str) -> DefaultKind {
         .mic_render
         .as_ref()
         .is_some_and(|(_, mic_id)| mic_id == id);
-    // B10: a pad's audio endpoint is not ordinary hardware, and the name rules cannot see that —
-    // it is deliberately stamped with the controller's own name ("DualSense Wireless Controller")
-    // so games treat it as the pad's speaker, which means `excluded_from_loopback` passes it
-    // straight through as `Capturable`. The pure plan filtered these out, but the plan is not the
-    // only reader: this classifier drives the watchdog, Follow mode and the parked default, so a
-    // pad endpoint that happened to be the system default could be adopted as the desktop capture
-    // source — sending the whole desktop mix to a controller's voice coils. Identity, not name.
-    let is_pad = super::pad_endpoint::is_pad_render_endpoint(id);
-    if is_mic || is_pad || wiring_plan::excluded_from_loopback(&ln) {
+    if is_mic || wiring_plan::excluded_from_loopback(&ln) {
         DefaultKind::Dud(name)
     } else {
         DefaultKind::Capturable(name)

crates/punktfunk-host/src/audio/windows/wasapi_mic.rs

@@ -253,16 +253,25 @@ pub(crate) fn install_steam_audio_pair() -> bool {
     mic || spk
 }
 
-/// Full path of a Steam Remote Play driver INF under Steam's per-arch driver directory
-/// (`%CommonProgramFiles(x86)%\Steam\drivers\Windows10\{arch}\<inf_name>`), as a NUL-terminated
-/// UTF-16 buffer. Shared by [`try_install_steam_audio`] and the pad-endpoint provisioning
-/// ([`super::pad_endpoint`]), which feeds the same INF to `UpdateDriverForPlugAndPlayDevicesW`
-/// when no installed Steam Streaming Speakers devnode exposes its `oemNN.inf`. `None` when the
-/// environment expansion fails (existence is the caller's check).
-pub(crate) fn steam_driver_inf_path(inf_name: &str) -> Option<Vec<u16>> {
-    use windows::core::PCWSTR;
+/// Install one Steam Streaming driver INF by filename via `DiInstallDriverW` (loaded from
+/// `newdev.dll`, like Apollo, to avoid an extra windows-crate feature). See
+/// [`install_steam_audio_pair`] for the contract; `inf_name` is a bare filename under Steam's
+/// per-arch `drivers\Windows10\{arch}\` directory.
+///
+/// Safe: `inf_name` is a `&str` and every FFI argument is built locally from it, so there is no
+/// precondition a caller could break — the `unsafe` is the `LoadLibraryExW`/`transmute`/call chain
+/// inside, which is this function's own business.
+fn try_install_steam_audio(inf_name: &str) -> bool {
+    use windows::core::{s, w, PCWSTR};
+    use windows::Win32::Foundation::HWND;
     use windows::Win32::System::Environment::ExpandEnvironmentStringsW;
+    use windows::Win32::System::LibraryLoader::{
+        GetProcAddress, LoadLibraryExW, LOAD_LIBRARY_SEARCH_SYSTEM32,
+    };
 
+    if std::env::var_os("PUNKTFUNK_NO_MIC_INSTALL").is_some() {
+        return false;
+    }
     // Steam ships per-arch driver INFs under `Steam\drivers\Windows10\{arch}\`.
     #[cfg(target_arch = "x86_64")]
     let subdir = "x64";
@@ -281,33 +290,8 @@ pub(crate) fn steam_driver_inf_path(inf_name: &str) -> Option<Vec<u16>> {
     let n =
         unsafe { ExpandEnvironmentStringsW(PCWSTR(template.as_ptr()), Some(path.as_mut_slice())) };
     if n == 0 || n as usize > path.len() {
-        return None;
-    }
-    path.truncate(n as usize); // keeps the NUL
-    Some(path)
-}
-
-/// Install one Steam Streaming driver INF by filename via `DiInstallDriverW` (loaded from
-/// `newdev.dll`, like Apollo, to avoid an extra windows-crate feature). See
-/// [`install_steam_audio_pair`] for the contract; `inf_name` is a bare filename under Steam's
-/// per-arch `drivers\Windows10\{arch}\` directory.
-///
-/// Safe: `inf_name` is a `&str` and every FFI argument is built locally from it, so there is no
-/// precondition a caller could break — the `unsafe` is the `LoadLibraryExW`/`transmute`/call chain
-/// inside, which is this function's own business.
-fn try_install_steam_audio(inf_name: &str) -> bool {
-    use windows::core::{s, w, PCWSTR};
-    use windows::Win32::Foundation::HWND;
-    use windows::Win32::System::LibraryLoader::{
-        GetProcAddress, LoadLibraryExW, LOAD_LIBRARY_SEARCH_SYSTEM32,
-    };
-
-    if std::env::var_os("PUNKTFUNK_NO_MIC_INSTALL").is_some() {
         return false;
     }
-    let Some(path) = steam_driver_inf_path(inf_name) else {
-        return false;
-    };
 
     // SAFETY: a static NUL-terminated literal, loaded from System32 only (the flag), so this cannot
     // pick up a planted `newdev.dll` from the working directory. The handle is checked before use.

crates/punktfunk-host/src/audio/wiring_plan.rs

@@ -186,17 +186,6 @@ fn virtualish(lname: &str) -> bool {
         || lname.contains("voicemeeter")
 }
 
-/// Is this render endpoint id one of the virtual pad's audio endpoints?
-///
-/// Pulled out of [`plan`] because the plan is NOT the only place that must not treat these as
-/// ordinary hardware — see [`excluded_from_loopback`]'s callers. A pad endpoint is deliberately
-/// stamped with the controller's own name ("DualSense Wireless Controller") so games read it as
-/// the pad's speaker, which means no name-based rule can recognise one; the only reliable test is
-/// identity against the ids the pad-endpoint provisioner created.
-pub(crate) fn is_pad_render(id: &str, pad_renders: &[String]) -> bool {
-    pad_renders.iter().any(|p| p == id)
-}
-
 /// Compute the assignment. `mic_want` is the operator override (`PUNKTFUNK_MIC_DEVICE`,
 /// lowercased): when set it beats the built-in candidate order for the mic target. `host_audio`
 /// flips the loopback preference to real hardware (audio audible on the host too); the default
@@ -206,17 +195,8 @@ pub(crate) fn plan(
     captures: &[Endpoint],
     mic_want: Option<&str>,
     host_audio: bool,
-    pad_renders: &[String],
 ) -> Wiring {
-    plan_with_formats(
-        renders,
-        captures,
-        mic_want,
-        host_audio,
-        &no_formats,
-        2,
-        pad_renders,
-    )
+    plan_with_formats(renders, captures, mic_want, host_audio, &no_formats, 2)
 }
 
 /// [`plan`] with knowledge of each render endpoint's engine mix format, and the channel count the
@@ -241,20 +221,7 @@ pub(crate) fn plan_with_formats(
     host_audio: bool,
     format_of: FormatProbe,
     want_channels: u8,
-    pad_renders: &[String],
 ) -> Wiring {
-    // 0. Pad-audio endpoints are invisible to the plan: never the mic target (client voice
-    //    would play out of a pad "speaker"), never a loopback source (a game's controller
-    //    audio cues would stream as desktop audio), and — since this shadows `renders` for
-    //    every tier below — never the flagged last resort either. Their names carry no virtual
-    //    marker (they are stamped "DualSense Wireless Controller" on purpose, so games read
-    //    them as the pad's speaker), so the name rules alone would take one for real hardware.
-    let renders: Vec<Endpoint> = renders
-        .iter()
-        .filter(|(_, id)| !is_pad_render(id, pad_renders))
-        .cloned()
-        .collect();
-    let renders = renders.as_slice();
     let find_render = |needle: &str| {
         renders
             .iter()
@@ -455,7 +422,7 @@ mod tests {
             ep("Microphone (Webcam)"),
             ep("CABLE Output (VB-Audio Virtual Cable)"),
         ];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "CABLE Input (VB-Audio Virtual Cable)"
@@ -484,7 +451,7 @@ mod tests {
             ep("CABLE Output (VB-Audio Virtual Cable)"),
             ep("Microphone (Steam Streaming Microphone)"),
         ];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "CABLE Input (VB-Audio Virtual Cable)"
@@ -504,7 +471,7 @@ mod tests {
             ep("CABLE Input (VB-Audio Virtual Cable)"),
             ep("Speakers (Steam Streaming Microphone)"),
         ];
-        let w = plan(&renders, &[], None, true, &[]);
+        let w = plan(&renders, &[], None, true);
         assert_eq!(
             w.loopback_render.unwrap().0,
             "Speakers (Apple Audio Device)"
@@ -521,7 +488,7 @@ mod tests {
             ep("CABLE In 16ch (VB-Audio Virtual Cable)"),
         ];
         for host_audio in [false, true] {
-            let w = plan(&renders, &[], None, host_audio, &[]);
+            let w = plan(&renders, &[], None, host_audio);
             assert!(w.loopback_render.is_none(), "host_audio={host_audio}");
         }
     }
@@ -533,7 +500,7 @@ mod tests {
     fn headless_cable_only_mic_wins() {
         let renders = [ep("CABLE Input (VB-Audio Virtual Cable)")];
         let captures = [ep("CABLE Output (VB-Audio Virtual Cable)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert!(w.mic_render.is_some(), "mic must claim the only cable");
         assert!(w.loopback_render.is_none(), "no echo-safe loopback exists");
     }
@@ -551,7 +518,7 @@ mod tests {
             ep("CABLE Output (VB-Audio Virtual Cable)"),
             ep("Microphone (Steam Streaming Microphone)"),
         ];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "CABLE Input (VB-Audio Virtual Cable)"
@@ -579,7 +546,7 @@ mod tests {
             ep("Speakers (Realtek HD Audio)"),
         ];
         let captures = [ep("Microphone (Steam Streaming Microphone)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "Speakers (Steam Streaming Microphone)"
@@ -593,7 +560,7 @@ mod tests {
     fn steam_mic_only_no_echo() {
         let renders = [ep("Speakers (Steam Streaming Microphone)")];
         let captures = [ep("Microphone (Steam Streaming Microphone)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert!(w.mic_render.is_some());
         assert!(w.loopback_render.is_none());
     }
@@ -609,7 +576,7 @@ mod tests {
             ep("Speakers (Steam Streaming Speakers)"),
         ];
         for host_audio in [false, true] {
-            let w = plan(&renders, &[], None, host_audio, &[]);
+            let w = plan(&renders, &[], None, host_audio);
             assert_eq!(
                 w.loopback_render.as_ref().unwrap().0,
                 "Speakers (Steam Streaming Speakers)",
@@ -630,7 +597,7 @@ mod tests {
             ep("Altavoces (Steam Streaming Microphone)"),
         ];
         let captures = [ep("Microphone (Steam Streaming Microphone)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "Altavoces (Steam Streaming Microphone)"
@@ -653,7 +620,7 @@ mod tests {
         ];
         let captures = [ep("Microphone (Steam Streaming Microphone)")];
         for host_audio in [false, true] {
-            let w = plan(&renders, &captures, None, host_audio, &[]);
+            let w = plan(&renders, &captures, None, host_audio);
             assert_eq!(
                 w.loopback_render.as_ref().unwrap().0,
                 "Speakers (Realtek HD Audio)",
@@ -675,7 +642,7 @@ mod tests {
         ];
         let captures = [ep("CABLE Output (VB-Audio Virtual Cable)")];
         for host_audio in [false, true] {
-            let w = plan(&renders, &captures, None, host_audio, &[]);
+            let w = plan(&renders, &captures, None, host_audio);
             assert!(w.loopback_render.is_none(), "host_audio={host_audio}");
             assert!(!w.loopback_last_resort, "host_audio={host_audio}");
             assert!(w.loopback_unsatisfiable(), "host_audio={host_audio}");
@@ -724,7 +691,7 @@ mod tests {
             ("steam streaming microphone", fmt(24_000, 1)),
             ("odyssey", fmt(48_000, 2)),
         ]);
-        let w = plan_with_formats(&renders, &captures, None, false, &p, 2, &[]);
+        let w = plan_with_formats(&renders, &captures, None, false, &p, 2);
         assert_eq!(
             w.loopback_render.as_ref().unwrap().0,
             "1 - Odyssey G60SD (AMD High Definition Audio Device)",
@@ -754,7 +721,7 @@ mod tests {
             ("steam streaming microphone", fmt(48_000, 2)),
             ("realtek", fmt(48_000, 2)),
         ]);
-        let w = plan_with_formats(&renders, &[], None, false, &p, 2, &[]);
+        let w = plan_with_formats(&renders, &[], None, false, &p, 2);
         assert_eq!(
             w.loopback_render.unwrap().0,
             "Speakers (Steam Streaming Microphone)"
@@ -770,7 +737,7 @@ mod tests {
             ep("Speakers (Steam Streaming Microphone)"),
         ];
         let p = probe(vec![("steam streaming microphone", fmt(16_000, 1))]);
-        let w = plan_with_formats(&renders, &[], None, false, &p, 2, &[]);
+        let w = plan_with_formats(&renders, &[], None, false, &p, 2);
         assert_eq!(
             w.loopback_render.as_ref().unwrap().0,
             "Speakers (Steam Streaming Microphone)"
@@ -786,7 +753,7 @@ mod tests {
     fn narrowing_is_reported_for_real_hardware_too() {
         let renders = [ep("Headset (Hands-Free AG Audio)")];
         let p = probe(vec![("headset", fmt(16_000, 1))]);
-        let w = plan_with_formats(&renders, &[], None, false, &p, 2, &[]);
+        let w = plan_with_formats(&renders, &[], None, false, &p, 2);
         assert_eq!(
             w.loopback_render.as_ref().unwrap().0,
             "Headset (Hands-Free AG Audio)"
@@ -806,8 +773,8 @@ mod tests {
         ];
         let captures = [ep("CABLE Output (VB-Audio Virtual Cable)")];
         for host_audio in [false, true] {
-            let a = plan(&renders, &captures, None, host_audio, &[]);
-            let b = plan_with_formats(&renders, &captures, None, host_audio, &no_formats, 2, &[]);
+            let a = plan(&renders, &captures, None, host_audio);
+            let b = plan_with_formats(&renders, &captures, None, host_audio, &no_formats, 2);
             assert_eq!(a, b, "host_audio={host_audio}");
             assert!(a.loopback_narrowing.is_none());
         }
@@ -825,7 +792,7 @@ mod tests {
             ("steam streaming microphone", fmt(24_000, 1)),
             ("realtek", fmt(48_000, 2)),
         ]);
-        let w = plan_with_formats(&renders, &[], None, true, &p, 2, &[]);
+        let w = plan_with_formats(&renders, &[], None, true, &p, 2);
         assert_eq!(w.loopback_render.unwrap().0, "Speakers (Realtek HD Audio)");
     }
 
@@ -853,7 +820,7 @@ mod tests {
             ep("Voicemeeter Input (VB-Audio Voicemeeter VAIO)"),
         ];
         let captures = [ep("Voicemeeter Out B1 (VB-Audio Voicemeeter VAIO)")];
-        let w = plan(&renders, &captures, Some("voicemeeter input"), false, &[]);
+        let w = plan(&renders, &captures, Some("voicemeeter input"), false);
         assert_eq!(
             w.mic_render.unwrap().0,
             "Voicemeeter Input (VB-Audio Voicemeeter VAIO)"
@@ -869,7 +836,7 @@ mod tests {
     #[test]
     fn no_virtual_device() {
         let renders = [ep("Speakers (Realtek HD Audio)")];
-        let w = plan(&renders, &[], None, false, &[]);
+        let w = plan(&renders, &[], None, false);
         assert!(w.mic_render.is_none());
         assert_eq!(w.loopback_render.unwrap().0, "Speakers (Realtek HD Audio)");
     }
@@ -887,7 +854,7 @@ mod tests {
         ];
         let captures = [ep("Voicemeeter Out B1 (VB-Audio Voicemeeter VAIO)")];
         for host_audio in [false, true] {
-            let w = plan(&renders, &captures, None, host_audio, &[]);
+            let w = plan(&renders, &captures, None, host_audio);
             assert_eq!(
                 w.mic_render.as_ref().unwrap().0,
                 "Voicemeeter Input (VB-Audio Voicemeeter VAIO)",
@@ -910,7 +877,7 @@ mod tests {
             ep("Voicemeeter Aux Input (VB-Audio Voicemeeter AUX VAIO)"),
         ];
         for host_audio in [false, true] {
-            let w = plan(&renders, &[], None, host_audio, &[]);
+            let w = plan(&renders, &[], None, host_audio);
             assert!(w.mic_render.is_some(), "host_audio={host_audio}");
             assert!(w.loopback_render.is_none(), "host_audio={host_audio}");
         }
@@ -925,7 +892,7 @@ mod tests {
             ep("CABLE Input (VB-Audio Virtual Cable)"),
             ep("Speakers (Some Virtual Audio Device)"),
         ];
-        let w = plan(&renders, &[], None, false, &[]);
+        let w = plan(&renders, &[], None, false);
         assert!(w.loopback_render.is_none());
     }
 
@@ -951,7 +918,7 @@ mod tests {
         // Field shape minus the Speakers (mic holds the Streaming Microphone, nothing else).
         let renders = [ep("Altavoces (Steam Streaming Microphone)")];
         let captures = [ep("Microphone (Steam Streaming Microphone)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert!(w.loopback_unsatisfiable());
         let msg = describe_no_loopback(&renders, &w);
         assert!(msg.contains("reserved for the virtual mic"), "{msg}");
@@ -962,70 +929,10 @@ mod tests {
         // anyway), while the Steam pair is the remedy that adds a capturable sink.
         let renders = [ep("CABLE Input (VB-Audio Virtual Cable)")];
         let captures = [ep("CABLE Output (VB-Audio Virtual Cable)")];
-        let w = plan(&renders, &captures, None, false, &[]);
+        let w = plan(&renders, &captures, None, false);
         assert!(w.loopback_unsatisfiable());
         let msg = describe_no_loopback(&renders, &w);
         assert!(msg.contains("install Steam"), "{msg}");
         assert!(!msg.contains("install VB-Audio Virtual Cable"), "{msg}");
     }
-
-    /// A stamped pad endpoint is invisible to the plan. Its name carries NO virtual marker — on
-    /// purpose, games must read it as the pad's speaker — so the name rules alone would classify
-    /// it as real hardware and hand it the loopback; only the id exclusion prevents that.
-    /// Measured fact: the wiring plan on the target box already enumerated a stamped endpoint.
-    #[test]
-    fn pad_endpoints_invisible() {
-        let renders = [
-            ep("DualSense Wireless Controller"),
-            ep("Speakers (Realtek HD Audio)"),
-        ];
-        let pads = [renders[0].1.clone()];
-        let w = plan(&renders, &[], None, false, &pads);
-        assert_eq!(w.loopback_render.unwrap().0, "Speakers (Realtek HD Audio)");
-        // Even an operator mic override matching the pad's name must not claim it; with the
-        // pad as the only render endpoint there is honestly no mic target and no loopback.
-        let w = plan(
-            &renders[..1],
-            &[],
-            Some("wireless controller"),
-            false,
-            &pads,
-        );
-        assert!(w.mic_render.is_none());
-        assert!(w.loopback_render.is_none());
-    }
-
-    /// The exclusion has to survive the LAST RESORT tier, which this merge introduced alongside
-    /// pad audio. `last_resort` matches on the Steam-Speakers name, but it reads the same
-    /// shadowed `renders`, so a pad can never be reached through it either — otherwise the whole
-    /// desktop mix would be routed into the controller's voice coils.
-    #[test]
-    fn a_pad_is_never_the_last_resort() {
-        // Only the pad and the Steam pair exist; the mic reserves the Streaming Microphone, so
-        // the plan falls all the way through to the last resort.
-        let renders = [
-            ep("DualSense Wireless Controller"),
-            ep("Speakers (Steam Streaming Microphone)"),
-            ep("Speakers (Steam Streaming Speakers)"),
-        ];
-        let captures = [ep("Microphone (Steam Streaming Microphone)")];
-        let pads = [renders[0].1.clone()];
-        let w = plan(&renders, &captures, None, false, &pads);
-        assert_eq!(
-            w.loopback_render.as_ref().unwrap().0,
-            "Speakers (Steam Streaming Speakers)",
-            "the last resort must skip the pad"
-        );
-        assert!(w.loopback_last_resort);
-
-        // …and with the pad as the ONLY candidate left, the plan stays honestly unsatisfiable
-        // rather than falling back onto the coils.
-        let w = plan(&renders[..1], &captures, None, false, &pads);
-        assert!(
-            w.loopback_render.is_none(),
-            "a pad was taken as the last resort"
-        );
-        assert!(!w.loopback_last_resort);
-        assert!(w.loopback_unsatisfiable());
-    }
 }

crates/punktfunk-host/src/devtest.rs

@@ -384,7 +384,6 @@ pub fn dualsense_windows_test(args: &[String]) -> Result<()> {
                 index: idx,
                 kind: 2,
                 capabilities: 0,
-                audio_caps: 0,
             });
             println!(
                 "virtual {} up — cycling Cross + sweeping the left stick for {secs}s. Watch \
@@ -431,7 +430,6 @@ pub fn dualsense_windows_test(args: &[String]) -> Result<()> {
             index: idx,
             kind: 1,
             capabilities: 0,
-            audio_caps: 0,
         });
         println!(
             "virtual Xbox 360 (XUSB) up — sweeping LS + toggling A for {secs}s. Check with \
@@ -488,119 +486,6 @@ pub fn dualsense_windows_test(args: &[String]) -> Result<()> {
     Ok(())
 }
 
-/// Windows: pad-audio endpoint provisioning — `pad-endpoint ensure|remove|status [--index N]`.
-/// `ensure` runs the idempotent startup path (reuse-or-create the devnode, bind the Steam
-/// Streaming Speakers driver, stamp the DualSense identity + 4ch/48k formats, report whether
-/// the stamps are SERVED); `status` prints the devnode/endpoint and per-stamp stored vs served
-/// state without changing anything; `remove` deletes the devnode via pnputil — the escape
-/// hatch only, endpoints are persistent by design. Stamping needs SYSTEM (the MMDevices ACL);
-/// run `ensure` under the service account or PsExec when the property-store route is denied.
-#[cfg(target_os = "windows")]
-pub fn pad_endpoint(args: &[String]) -> Result<()> {
-    use crate::audio::pad_endpoint as pe;
-    let idx: u8 = args
-        .iter()
-        .skip_while(|a| *a != "--index")
-        .nth(1)
-        .and_then(|s| s.parse().ok())
-        .unwrap_or(0);
-    // `--endpoint <id>` drives ANY render endpoint, not just a provisioned pad one. It is the
-    // discriminator between "this process cannot activate anything" and "our endpoint is broken":
-    // aim the same binary at a known-good endpoint and see whether it succeeds there.
-    let endpoint_override: Option<String> = args
-        .iter()
-        .skip_while(|a| *a != "--endpoint")
-        .nth(1)
-        .cloned();
-    match args.get(1).map(String::as_str) {
-        Some("ensure") => {
-            let p = pe::ensure(idx)?;
-            println!(
-                "pad-endpoint ensure: pad {} devnode {} endpoint {} needs_aeb_kick={}",
-                p.pad_index, p.device_instance, p.endpoint_id, p.needs_aeb_kick
-            );
-            Ok(())
-        }
-        Some("remove") => match pe::find(idx)? {
-            Some(p) => {
-                pe::remove(&p);
-                println!(
-                    "pad-endpoint remove: requested removal of {}",
-                    p.device_instance
-                );
-                Ok(())
-            }
-            None => {
-                println!("pad-endpoint remove: no pad-audio devnode for index {idx}");
-                Ok(())
-            }
-        },
-        // `punktfunk-host pad-endpoint <n> tone [seconds] [hz]` — drive the endpoint directly so
-        // the whole pad-audio chain can be exercised without a game. Without this, every attempt
-        // costs a game launch and a failure does not say which link broke.
-        Some("tone") => {
-            let secs: u32 = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(5);
-            let hz: f32 = args.get(3).and_then(|s| s.parse().ok()).unwrap_or(60.0);
-            let endpoint_id = match endpoint_override {
-                Some(id) => id,
-                None => {
-                    // `find` (a system lookup), NOT `endpoint_for` (the service's in-process
-                    // cache): this runs as a separate CLI process and has no cache of its own.
-                    let Some(ep) = pe::find(idx)? else {
-                        println!(
-                            "pad-endpoint tone: no pad-audio devnode for pad {idx} — run \
-                             `ensure` first"
-                        );
-                        return Ok(());
-                    };
-                    if ep.endpoint_id.is_empty() {
-                        println!("pad-endpoint tone: pad {idx} has no endpoint id yet");
-                        return Ok(());
-                    }
-                    ep.endpoint_id
-                }
-            };
-            // `--pair front` drives the pad's SPEAKER instead of the voice coils — the only way to
-            // exercise the speaker kind without a game that renders one.
-            let pair = args
-                .iter()
-                .skip_while(|a| *a != "--pair")
-                .nth(1)
-                .map_or(pe::TonePair::Back, |s| pe::TonePair::parse(s));
-            println!(
-                "pad-endpoint tone: {hz} Hz into the {} of {endpoint_id} for {secs}s",
-                pair.label()
-            );
-            pe::render_test_tone(&endpoint_id, secs, hz, pair)?;
-            println!(
-                "pad-endpoint tone: done. A connected client with pad audio enabled should have \
-                 buzzed; the host log shows whether the gate opened."
-            );
-            Ok(())
-        }
-        // `punktfunk-host pad-endpoint capture [seconds]` — the receiving half of `tone`. Run
-        // both at once to exercise render -> engine -> loopback -> pair routing with no game and
-        // no client attached.
-        Some("capture") => {
-            let secs: u32 = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(5);
-            let endpoint_id = match endpoint_override {
-                Some(id) => id,
-                None => match pe::find(idx)? {
-                    Some(ep) if !ep.endpoint_id.is_empty() => ep.endpoint_id,
-                    _ => {
-                        println!("pad-endpoint capture: pad {idx} has no endpoint — run `ensure`");
-                        return Ok(());
-                    }
-                },
-            };
-            println!("pad-endpoint capture: listening on {endpoint_id} for {secs}s");
-            pe::capture_probe(&endpoint_id, secs)
-        }
-        Some("status") => pe::print_status(idx),
-        _ => anyhow::bail!("usage: punktfunk-host pad-endpoint <ensure|remove|status> [--index N]"),
-    }
-}
-
 /// Mirror a physical monitor and pull frames from it — the on-glass gate for per-monitor capture
 /// (`design/per-monitor-portal-capture.md` P2/P3), without needing a client to connect.
 ///

crates/punktfunk-host/src/gamestream/gamepad.rs

@@ -65,8 +65,6 @@ pub fn decode(plaintext: &[u8]) -> Option<GamepadEvent> {
             index: *b.first()?,
             kind: *b.get(1)?,
             capabilities: le16(2)? as u16,
-            // GameStream's LI_CCAP vocabulary can't express pad audio — native-plane only.
-            audio_caps: 0,
         }),
         _ => None,
     }
@@ -140,7 +138,6 @@ mod tests {
             index,
             kind,
             capabilities,
-            ..
         }) = decode(&wrap(MAGIC_CONTROLLER_ARRIVAL, &body))
         else {
             panic!("expected Arrival");

crates/punktfunk-host/src/main.rs

@@ -618,10 +618,6 @@ fn real_main() -> Result<()> {
         // hold it, driving the real *WindowsManager end to end. `--index N`, `--seconds N`.
         #[cfg(target_os = "windows")]
         Some("dualsense-windows-test") => devtest::dualsense_windows_test(&args),
-        // Windows: pad-audio endpoint provisioning (`ensure`/`status`) + the pnputil removal
-        // escape hatch (`remove`). `--index N` selects the pad slot (default 0).
-        #[cfg(target_os = "windows")]
-        Some("pad-endpoint") => devtest::pad_endpoint(&args),
         // Capture→encode→file pipeline spike (dev tool).
         Some("spike") => spike::run(parse_spike(&args[1..])?),
         // Native punktfunk/1 host (QUIC control plane + UDP data plane).

crates/punktfunk-host/src/native.rs

@@ -62,12 +62,6 @@ use pairing::pair_ceremony;
 mod audio;
 use audio::audio_thread;
 
-/// Per-pad DualSense audio (the 0xD1 plane): loopback capture of the pre-provisioned pad
-/// endpoints → per-kind silence gate → stereo Opus → `PAD_AUDIO_MAGIC` datagrams. The input
-/// thread spawns/reaps one streamer per arriving pad (`input`); the Welcome advertises the cap
-/// via `pad_audio::host_cap` (`handshake`).
-mod pad_audio;
-
 /// The native input plane (plan §W1); the session setup spawns `input_thread` and feeds it a
 /// channel of `ClientInput`. The `Pads` router + rumble live there too.
 mod input;
@@ -351,14 +345,6 @@ pub(crate) async fn serve(
     // binds its capture device) and self-heals when the backend dies (PipeWire restart, Windows
     // endpoint churn).
     let mic_service = crate::audio::MicPump::start();
-    // Windows, env-gated (PUNKTFUNK_PAD_AUDIO / _SLOTS): pre-provision the per-pad "DualSense
-    // speaker" render endpoints once per host lifetime — idempotent devnode + stamp work on a
-    // dedicated COM thread, results published for sessions to query by pad index
-    // (crate::audio::pad_endpoint::endpoint_for). If any stamp is stored-but-not-served, the
-    // worker performs ONE AudioEndpointBuilder+Audiosrv restart now, before any session exists.
-    // Failures log once and leave the feature off: pads still work, just without pad audio.
-    #[cfg(target_os = "windows")]
-    crate::audio::pad_endpoint::provision_at_startup();
     // Host-lifetime worker that fires debounced TV-session restores (the managed gamescope path
     // restores the box's autologin gaming session on idle, not per-disconnect — see
     // `vdisplay::restore_managed_session`). Held for serve()'s lifetime; dropping it stops it.
@@ -1217,14 +1203,9 @@ async fn serve_session(
     let input_handle = {
         let conn = conn.clone();
         let gamepad = welcome.gamepad;
-        // Pad audio (0xD1) negotiated: the Welcome advertised the cap (Windows + provisioned
-        // endpoints + the client asked — handshake reads `pad_audio::host_cap`). Read back off
-        // the Welcome rather than recomputed, so the input thread's spawns cannot disagree
-        // with what the client was told.
-        let pad_audio_on = welcome.host_caps & punktfunk_core::quic::HOST_CAP_PAD_AUDIO != 0;
         std::thread::Builder::new()
             .name("punktfunk1-input".into())
-            .spawn(move || input_thread(input_rx, conn, inj_tx, gamepad, pad_audio_on))
+            .spawn(move || input_thread(input_rx, conn, inj_tx, gamepad))
             .context("spawn input thread")?
     };
     // One reader for ALL client→host datagrams, demuxed by magic byte (two read_datagram loops

crates/punktfunk-host/src/native/handshake.rs

@@ -640,16 +640,6 @@ pub(super) async fn negotiate(
                 punktfunk_core::quic::HOST_CAP_AUDIO_RED
             } else {
                 0
-            }
-            // Per-pad DualSense audio (0xD1 + HidOutput::AudioCtl): granted only when the
-            // client asked AND this host can capture it — Windows with the feature enabled
-            // and at least one pad endpoint provisioned at startup. A capable client then
-            // marks its pads' renderers on their arrivals; the input thread streams toward
-            // exactly those pads (`super::pad_audio`).
-            | if super::pad_audio::host_cap(hello.client_caps) {
-                punktfunk_core::quic::HOST_CAP_PAD_AUDIO
-            } else {
-                0
             },
         // The negotiated session AEAD (resolved above) + its 32-byte key toward a ChaCha
         // client; toward everyone else cipher 0 keeps the Welcome byte-identical to the

crates/punktfunk-host/src/native/input.rs

@@ -515,100 +515,6 @@ impl Pads {
     }
 }
 
-/// Per-pad 0xD1 streamers (`super::pad_audio`), keyed by pad index like every per-pad table
-/// here (bounded by [`MAX_WIRE_PADS`]; only slots 0..4 can ever have a provisioned endpoint —
-/// `spawn` refuses the rest). Spawned when a negotiated session's DualSense-family arrival
-/// declares renderer bits, reaped on remove / re-declare / session teardown.
-struct PadAudioSlots {
-    /// `(kinds, handle)` per running pad — `kinds` is the arrival's audio-caps mask, kept so
-    /// an identical re-arrival (they are re-sent against datagram loss) is a no-op.
-    slots: [Option<(u8, pad_audio::PadAudioHandle)>; MAX_WIRE_PADS],
-    /// Kind-change restarts spent per pad this session (R3). The trigger is a client-sent
-    /// arrival, so without a ceiling the client decides how many WASAPI captures the host opens.
-    restarts: [u8; MAX_WIRE_PADS],
-}
-
-/// R3: how many times one pad may change its declared audio kinds before the host stops
-/// obliging. A real controller declares once at open and never again; the re-sent arrivals are
-/// identical and take the no-op path above, so this is only reached by a client that keeps
-/// changing its mind.
-const MAX_PAD_AUDIO_RESTARTS: u8 = 8;
-
-impl PadAudioSlots {
-    fn new() -> PadAudioSlots {
-        PadAudioSlots {
-            slots: std::array::from_fn(|_| None),
-            restarts: [0; MAX_WIRE_PADS],
-        }
-    }
-
-    /// Idempotent spawn: same kinds → keep the running streamer; changed kinds → restart with
-    /// the new mask; not running → spawn (a slot without an endpoint stays empty — bounded
-    /// retries, since arrivals are only re-sent a few times per slot open).
-    fn ensure(&mut self, conn: &quinn::Connection, pad: u8, kinds: u8) {
-        let idx = pad as usize;
-        if idx >= MAX_WIRE_PADS {
-            return;
-        }
-        if let Some((have, _)) = &self.slots[idx] {
-            if *have == kinds {
-                return; // identical re-arrival — keep the running streamer
-            }
-            // R3: the restart trigger is a CLIENT-sent arrival, so the count is client-driven.
-            // Nothing bounded it: a client alternating its declared kinds could make the host
-            // tear down and re-spawn a WASAPI loopback capture indefinitely, each cycle paying a
-            // thread spawn and an endpoint activation. Cheap to bound, and a pad that has already
-            // changed its mind this many times in one session is not doing anything legitimate.
-            if self.restarts[idx] >= MAX_PAD_AUDIO_RESTARTS {
-                tracing::warn!(
-                    pad = idx,
-                    "pad-audio kinds changed again after {MAX_PAD_AUDIO_RESTARTS} restarts — \
-                     ignoring; the streamer keeps its current kinds for this session"
-                );
-                return;
-            }
-            self.restarts[idx] += 1;
-            tracing::info!(
-                pad = idx,
-                restarts = self.restarts[idx],
-                "pad-audio kinds changed — restarting the streamer"
-            );
-            self.stop(idx);
-        }
-        let stop = Arc::new(AtomicBool::new(false));
-        if let Some(h) = pad_audio::spawn(conn.clone(), pad, kinds, stop) {
-            self.slots[idx] = Some((kinds, h));
-        }
-    }
-
-    /// Stop + reap one pad's streamer. The join rides a detached reaper thread: a quiet pad's
-    /// capturer can sit out its ~5 s recv timeout, and this thread must keep its ≤4 ms
-    /// feedback cadence (games block on GET_REPORT handshakes) — the reaper still joins, just
-    /// not here. A failed reaper spawn falls back to the handle's own drop (signal + join).
-    fn stop(&mut self, idx: usize) {
-        if let Some((_, h)) = self.slots.get_mut(idx).and_then(|s| s.take()) {
-            h.signal();
-            let _ = std::thread::Builder::new()
-                .name("punktfunk1-padreap".into())
-                .spawn(move || h.stop());
-        }
-    }
-
-    /// Session teardown: flag every streamer FIRST so they wind down concurrently, then join —
-    /// the worst case is ONE quiet-endpoint recv timeout (~5 s), well inside the session's
-    /// 10 s side-thread join grace, not one per pad.
-    fn stop_all(&mut self) {
-        for s in self.slots.iter().flatten() {
-            s.1.signal();
-        }
-        for s in &mut self.slots {
-            if let Some((_, h)) = s.take() {
-                h.stop();
-            }
-        }
-    }
-}
-
 /// One client→host input item, both planes on ONE channel so the input thread wakes the
 /// moment either arrives (a second rich channel drained after the 4 ms recv timeout cost
 /// every pure-gyro motion sample up to 4 ms of quantization).
@@ -777,13 +683,8 @@ pub(super) fn input_thread(
     conn: quinn::Connection,
     inj_tx: std::sync::mpsc::Sender<InputEvent>,
     gamepad: GamepadPref,
-    pad_audio_on: bool,
 ) {
     let mut pads = Pads::new(gamepad);
-    // Per-pad 0xD1 audio streamers, live only when the Welcome granted the cap (`pad_audio_on`
-    // — read back off the negotiated host_caps). Spawned on DualSense-family arrivals that
-    // declare renderer bits, reaped on remove/teardown below.
-    let mut pad_streams = PadAudioSlots::new();
     // Motion-cadence observability (debug level): inter-arrival percentiles per 5 s window,
     // the measurement a "gyro feels floaty" report needs. Bounded: 5 s at even a 1 kHz pad
     // is 5000 u32s.
@@ -953,53 +854,16 @@ pub(super) fn input_thread(
                             &mut rumble_seen[idx],
                             &mut rumble_stop_burst[idx],
                         );
-                        // The unplugged pad's 0xD1 streamer goes with it (seq-gated like the
-                        // rest of this arm, so a reordered stale removal can't kill the
-                        // stream of a re-plugged pad). A re-plug re-arrives and re-spawns.
-                        pad_streams.stop(idx);
                     }
                 }
                 InputKind::GamepadArrival => {
                     // Per-pad controller kind declaration (mixed types): route this pad's future
-                    // frames to a backend of the declared kind. `code` = the GamepadPref wire
-                    // byte, `flags` = pad index in the LOW BYTE — bits 8/9 carry the pad's
-                    // audio-render caps (haptics/speaker) from a pad-audio-capable client, so
-                    // the index MUST come from `decode_gamepad_arrival`, never the whole word.
-                    // Applied before the pad's first frame (the client sends it on slot open),
-                    // so the device is built as the right type from the start. The audio caps
-                    // are surfaced here for the 0xD1 capture path (which emits pad audio only
-                    // toward pads that declared a renderer).
-                    let (pad, audio_caps) = punktfunk_core::input::decode_gamepad_arrival(ev.flags);
-                    let idx = pad as usize;
+                    // frames to a backend of the declared kind. `code` = the GamepadPref wire byte,
+                    // `flags` = pad index. Applied before the pad's first frame (the client sends it
+                    // on slot open), so the device is built as the right type from the start.
+                    let idx = ev.flags as usize;
                     let kind = GamepadPref::from_u8(ev.code as u8);
-                    if audio_caps != 0 {
-                        tracing::debug!(
-                            pad = idx,
-                            haptics = audio_caps & 0x01 != 0,
-                            speaker = audio_caps & 0x02 != 0,
-                            "pad-audio render caps declared (arrival flags bits 8/9)"
-                        );
-                    }
                     pads.set_kind(idx, kind);
-                    // Pad audio (0xD1): stream toward DualSense-family pads that declared a
-                    // renderer, only on a session that negotiated the cap. Idempotent across
-                    // the arrival re-sends (same kinds keeps the running streamer); a
-                    // re-declare without bits — or as a kind with no pad audio — stops it.
-                    if pad_audio_on {
-                        let want = if matches!(
-                            kind,
-                            GamepadPref::DualSense | GamepadPref::DualSenseEdge
-                        ) {
-                            audio_caps
-                        } else {
-                            0
-                        };
-                        if want != 0 {
-                            pad_streams.ensure(&conn, pad, want);
-                        } else {
-                            pad_streams.stop(idx);
-                        }
-                    }
                 }
                 _ => {
                     // Track press/release so a mid-press disconnect can be undone below.
@@ -1155,9 +1019,6 @@ pub(super) fn input_thread(
             flags: 0,
         });
     }
-    // Reap the per-pad 0xD1 streamers with the session (after the instant release sends above
-    // — this can block on a quiet pad's capturer timeout, see PadAudioSlots::stop_all).
-    pad_streams.stop_all();
 }
 
 #[cfg(test)]

crates/punktfunk-host/src/native/pad_audio.rs

@@ -1,662 +0,0 @@
-//! Per-pad DualSense audio (the 0xD1 pad-audio plane): WASAPI loopback of a pre-provisioned pad
-//! endpoint ([`crate::audio::pad_endpoint`]) → 4-ch de-interleave into the speaker (front) and
-//! voice-coil haptics (back) pairs → per-kind silence gate → stereo Opus (48 kHz, CBR, LowDelay)
-//! → [`PAD_AUDIO_MAGIC`](punktfunk_core::quic::PAD_AUDIO_MAGIC) datagrams. One thread per
-//! arriving pad, spawned/reaped by the input thread ([`super::input`]) as arrivals declare
-//! renderers and pads leave. Modeled on the session audio thread ([`super::audio`]): the same
-//! reopen-with-backoff on capture death, the same monotonic-seq-kept-across-reopens discipline,
-//! the same power-of-two encode-warn throttle.
-
-use super::*;
-
-/// `kinds` bit for the haptics stream (bit N = wire kind N — the same packing the arrival's
-/// audio-caps bits use, see [`punktfunk_core::input::decode_gamepad_arrival`]).
-#[cfg(any(target_os = "windows", test))]
-pub(super) const KIND_BIT_HAPTICS: u8 = 1 << punktfunk_core::quic::PAD_AUDIO_KIND_HAPTICS;
-/// `kinds` bit for the speaker stream.
-#[cfg(any(target_os = "windows", test))]
-pub(super) const KIND_BIT_SPEAKER: u8 = 1 << punktfunk_core::quic::PAD_AUDIO_KIND_SPEAKER;
-
-/// Haptics frames are 5 ms (the session-audio cadence — haptics are felt latency); speaker
-/// frames are 10 ms (speaker content tolerates the buffering for the coding efficiency). Both
-/// are the wire contract's cadences (`punktfunk_core::quic::PAD_AUDIO_KIND_*`).
-#[cfg(any(target_os = "windows", test))]
-const HAPTICS_FRAME_MS: u32 = 5;
-#[cfg(any(target_os = "windows", test))]
-const SPEAKER_FRAME_MS: u32 = 10;
-/// Samples per frame (per channel) at 48 kHz: 240 / 480.
-#[cfg(any(target_os = "windows", test))]
-const HAPTICS_FRAME_SAMPLES: usize =
-    crate::audio::SAMPLE_RATE as usize * HAPTICS_FRAME_MS as usize / 1000;
-#[cfg(any(target_os = "windows", test))]
-const SPEAKER_FRAME_SAMPLES: usize =
-    crate::audio::SAMPLE_RATE as usize * SPEAKER_FRAME_MS as usize / 1000;
-/// The capture's channel count — the pad endpoint is stamped quad (FL FR BL BR: front pair =
-/// speaker, back pair = voice coils). Mirrors `pad_endpoint::PAD_CHANNELS` (Windows-gated, so
-/// the pure splitter logic keeps its own copy).
-#[cfg(any(target_os = "windows", test))]
-const CAP_CHANNELS: usize = 4;
-
-/// Peak (absolute sample) at or above which a frame counts as signal — the gate OPENS on that
-/// very frame (haptics are felt latency; the first active frame must ship). ≈ −60 dBFS.
-#[cfg(any(target_os = "windows", test))]
-const GATE_OPEN_PEAK: f32 = 1e-3;
-/// How long the gate keeps sending after the last signal frame before it CLOSES (hangover):
-/// long enough that a decaying haptic tail (and the client decoder's own tail) is never
-/// clipped, short enough that an idle pad costs nothing in steady state.
-#[cfg(any(target_os = "windows", test))]
-const GATE_HANGOVER_MS: u32 = 250;
-
-/// Per-kind Opus bitrate — a stereo voice-coil / pad-speaker pair needs far less than the
-/// session plane's 128 kbps; 64 kbps CBR keeps every frame comfortably under one MTU.
-#[cfg(target_os = "windows")]
-const PAD_AUDIO_BITRATE: i32 = 64_000;
-
-/// The per-kind silence gate — the steady-state-cost feature: an idle pad endpoint (games
-/// rarely render pad audio) must cost ZERO encodes and ZERO datagrams, not a permanent 200 Hz
-/// stream of coded silence. Opens the instant a frame carries signal ([`GATE_OPEN_PEAK`]);
-/// closes only after [`GATE_HANGOVER_MS`] of continuous sub-threshold frames. Pure logic,
-/// unit-tested below.
-#[cfg(any(target_os = "windows", test))]
-struct SilenceGate {
-    /// Consecutive sub-threshold frames that close the gate ([`GATE_HANGOVER_MS`] ÷ frame ms).
-    hangover_frames: u32,
-    /// Consecutive sub-threshold frames seen so far while open.
-    quiet: u32,
-    /// Starts closed: a pad no game ever renders into never opens (and never sends).
-    open: bool,
-}
-
-#[cfg(any(target_os = "windows", test))]
-impl SilenceGate {
-    fn new(frame_ms: u32) -> SilenceGate {
-        SilenceGate {
-            hangover_frames: (GATE_HANGOVER_MS / frame_ms).max(1),
-            quiet: 0,
-            open: false,
-        }
-    }
-
-    /// Feed one frame; `true` = encode + send it. Signal opens the gate on THIS frame; the
-    /// frame that completes the hangover closes it and is itself suppressed (the client
-    /// already has ~250 ms of ramped-out silence by then).
-    fn feed(&mut self, frame: &[f32]) -> bool {
-        if frame.iter().any(|s| s.abs() >= GATE_OPEN_PEAK) {
-            self.open = true;
-            self.quiet = 0;
-        } else if self.open {
-            self.quiet += 1;
-            if self.quiet >= self.hangover_frames {
-                self.open = false;
-                self.quiet = 0;
-            }
-        }
-        self.open
-    }
-}
-
-/// One kind's send-admission + seq bookkeeping (pure logic — the capture thread wraps it with
-/// the encoder and the datagram send). `seq` is monotonic per (pad, kind) and NEVER advances
-/// while the gate is closed: frozen-seq = deliberate silence — the client tells silence from
-/// loss by seq continuity (the mic-mute discipline, pf-client-core/src/audio.rs). It is also
-/// kept across capture reopens (the session audio thread's discipline, audio.rs): the client
-/// sees a gap, not a restart.
-#[cfg(any(target_os = "windows", test))]
-struct LaneCtl {
-    gate: SilenceGate,
-    seq: u32,
-}
-
-#[cfg(any(target_os = "windows", test))]
-impl LaneCtl {
-    fn new(frame_ms: u32) -> LaneCtl {
-        LaneCtl {
-            gate: SilenceGate::new(frame_ms),
-            seq: 0,
-        }
-    }
-
-    /// Admit one frame: `Some(seq)` = encode + send it with this seq (advanced for the next);
-    /// `None` = gated — do not send, do not advance. An encode failure AFTER admission leaves a
-    /// one-frame seq gap, which the client conceals exactly like datagram loss.
-    fn admit(&mut self, frame: &[f32]) -> Option<u32> {
-        if !self.gate.feed(frame) {
-            return None;
-        }
-        let seq = self.seq;
-        self.seq = self.seq.wrapping_add(1);
-        Some(seq)
-    }
-}
-
-/// De-interleave one 4-ch block (FL FR BL BR) into its stereo pairs: `(front, back)` — front =
-/// speaker (channels 0/1), back = voice-coil haptics (channels 2/3). A ragged tail (not a
-/// multiple of 4 — the capturer only ever delivers whole frames) is dropped, never smeared
-/// across channels.
-#[cfg(any(target_os = "windows", test))]
-fn split_quad(block: &[f32]) -> (Vec<f32>, Vec<f32>) {
-    let mut front = Vec::with_capacity(block.len() / 2);
-    let mut back = Vec::with_capacity(block.len() / 2);
-    for s in block.chunks_exact(CAP_CHANNELS) {
-        front.extend_from_slice(&s[..2]);
-        back.extend_from_slice(&s[2..4]);
-    }
-    (front, back)
-}
-
-/// Accumulates interleaved 4-ch capture and cuts it into the wire contract's per-kind stereo
-/// frames — haptics every 5 ms from the back pair, speaker every 10 ms from the front pair —
-/// emitting ONLY the kinds enabled in `kinds` (a disabled kind is never even split out, so it
-/// can never reach an encoder). Pure logic, unit-tested; the capture thread wraps it.
-#[cfg(any(target_os = "windows", test))]
-struct PadFramer {
-    kinds: u8,
-    /// Raw interleaved 4-ch accumulation, drained in 5 ms blocks.
-    acc: Vec<f32>,
-    /// Front-pair stereo accumulation toward the next 10 ms speaker frame.
-    front: Vec<f32>,
-}
-
-#[cfg(any(target_os = "windows", test))]
-impl PadFramer {
-    fn new(kinds: u8) -> PadFramer {
-        PadFramer {
-            kinds,
-            acc: Vec::with_capacity(HAPTICS_FRAME_SAMPLES * CAP_CHANNELS * 4),
-            front: Vec::new(),
-        }
-    }
-
-    /// Feed one capture chunk; `emit(kind, stereo_frame)` fires for each completed frame
-    /// (haptics first — it is the latency-critical pair).
-    fn feed(&mut self, chunk: &[f32], mut emit: impl FnMut(u8, &[f32])) {
-        self.acc.extend_from_slice(chunk);
-        let block_len = HAPTICS_FRAME_SAMPLES * CAP_CHANNELS;
-        while self.acc.len() >= block_len {
-            let block: Vec<f32> = self.acc.drain(..block_len).collect();
-            let (front, back) = split_quad(&block);
-            if self.kinds & KIND_BIT_HAPTICS != 0 {
-                emit(punktfunk_core::quic::PAD_AUDIO_KIND_HAPTICS, &back);
-            }
-            if self.kinds & KIND_BIT_SPEAKER != 0 {
-                self.front.extend_from_slice(&front);
-                let frame_len = SPEAKER_FRAME_SAMPLES * 2;
-                while self.front.len() >= frame_len {
-                    let frame: Vec<f32> = self.front.drain(..frame_len).collect();
-                    emit(punktfunk_core::quic::PAD_AUDIO_KIND_SPEAKER, &frame);
-                }
-            }
-        }
-    }
-
-    /// Drop the partial frames straddling a capture gap (reopen). The seq/gate state is NOT
-    /// here — [`LaneCtl`] deliberately survives reopens, so the client sees a gap, not a
-    /// restart.
-    fn clear(&mut self) {
-        self.acc.clear();
-        self.front.clear();
-    }
-}
-
-/// A running per-pad streamer. [`stop`](PadAudioHandle::stop) (or drop) flags the thread and
-/// joins it; [`signal`](PadAudioHandle::signal) only flags — the input thread's teardown flags
-/// every pad first so the joins overlap instead of serializing the capturer's worst-case ~5 s
-/// quiet-endpoint recv timeout.
-pub(super) struct PadAudioHandle {
-    stop: Arc<AtomicBool>,
-    join: Option<std::thread::JoinHandle<()>>,
-}
-
-impl PadAudioHandle {
-    /// Flag the streamer to wind down without waiting for it.
-    pub(super) fn signal(&self) {
-        self.stop.store(true, Ordering::SeqCst);
-    }
-
-    /// Stop + reap. Bounded by the capturer's ~5 s quiet-endpoint recv timeout in the worst
-    /// case — the mid-session reap paths run this on a detached reaper thread for that reason
-    /// (`input.rs::PadAudioSlots::stop`); session teardown affords it inline (the 10 s
-    /// side-thread join grace covers it).
-    pub(super) fn stop(mut self) {
-        self.reap();
-    }
-
-    fn reap(&mut self) {
-        self.signal();
-        if let Some(join) = self.join.take() {
-            let _ = join.join();
-        }
-    }
-}
-
-/// A handle dropped without `stop()` (reaper-spawn failure) still winds its thread down.
-impl Drop for PadAudioHandle {
-    fn drop(&mut self) {
-        self.reap();
-    }
-}
-
-/// Whether this session's Welcome should advertise
-/// [`HOST_CAP_PAD_AUDIO`](punktfunk_core::quic::HOST_CAP_PAD_AUDIO): the client asked
-/// ([`CLIENT_CAP_PAD_AUDIO`](punktfunk_core::quic::CLIENT_CAP_PAD_AUDIO)), this is a Windows
-/// host with the feature on (`PUNKTFUNK_PAD_AUDIO` != "0"), and startup provisioning published
-/// at least one endpoint (`pad_endpoint::provision_at_startup`). Still-running provisioning
-/// reads as "none yet": a session racing host startup simply negotiates without pad audio and
-/// picks it up on its next connect.
-pub(super) fn host_cap(client_caps: u8) -> bool {
-    let asked = client_caps & punktfunk_core::quic::CLIENT_CAP_PAD_AUDIO != 0;
-    #[cfg(target_os = "windows")]
-    {
-        // R5: a startup attempt that failed transiently leaves nothing latched, so retry here —
-        // this is the first moment in a session's life that anyone asks whether pad audio exists.
-        if asked {
-            crate::audio::pad_endpoint::ensure_provisioned();
-        }
-        asked
-            && std::env::var_os("PUNKTFUNK_PAD_AUDIO").is_none_or(|v| v != "0")
-            && crate::audio::pad_endpoint::provisioned_endpoints()
-                .is_some_and(|eps| !eps.is_empty())
-    }
-    #[cfg(not(target_os = "windows"))]
-    {
-        // Only the Windows virtual DualSense exposes pad audio endpoints today.
-        let _ = asked;
-        false
-    }
-}
-
-/// Start the per-pad streamer toward `conn` for `pad`, streaming the kinds in `kinds` (bit 0 =
-/// haptics, bit 1 = speaker — the arrival's audio-caps packing). `stop` is this handle's own
-/// flag (fresh per spawn — pad streamers stop individually, not with the session). `None` when
-/// the slot has no provisioned endpoint (provisioning failed or still running, or the slot is
-/// past `PUNKTFUNK_PAD_AUDIO_SLOTS` — only 0..4 can ever have one) or the thread cannot spawn;
-/// the pad itself keeps working either way, just without audio.
-#[cfg(target_os = "windows")]
-pub(super) fn spawn(
-    conn: quinn::Connection,
-    pad: u8,
-    kinds: u8,
-    stop: Arc<AtomicBool>,
-) -> Option<PadAudioHandle> {
-    if kinds & (KIND_BIT_HAPTICS | KIND_BIT_SPEAKER) == 0 {
-        return None;
-    }
-    let Some(ep) = crate::audio::pad_endpoint::endpoint_for(pad) else {
-        tracing::debug!(
-            pad,
-            "pad-audio arrival for a slot without a provisioned endpoint — not streaming"
-        );
-        return None;
-    };
-    if ep.endpoint_id.is_empty() {
-        // The devnode-without-endpoint shape (`find`) — never in the provisioned set, but
-        // cheap to refuse rather than spin the open/backoff loop on an empty id.
-        return None;
-    }
-    if ep.needs_aeb_kick {
-        // R4: this flag was computed on every path and consulted nowhere past startup. It means
-        // the endpoint's stamps are STORED but not SERVED — the audio stack never picked up the
-        // DualSense identity — and startup's one restart did not fix it. Opening anyway is worse
-        // than refusing: `AUTOCONVERTPCM` makes a wrong-format endpoint initialize *successfully*,
-        // so the stream runs, the logs look healthy, and the haptics/speaker pair is mis-routed
-        // with nothing to point at. Decline, and say which reboot-shaped problem it is.
-        tracing::warn!(
-            pad,
-            endpoint = %ep.endpoint_id,
-            "pad endpoint stamps are stored but not served — the audio stack has not adopted the \
-             DualSense identity (a reboot, or a manual AudioEndpointBuilder+Audiosrv restart, \
-             clears it). Not streaming: the endpoint would open and mis-route."
-        );
-        return None;
-    }
-    let stop_t = stop.clone();
-    match std::thread::Builder::new()
-        .name(format!("punktfunk1-pad{pad}"))
-        .spawn(move || pad_audio_thread(conn, pad, kinds, ep.endpoint_id, stop_t))
-    {
-        Ok(join) => Some(PadAudioHandle {
-            stop,
-            join: Some(join),
-        }),
-        Err(e) => {
-            tracing::warn!(pad, error = %e, "pad-audio thread spawn failed — pad streams without audio");
-            None
-        }
-    }
-}
-
-/// Stub — pad endpoints exist only behind the Windows virtual DualSense; other hosts run pads
-/// without the audio side (and never advertise the cap, see [`host_cap`]).
-#[cfg(not(target_os = "windows"))]
-pub(super) fn spawn(
-    _conn: quinn::Connection,
-    _pad: u8,
-    _kinds: u8,
-    _stop: Arc<AtomicBool>,
-) -> Option<PadAudioHandle> {
-    None
-}
-
-/// One enabled kind's encoder lane: admission/seq control + its stereo Opus encoder + the
-/// power-of-two warn throttle (a stuck encoder would otherwise fail ~200 times a second).
-#[cfg(target_os = "windows")]
-struct Lane {
-    kind: u8,
-    ctl: LaneCtl,
-    enc: opus::Encoder,
-    encode_errs: u64,
-}
-
-/// Build one stereo encoder per enabled kind: 48 kHz LowDelay hard-CBR like the session audio
-/// plane ([`super::audio`]), at the pad plane's 64 kbps.
-#[cfg(target_os = "windows")]
-fn build_lanes(kinds: u8) -> Result<Vec<Lane>, opus::Error> {
-    let mut lanes = Vec::new();
-    for (bit, kind, frame_ms) in [
-        (
-            KIND_BIT_HAPTICS,
-            punktfunk_core::quic::PAD_AUDIO_KIND_HAPTICS,
-            HAPTICS_FRAME_MS,
-        ),
-        (
-            KIND_BIT_SPEAKER,
-            punktfunk_core::quic::PAD_AUDIO_KIND_SPEAKER,
-            SPEAKER_FRAME_MS,
-        ),
-    ] {
-        if kinds & bit == 0 {
-            continue;
-        }
-        let mut enc = opus::Encoder::new(
-            crate::audio::SAMPLE_RATE,
-            opus::Channels::Stereo,
-            opus::Application::LowDelay,
-        )?;
-        enc.set_bitrate(opus::Bitrate::Bits(PAD_AUDIO_BITRATE)).ok();
-        enc.set_vbr(false).ok();
-        lanes.push(Lane {
-            kind,
-            ctl: LaneCtl::new(frame_ms),
-            enc,
-            encode_errs: 0,
-        });
-    }
-    Ok(lanes)
-}
-
-/// The per-pad streaming thread: loopback capture → framer → per-kind gate/encode → 0xD1
-/// datagrams. Capture death reopens with the session-audio backoff ([`INJECTOR_REOPEN_BACKOFF`],
-/// encoders + seq kept); a send error ends the thread (the connection — the session — is gone).
-#[cfg(target_os = "windows")]
-fn pad_audio_thread(
-    conn: quinn::Connection,
-    pad: u8,
-    kinds: u8,
-    endpoint_id: String,
-    stop: Arc<AtomicBool>,
-) {
-    use crate::audio::AudioCapturer as _;
-    let mut lanes = match build_lanes(kinds) {
-        Ok(l) => l,
-        Err(e) => {
-            tracing::warn!(pad, error = %e, "pad-audio opus encoder init failed — pad continues without audio");
-            return;
-        }
-    };
-    if lanes.is_empty() {
-        return; // spawn() refuses kinds == 0 — belt and braces
-    }
-    let mut framer = PadFramer::new(kinds);
-    // One Opus frame per datagram; 64 kbps CBR at ≤10 ms is ~80 bytes — sized with the session
-    // plane's slack.
-    let mut opus_buf = vec![0u8; 1500];
-    // Reopen-with-backoff (the audio.rs discipline): a capture death (endpoint invalidated,
-    // audio-engine restart) reopens instead of muting the pad for the rest of the session. The
-    // first open ALSO rides this loop, so an open lost to endpoint churn starts late, not never.
-    let mut capturer: Option<crate::audio::pad_endpoint::PadLoopbackCapturer> = None;
-    let mut last_failed: Option<std::time::Instant> = None;
-    tracing::info!(
-        pad,
-        haptics = kinds & KIND_BIT_HAPTICS != 0,
-        speaker = kinds & KIND_BIT_SPEAKER != 0,
-        "pad audio streaming (0xD1, Opus 48 kHz, silence-gated)"
-    );
-    'session: while !stop.load(Ordering::SeqCst) {
-        if capturer.is_none() {
-            if last_failed.is_some_and(|t| t.elapsed() < INJECTOR_REOPEN_BACKOFF) {
-                std::thread::sleep(std::time::Duration::from_millis(200));
-                continue;
-            }
-            match crate::audio::pad_endpoint::PadLoopbackCapturer::open(&endpoint_id) {
-                Ok(c) => {
-                    if last_failed.take().is_some() {
-                        tracing::info!(pad, "pad-audio capture reopened");
-                    }
-                    capturer = Some(c);
-                    framer.clear(); // drop the partial frames straddling the gap
-                }
-                Err(e) => {
-                    tracing::debug!(pad, error = %format!("{e:#}"), "pad-audio open failed — will retry");
-                    last_failed = Some(std::time::Instant::now());
-                    std::thread::sleep(std::time::Duration::from_millis(200));
-                    continue;
-                }
-            }
-        }
-        // An empty chunk is a QUIET endpoint (the capturer's idle timeout), not a death — keep
-        // it; only a genuine Err (capture thread ended) drops the capturer for reopen.
-        let chunk = match capturer.as_mut().unwrap().next_chunk() {
-            Ok(c) => c,
-            Err(e) => {
-                tracing::warn!(pad, error = %format!("{e:#}"), "pad-audio capture lost — reopening");
-                capturer = None;
-                last_failed = Some(std::time::Instant::now());
-                continue;
-            }
-        };
-        let mut session_gone = false;
-        framer.feed(&chunk, |kind, frame| {
-            if session_gone {
-                return;
-            }
-            let Some(lane) = lanes.iter_mut().find(|l| l.kind == kind) else {
-                return; // framer emits only enabled kinds — unreachable, but never panic here
-            };
-            // Gated = deliberate silence: no datagram AND a frozen seq (the client tells
-            // silence from loss by seq continuity).
-            let Some(seq) = lane.ctl.admit(frame) else {
-                return;
-            };
-            let pts_ns = now_ns();
-            match lane.enc.encode_float(frame, &mut opus_buf) {
-                Ok(n) => {
-                    let d = punktfunk_core::quic::encode_pad_audio_datagram(
-                        pad,
-                        kind,
-                        seq,
-                        pts_ns,
-                        &opus_buf[..n],
-                    );
-                    if conn.send_datagram(d.into()).is_err() {
-                        session_gone = true; // connection gone — the session is over
-                    }
-                }
-                Err(e) => {
-                    lane.encode_errs += 1;
-                    if lane.encode_errs.is_power_of_two() {
-                        tracing::warn!(
-                            pad,
-                            kind,
-                            error = %e,
-                            count = lane.encode_errs,
-                            "pad-audio opus encode failed — dropping frame"
-                        );
-                    }
-                }
-            }
-        });
-        if session_gone {
-            break 'session;
-        }
-    }
-    // Dropping the capturer stops its WASAPI thread. Nothing to park: pad capture is per-pad,
-    // per-session by design (unlike the session audio slot there is no cross-session reuse).
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use punktfunk_core::quic::{PAD_AUDIO_KIND_HAPTICS, PAD_AUDIO_KIND_SPEAKER};
-
-    /// A stereo frame of `n` samples at a constant level.
-    fn frame(level: f32, n: usize) -> Vec<f32> {
-        vec![level; n * 2]
-    }
-
-    #[test]
-    fn gate_opens_immediately_and_closes_after_hangover() {
-        let mut g = SilenceGate::new(HAPTICS_FRAME_MS);
-        // 250 ms of 5 ms frames.
-        assert_eq!(g.hangover_frames, 50);
-        // Closed from birth: an idle pad never sends.
-        assert!(!g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        // A peak at exactly the threshold opens on THIS frame (haptics are felt latency).
-        assert!(g.feed(&frame(GATE_OPEN_PEAK, HAPTICS_FRAME_SAMPLES)));
-        // 49 quiet frames ride the hangover; the 50th completes 250 ms and is suppressed.
-        for _ in 0..49 {
-            assert!(g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        }
-        assert!(!g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        // ... and stays closed.
-        assert!(!g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        // Sub-threshold wiggle does not reopen; real signal does (negative peaks count).
-        assert!(!g.feed(&frame(9e-4, HAPTICS_FRAME_SAMPLES)));
-        assert!(g.feed(&frame(-0.5, HAPTICS_FRAME_SAMPLES)));
-        // A loud frame mid-hangover rearms the full 250 ms.
-        for _ in 0..49 {
-            assert!(g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        }
-        assert!(g.feed(&frame(0.02, HAPTICS_FRAME_SAMPLES)));
-        for _ in 0..49 {
-            assert!(g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-        }
-        assert!(!g.feed(&frame(0.0, HAPTICS_FRAME_SAMPLES)));
-    }
-
-    #[test]
-    fn gate_hangover_scales_with_frame_ms() {
-        let mut g = SilenceGate::new(SPEAKER_FRAME_MS);
-        assert_eq!(g.hangover_frames, 25); // 250 ms of 10 ms frames
-        assert!(g.feed(&frame(0.1, SPEAKER_FRAME_SAMPLES)));
-        for _ in 0..24 {
-            assert!(g.feed(&frame(0.0, SPEAKER_FRAME_SAMPLES)));
-        }
-        assert!(!g.feed(&frame(0.0, SPEAKER_FRAME_SAMPLES)));
-    }
-
-    #[test]
-    fn seq_freezes_while_gated_and_survives_reopen() {
-        let mut lane = LaneCtl::new(HAPTICS_FRAME_MS);
-        // Two audible frames: seq 0, 1.
-        assert_eq!(lane.admit(&frame(0.5, HAPTICS_FRAME_SAMPLES)), Some(0));
-        assert_eq!(lane.admit(&frame(0.5, HAPTICS_FRAME_SAMPLES)), Some(1));
-        // The hangover is still sent (seq advances), then the gate closes and seq FREEZES —
-        // deliberate silence the client tells from loss by continuity.
-        for i in 0..49u32 {
-            assert_eq!(lane.admit(&frame(0.0, HAPTICS_FRAME_SAMPLES)), Some(2 + i));
-        }
-        for _ in 0..500 {
-            assert_eq!(lane.admit(&frame(0.0, HAPTICS_FRAME_SAMPLES)), None);
-        }
-        // A capture reopen resets ONLY the framer (PadFramer::clear) — LaneCtl is deliberately
-        // untouched, so the next audible frame CONTINUES the sequence (gap, not restart).
-        assert_eq!(lane.admit(&frame(0.9, HAPTICS_FRAME_SAMPLES)), Some(51));
-    }
-
-    #[test]
-    fn splitter_exact_pairs() {
-        // Interleave [FL FR BL BR] × 2 frames with distinct values everywhere.
-        let quad = [0.0, 1.0, 2.0, 3.0, 10.0, 11.0, 12.0, 13.0];
-        let (front, back) = split_quad(&quad);
-        assert_eq!(front, [0.0, 1.0, 10.0, 11.0]);
-        assert_eq!(back, [2.0, 3.0, 12.0, 13.0]);
-        // A ragged tail (never produced by the capturer) is dropped, not smeared.
-        let (front, back) = split_quad(&quad[..7]);
-        assert_eq!((front.len(), back.len()), (2, 2));
-    }
-
-    #[test]
-    fn framer_cuts_the_wire_cadence() {
-        let mut f = PadFramer::new(KIND_BIT_HAPTICS | KIND_BIT_SPEAKER);
-        let mut got: Vec<(u8, usize, f32)> = Vec::new();
-        // 10 ms of capture (480 samples), fed in ragged chunks: exactly two 5 ms haptics
-        // frames from the back pair, then one 10 ms speaker frame from the front pair.
-        let mut quad = Vec::new();
-        for _ in 0..2 * HAPTICS_FRAME_SAMPLES {
-            quad.extend_from_slice(&[0.25, 0.25, -0.5, -0.5]);
-        }
-        for chunk in quad.chunks(101) {
-            f.feed(chunk, |kind, frame| got.push((kind, frame.len(), frame[0])));
-        }
-        assert_eq!(
-            got,
-            vec![
-                (PAD_AUDIO_KIND_HAPTICS, 2 * HAPTICS_FRAME_SAMPLES, -0.5),
-                (PAD_AUDIO_KIND_HAPTICS, 2 * HAPTICS_FRAME_SAMPLES, -0.5),
-                (PAD_AUDIO_KIND_SPEAKER, 2 * SPEAKER_FRAME_SAMPLES, 0.25),
-            ]
-        );
-    }
-
-    #[test]
-    fn framer_masks_disabled_kinds() {
-        // 20 ms of all-ones capture: 4 potential haptics frames, 2 potential speaker frames.
-        let quad = vec![1.0f32; 4 * HAPTICS_FRAME_SAMPLES * CAP_CHANNELS];
-        let mut kinds_seen = Vec::new();
-        // Haptics-only: the front pair is never split out, let alone encoded.
-        let mut f = PadFramer::new(KIND_BIT_HAPTICS);
-        f.feed(&quad, |kind, _| kinds_seen.push(kind));
-        assert_eq!(kinds_seen, vec![PAD_AUDIO_KIND_HAPTICS; 4]);
-        // Speaker-only: no haptics frames.
-        let mut f = PadFramer::new(KIND_BIT_SPEAKER);
-        kinds_seen.clear();
-        f.feed(&quad, |kind, _| kinds_seen.push(kind));
-        assert_eq!(kinds_seen, vec![PAD_AUDIO_KIND_SPEAKER; 2]);
-        // kinds = 0 is never spawned, but the framer must still be total: nothing comes out.
-        let mut f = PadFramer::new(0);
-        kinds_seen.clear();
-        f.feed(&quad, |kind, _| kinds_seen.push(kind));
-        assert!(kinds_seen.is_empty());
-    }
-
-    #[test]
-    fn framer_clear_drops_partials_only() {
-        let mut f = PadFramer::new(KIND_BIT_HAPTICS | KIND_BIT_SPEAKER);
-        let mut emitted = 0;
-        // 100 samples: no frame boundary reached yet.
-        f.feed(&vec![0.1; 100 * CAP_CHANNELS], |_, _| emitted += 1);
-        assert_eq!(emitted, 0);
-        f.clear();
-        // After the gap: exactly one haptics frame from 240 fresh samples — the 100 stale
-        // samples are gone (they would skew every later frame boundary).
-        f.feed(
-            &vec![0.2; HAPTICS_FRAME_SAMPLES * CAP_CHANNELS],
-            |kind, frame| {
-                emitted += 1;
-                assert_eq!(
-                    (kind, frame.len()),
-                    (PAD_AUDIO_KIND_HAPTICS, 2 * HAPTICS_FRAME_SAMPLES)
-                );
-            },
-        );
-        assert_eq!(emitted, 1);
-    }
-
-    #[test]
-    fn host_cap_requires_the_client_bit() {
-        // Without CLIENT_CAP_PAD_AUDIO the answer is no on EVERY platform (on Windows the
-        // env + provisioning legs are environment-dependent — not unit-tested here).
-        assert!(!host_cap(0));
-        assert!(!host_cap(punktfunk_core::quic::CLIENT_CAP_CURSOR));
-    }
-}

crates/punktfunk-host/src/native/stream.rs

@@ -441,27 +441,26 @@ fn idd_adaptive_enabled() -> bool {
 /// Seal one access unit and send it with MICROBURST pacing (the shared
 /// [`send_pacing`](crate::send_pacing) policy, native parameterization): the first `burst_cap`
 /// bytes go out immediately (one absorbed burst the NIC / socket tx-buffer can swallow), and
-/// only the OVERFLOW beyond that is spread across the time it needs at `pace_rate_bps` in
-/// ADAPTIVE chunks — 16 packets at today's rates, coarsening to at most 64 (the GSO-segment
-/// cap) once the rate would otherwise skip every sub-floor sleep, so ≥1 Gbps frames still pace
-/// instead of collapsing into an unpaced blast (plan Phase 1.2). `burst_cap` `None` = auto:
-/// `max(128 KB, this AU's wire bytes / 4)`, so the burst stays a bounded fraction of a
-/// high-rate frame instead of swallowing it whole (plan Phase 1.3); `Some` =
-/// PUNKTFUNK_PACE_BURST_KB pinned an absolute cap. So a normal-bitrate frame (≤ cap) leaves in
-/// one immediate burst at ~0 added latency, while a genuine IDR / sustained-high-bitrate frame
-/// (≫ cap) still spreads — keeping the freeze fix exactly where it's needed (an unpaced
-/// line-rate burst overruns the kernel tx buffer → EAGAIN drop → under infinite GOP, a freeze
-/// until the next keyframe).
+/// only the OVERFLOW beyond that is spread across `min(~90% of the time to deadline, the time
+/// the overflow needs at pace_rate_bps)` in ADAPTIVE chunks — 16 packets at today's rates,
+/// coarsening to at most 64 (the GSO-segment cap) once the rate would otherwise skip every
+/// sub-floor sleep, so ≥1 Gbps frames still pace instead of collapsing into an unpaced blast
+/// (plan Phase 1.2). `burst_cap` `None` = auto: `max(128 KB, this AU's wire bytes / 4)`, so
+/// the burst stays a bounded fraction of a high-rate frame instead of swallowing it whole
+/// (plan Phase 1.3); `Some` = PUNKTFUNK_PACE_BURST_KB pinned an absolute cap. So a
+/// normal-bitrate frame (≤ cap) leaves in one immediate burst at ~0 added latency, while a
+/// genuine IDR / sustained-high-bitrate frame (≫ cap) still spreads — keeping the freeze fix
+/// exactly where it's needed (an unpaced line-rate burst overruns the kernel tx buffer →
+/// EAGAIN drop → under infinite GOP, a freeze until the next keyframe). With no slack
+/// (encode ≈ interval) the budget collapses to 0 and even the overflow goes out immediately,
+/// so this is never slower than unpaced.
 ///
-/// `pace_rate_bps` (latency plan T1.2; resume-safe form, stall program T2): the caller passes
-/// ~3× the live encoder bitrate — a rate the link is proven to carry sustained — and the
-/// overflow's wire time at that rate IS the pace budget ([`crate::send_pacing::native_budget`],
-/// [`crate::send_pacing::MAX_PACE_SPREAD`]-bounded). The frame deadline no longer under-cuts
-/// the spread: for a steady-state frame the rate term was the smaller one anyway (tail gone in
-/// a fraction of the interval), and for an oversized frame (stall-resume scene delta, cold
-/// IDR) the old deadline clamp was exactly the line-rate blast → tx-overrun → freeze path this
-/// module exists to prevent. `0` = uncapped legacy deadline-only spread
-/// (PUNKTFUNK_PACE_FACTOR=0, and the fallback when the bitrate isn't known yet).
+/// `pace_rate_bps` (latency plan T1.2) bounds the spread from above: the deadline term alone
+/// smears a big frame's tail across the whole remaining interval (~15 ms at 60 fps) even when
+/// the link could drain it in 2–3 ms. The caller passes ~3× the live encoder bitrate — a rate
+/// the link is proven to carry sustained, so the bounded excursion keeps the anti-freeze
+/// property while the tail leaves as soon as the link plausibly allows. `0` = uncapped
+/// (legacy smoothness-only spread, and the fallback when the bitrate isn't known yet).
 #[allow(clippy::too_many_arguments)]
 fn paced_submit(
     session: &mut Session,
@@ -499,22 +498,34 @@ fn pace_sealed(
         chunk: crate::send_pacing::ChunkPolicy::Adaptive { base: 16, max: 64 },
         sleep_floor: std::time::Duration::from_micros(500),
     };
-    // T1.2 rate cap, resume-safe form (stall program T2): the overflow's wire time at
-    // `pace_rate_bps` IS the budget — the deadline no longer under-cuts it, so an oversized
-    // frame (a stall-resume scene delta, a cold IDR) paces at the proven 3× rate instead of
-    // collapsing into a line-rate blast that overruns the socket buffer and loses the very
-    // frame that ends a freeze. See `send_pacing::native_budget` for the full argument.
+    // T1.2 rate cap: the overflow's wire time at `pace_rate_bps`. Only the bytes past the
+    // burst pace at all, so only they bound the budget.
     let overflow_bytes = wire_bytes.saturating_sub(burst_bytes) as u64;
-    let budget = crate::send_pacing::native_budget(deadline, pace_rate_bps, overflow_bytes);
+    let cap = if pace_rate_bps > 0 && overflow_bytes > 0 {
+        std::time::Duration::from_nanos(
+            (overflow_bytes * 8).saturating_mul(1_000_000_000) / pace_rate_bps,
+        )
+    } else {
+        std::time::Duration::MAX
+    };
     // Time the socket handoff per chunk and fold it into the session's SealPerf split — the
     // sleeps between chunks stay excluded, so sock_ns is pure send_gso/sendmmsg time.
     let mut sock_ns = 0u64;
-    let result = crate::send_pacing::pace_frame(&refs, budget, &cfg, |chunk| {
-        let t0 = std::time::Instant::now();
-        let r = session.send_sealed(chunk).map(|_| ());
-        sock_ns += t0.elapsed().as_nanos() as u64;
-        r
-    });
+    let result = crate::send_pacing::pace_frame(
+        &refs,
+        crate::send_pacing::PaceBudget::UntilDeadline {
+            deadline,
+            fraction: 0.9,
+            cap,
+        },
+        &cfg,
+        |chunk| {
+            let t0 = std::time::Instant::now();
+            let r = session.send_sealed(chunk).map(|_| ());
+            sock_ns += t0.elapsed().as_nanos() as u64;
+            r
+        },
+    );
     drop(refs); // release the borrow of `wires` so it can return to the seal pool
     session.reclaim_wires(wires);
     session.note_sock_ns(sock_ns);

crates/punktfunk-host/src/send_pacing.rs

@@ -55,7 +55,7 @@ pub(crate) enum ChunkPolicy {
 }
 
 /// The time the paced (post-burst) packets spread across.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug)]
 pub(crate) enum PaceBudget {
     /// `min((deadline − now-after-burst) × fraction, cap)`, collapsing to 0 with no slack
     /// (native: fraction 0.9). `cap` bounds the spread to the time the overflow actually needs
@@ -68,53 +68,10 @@ pub(crate) enum PaceBudget {
         fraction: f32,
         cap: Duration,
     },
-    /// A precomputed fixed budget (GameStream: ¾ of the frame interval; native: the rate-cap
-    /// spread from [`native_budget`]).
+    /// A precomputed fixed budget (GameStream: ¾ of the frame interval).
     Fixed(Duration),
 }
 
-/// Absolute ceiling on one frame's paced spread (native plane): a pathological frame must not
-/// park the send thread for longer than this, whatever the rate math says. At the ceiling the
-/// tail is late but delivered whole — still strictly better than the blast-loss → freeze →
-/// recovery-IDR round trip it replaces.
-pub(crate) const MAX_PACE_SPREAD: Duration = Duration::from_millis(100);
-
-/// The native plane's pace budget for one frame (pure — unit-tested): with the T1.2 rate cap
-/// active, the paced overflow spreads across exactly the time it needs at the pace rate
-/// (`cap`, bounded by [`MAX_PACE_SPREAD`]) and is NEVER under-cut by the frame deadline.
-///
-/// The old schedule took `min(0.9 × time-to-deadline, cap)`. For a steady-state frame the cap
-/// is the smaller term and nothing changes. But for an OVERSIZED frame — a stall-resume scene
-/// delta after seconds of frozen composition, a cold IDR — the overflow needs SEVERAL frame
-/// intervals at the pace rate, and the deadline term clamped that into the remainder of ONE:
-/// an instantaneous many-×-stream-rate blast that overruns the socket tx-buffer and loses the
-/// very frame that would have ended the freeze (field fingerprint: WSAENOBUFS 10055 +
-/// `loss_ppm` spikes at capture-stall edges, then a recovery-IDR round trip per retry). The
-/// pace rate is ~3× a rate the link demonstrably carries, so holding it past the deadline is
-/// safe by the same argument that introduced the cap — the deadline stays a *target*, not a
-/// license to blast.
-///
-/// `pace_rate_bps == 0` (PUNKTFUNK_PACE_FACTOR=0) or an overflow-free frame keeps the legacy
-/// deadline-only spread.
-pub(crate) fn native_budget(
-    deadline: Instant,
-    pace_rate_bps: u64,
-    overflow_bytes: u64,
-) -> PaceBudget {
-    if pace_rate_bps > 0 && overflow_bytes > 0 {
-        let cap = Duration::from_nanos(
-            (overflow_bytes * 8).saturating_mul(1_000_000_000) / pace_rate_bps,
-        );
-        PaceBudget::Fixed(cap.min(MAX_PACE_SPREAD))
-    } else {
-        PaceBudget::UntilDeadline {
-            deadline,
-            fraction: 0.9,
-            cap: Duration::MAX,
-        }
-    }
-}
-
 /// Per-plane pacing parameters. See the module doc for the two canonical values.
 #[derive(Clone, Copy, Debug)]
 pub(crate) struct PaceCfg {
@@ -641,43 +598,6 @@ mod tests {
         );
     }
 
-    /// [`native_budget`]: with the rate cap active the budget is the overflow's wire time at
-    /// the pace rate — a FIXED spread the deadline can no longer under-cut — bounded by
-    /// [`MAX_PACE_SPREAD`]; rate 0 / no overflow keep the legacy deadline-only schedule.
-    #[test]
-    fn native_budget_is_rate_bound_never_deadline_cut() {
-        // The stall-resume case the fix exists for: a 3 MB overflow at 3×240 Mbps needs
-        // ~33 ms — an IMMINENT deadline (the old min() made this a blast) must not shrink it.
-        let deadline = Instant::now() + Duration::from_millis(4); // 240 fps interval
-        let b = native_budget(deadline, 720_000_000, 3_000_000);
-        assert_eq!(b, PaceBudget::Fixed(Duration::from_nanos(33_333_333)));
-
-        // A steady-state frame: overflow 90 KB at 3×240 Mbps = 1 ms — identical to what the
-        // old min(slack, cap) chose (cap was the smaller term), so nothing regresses.
-        let b = native_budget(deadline, 720_000_000, 90_000);
-        assert_eq!(b, PaceBudget::Fixed(Duration::from_micros(1_000)));
-
-        // A crater-rate resume (ABR backed off to 20 Mbps, pace 60 Mbps): the raw rate math
-        // says 400 ms for 3 MB — the absolute ceiling bounds the send thread's stall.
-        let b = native_budget(deadline, 60_000_000, 3_000_000);
-        assert_eq!(b, PaceBudget::Fixed(MAX_PACE_SPREAD));
-
-        // Rate cap off (PUNKTFUNK_PACE_FACTOR=0): the legacy deadline-only spread, uncapped.
-        let b = native_budget(deadline, 0, 3_000_000);
-        assert!(matches!(
-            b,
-            PaceBudget::UntilDeadline {
-                fraction,
-                cap: Duration::MAX,
-                ..
-            } if fraction == 0.9
-        ));
-
-        // No overflow (the whole frame bursts): budget is never consulted — legacy shape.
-        let b = native_budget(deadline, 720_000_000, 0);
-        assert!(matches!(b, PaceBudget::UntilDeadline { .. }));
-    }
-
     /// `inject_video_drop` is a no-op when the knob is off (the default test env).
     #[test]
     fn drop_injection_off_by_default() {

include/punktfunk_core.h

@@ -70,13 +70,7 @@
 // says what it says — so v15 is the floor that *guarantees* them: at or above it the surface is
 // present, below it an embedder must probe for the symbol. Purely a version statement; no code
 // changed with this bump, and no wire change, so [`WIRE_VERSION`] is unchanged.
-// v16: added the pad-audio client surface — `punktfunk_connection_next_pad_audio` (the 0xD1
-// per-gamepad DualSense haptics/speaker plane) + `punktfunk_connection_set_pad_audio_caps` and
-// the `PUNKTFUNK_CLIENT_CAP_PAD_AUDIO` / `PUNKTFUNK_HOST_CAP_PAD_AUDIO` mirrors. Additive and
-// capability-gated end to end: the wire grows a new datagram tag (0xD1) an old client never
-// receives (double-gated caps), a new 0xCD kind (0x06, dropped as unknown by old clients) and
-// arrival flag bits 8/9 sent only toward a capable host, so [`WIRE_VERSION`] is unchanged.
-#define PUNKTFUNK_ABI_VERSION 16
+#define PUNKTFUNK_ABI_VERSION 15
 
 // The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
 // Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**
@@ -100,13 +94,6 @@
 // little-endian `u16`s with `effect_len = 6`. Clients without trackpad coils drop it.
 #define PUNKTFUNK_HIDOUT_TRACKPAD_HAPTIC 4
 
-// `PunktfunkHidOutput::kind` — the audio-control region of a DS5 output report (pad-audio
-// routing/volumes; the audio SAMPLES arrive via [`punktfunk_connection_next_pad_audio`]).
-// `which` = the condensed audio flags (bit0 = haptics-select, bits1..4 = the report's
-// audio-valid flags); `effect[0..6]` = bytes 5..=10 of the report verbatim
-// (headphone/speaker/mic volumes + routing) with `effect_len = 6`. Forwarded change-only.
-#define PUNKTFUNK_HIDOUT_AUDIO_CTL 5
-
 // Capacity of `PunktfunkHidOutput::effect` (the DualSense trigger parameter block).
 #define PUNKTFUNK_HID_EFFECT_MAX 11
 
@@ -291,28 +278,6 @@
 // design/pen-tablet-input.md.)
 #define PUNKTFUNK_HOST_CAP_PEN 16
 
-// Host-capability bit in [`punktfunk_connection_host_caps`]: the host can capture per-gamepad
-// audio (DualSense voice-coil haptics + speaker) and emit it on the 0xD1 plane toward pads
-// declared capable via [`punktfunk_connection_set_pad_audio_caps`]. Set only when the client
-// asked via [`PUNKTFUNK_CLIENT_CAP_PAD_AUDIO`]. (Mirrors `quic::HOST_CAP_PAD_AUDIO`.)
-#define PUNKTFUNK_HOST_CAP_PAD_AUDIO 64
-
-// Pad-audio `kind` ([`punktfunk_connection_next_pad_audio`]): the BACK channel pair — DualSense
-// voice-coil haptics, 5 ms Opus frames. (Mirrors `quic::PAD_AUDIO_KIND_HAPTICS`.)
-#define PUNKTFUNK_PAD_AUDIO_KIND_HAPTICS 0
-
-// Pad-audio `kind`: the FRONT channel pair — the controller's built-in speaker, 10 ms Opus
-// frames. (Mirrors `quic::PAD_AUDIO_KIND_SPEAKER`.)
-#define PUNKTFUNK_PAD_AUDIO_KIND_SPEAKER 1
-
-// [`punktfunk_connection_set_pad_audio_caps`] `audio_caps` bit: the pad renders the HAPTICS
-// stream (a real DualSense's voice coils).
-#define PUNKTFUNK_PAD_AUDIO_CAP_HAPTICS 1
-
-// [`punktfunk_connection_set_pad_audio_caps`] `audio_caps` bit: the pad renders the SPEAKER
-// stream.
-#define PUNKTFUNK_PAD_AUDIO_CAP_SPEAKER 2
-
 // [`punktfunk_connect_ex9`] `client_caps` bit: render the host cursor locally (the cursor
 // channel, `design/remote-desktop-sweep.md` M2).
 #define PUNKTFUNK_CLIENT_CAP_CURSOR 1
@@ -323,13 +288,6 @@
 // forward-compatible.
 #define PUNKTFUNK_CLIENT_CAP_PHASE_LOCK 2
 
-// [`punktfunk_connect_ex9`] `client_caps` bit: the client understands the pad-audio plane
-// (0xD1 — per-gamepad DualSense voice-coil haptics + speaker). The embedder MUST then drain
-// [`punktfunk_connection_next_pad_audio`] and declare each capable pad via
-// [`punktfunk_connection_set_pad_audio_caps`]; the host emits pad audio only when it answers
-// with [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`]. (Mirrors `quic::CLIENT_CAP_PAD_AUDIO`.)
-#define PUNKTFUNK_CLIENT_CAP_PAD_AUDIO 8
-
 // `*ttl_ms` sentinel written by [`punktfunk_connection_next_rumble2`] for a legacy (v1) rumble
 // datagram — an old host that sent no self-termination lease. The client then falls back to its
 // own staleness heuristic for that update instead of a host-supplied deadline.
@@ -409,19 +367,6 @@
 // Fixed serialized size of an [`InputEvent`] on the wire (tag + fields).
 #define PUNKTFUNK_INPUT_WIRE_LEN (((((1 + 1) + 4) + 4) + 4) + 4)
 
-// [`InputKind::GamepadArrival`] `flags` bit: this pad renders pad-audio HAPTICS — it is (or
-// forwards to) a real DualSense whose voice-coil actuators can play the
-// [`PAD_AUDIO_KIND_HAPTICS`](crate::quic::PAD_AUDIO_KIND_HAPTICS) stream. Rides above the pad
-// index byte; sent only toward a [`HOST_CAP_PAD_AUDIO`](crate::quic::HOST_CAP_PAD_AUDIO) host
-// (an older host reads the whole `flags` word as the index, so unexpected high bits would make
-// it drop the declaration).
-#define ARRIVAL_FLAG_PAD_AUDIO_HAPTICS (1 << 8)
-
-// [`InputKind::GamepadArrival`] `flags` bit: this pad renders pad-audio SPEAKER — the
-// [`PAD_AUDIO_KIND_SPEAKER`](crate::quic::PAD_AUDIO_KIND_SPEAKER) stream. Same wire discipline
-// as [`ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`].
-#define ARRIVAL_FLAG_PAD_AUDIO_SPEAKER (1 << 9)
-
 // The number of gamepads addressable on the wire (`flags` pad index 0..15). Shared by the
 // client's snapshot fold and the host's per-pad accumulators.
 #define PUNKTFUNK_MAX_PADS 16
@@ -730,18 +675,6 @@
 #define PUNKTFUNK_CLIENT_CAP_AUDIO_RED 4
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// [`Hello::client_caps`] bit: the client understands the pad-audio plane
-// ([`PAD_AUDIO_MAGIC`](super::datagram::PAD_AUDIO_MAGIC), `0xD1`) — per-gamepad DualSense
-// voice-coil haptics + speaker Opus frames, plus the [`HidOutput::AudioCtl`]
-// (super::datagram::HidOutput) routing/volume events. Active only when the host answers with
-// [`HOST_CAP_PAD_AUDIO`] AND the pad's arrival declared a renderer for the kind
-// ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`) — the capable-and-agreed
-// precedent, per pad; toward an older or incapable host nothing changes. `0x08` — `0x01` is [`CLIENT_CAP_CURSOR`],
-// `0x02` is [`CLIENT_CAP_PHASE_LOCK`], `0x04` is [`CLIENT_CAP_AUDIO_RED`].
-#define CLIENT_CAP_PAD_AUDIO 8
-#endif
-
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // [`Welcome::host_caps`] bit: the host CAN forward the cursor out-of-band (it captures cursor
 // metadata separately from the frame — the Linux portal `SPA_META_Cursor` path; NOT gamescope,
@@ -781,19 +714,6 @@
 #define PUNKTFUNK_HOST_CAP_AUDIO_RED 32
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// [`Welcome::host_caps`] bit: the host can capture pad audio — its virtual DualSense exposes
-// the pad's audio endpoints (voice-coil haptics + speaker), so a game's per-pad audio can be
-// captured and shipped on the [`PAD_AUDIO_MAGIC`](super::datagram::PAD_AUDIO_MAGIC) plane.
-// Set only when the client asked via [`CLIENT_CAP_PAD_AUDIO`]; when both bits agree, a
-// capable client marks its pads' render capabilities on their arrivals
-// ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`) and the host emits `0xD1`
-// toward exactly those pads. `0x40` — `0x20` is [`HOST_CAP_AUDIO_RED`], `0x10` is
-// [`HOST_CAP_PEN`], `0x08` is [`HOST_CAP_CURSOR`], `0x04` is [`HOST_CAP_TEXT_INPUT`],
-// `0x01`/`0x02` are gamepad-state / clipboard.
-#define HOST_CAP_PAD_AUDIO 64
-#endif
-
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // [`Hello::video_codecs`] bit: the client can decode H.264 / AVC. The GPU-less **software**
 // encode path (openh264) emits H.264, so a client that wants to stream from a software host MUST
@@ -1091,9 +1011,7 @@
 // audio = [`AUDIO_MAGIC`] (0xC9, host→client), rumble = [`RUMBLE_MAGIC`] (0xCA, host→client),
 // mic = [`MIC_MAGIC`] (0xCB, client→host), rich-input = [`RICH_INPUT_MAGIC`] (0xCC, client→host),
 // HID-output = [`HIDOUT_MAGIC`] (0xCD, host→client), HDR metadata = [`HDR_META_MAGIC`]
-// (0xCE, host→client), host timing = [`HOST_TIMING_MAGIC`] (0xCF, host→client), cursor state =
-// [`CURSOR_STATE_MAGIC`] (0xD0, host→client), pad audio = [`PAD_AUDIO_MAGIC`] (0xD1,
-// host→client).
+// (0xCE, host→client).
 #define PUNKTFUNK_AUDIO_MAGIC 201
 #endif
 
@@ -1244,31 +1162,6 @@
 #define PUNKTFUNK_CURSOR_RELATIVE_HINT 2
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Pad-audio datagram tag, host → client: per-gamepad audio a game routed
-// to the host's virtual DualSense — voice-coil haptics and the built-in speaker — for the client
-// to render on the matching real controller. Next tag after [`CURSOR_STATE_MAGIC`]. The
-// per-pad AUDIO plane (Opus frames, the [`AUDIO_MAGIC`]/[`MIC_MAGIC`] shape plus pad + kind);
-// the routing/volume CONTROL side rides [`HidOutput::AudioCtl`]. Emitted only when the session
-// negotiated it ([`CLIENT_CAP_PAD_AUDIO`](super::caps::CLIENT_CAP_PAD_AUDIO) ∧
-// [`HOST_CAP_PAD_AUDIO`](super::caps::HOST_CAP_PAD_AUDIO)) and the pad's arrival declared a
-// renderer for the kind ([`crate::input::ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/`_SPEAKER`).
-// Best-effort like every audio datagram: a lost frame is a concealed gap, never state.
-#define PAD_AUDIO_MAGIC 209
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// [`PadAudioFrame::kind`]: the BACK channel pair — the DualSense voice-coil actuators (audio
-// haptics). 5 ms Opus frames, matching the [`AUDIO_MAGIC`] cadence: haptics are felt latency.
-#define PAD_AUDIO_KIND_HAPTICS 0
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// [`PadAudioFrame::kind`]: the FRONT channel pair — the controller's built-in speaker. 10 ms
-// Opus frames (speaker content tolerates the extra buffering for the better coding efficiency).
-#define PAD_AUDIO_KIND_SPEAKER 1
-#endif
-
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // QUIC application error code a punktfunk/1 client closes the control connection with on a
 // **deliberate quit** (a user "stop", not a network drop). The host reads it off the connection's
@@ -1583,11 +1476,7 @@ enum PunktfunkInputKind
     PUNKTFUNK_INPUT_KIND_GAMEPAD_REMOVE = 13,
     // Declares which controller KIND a pad presents so a session can MIX types (pad 0 a
     // DualSense, pad 1 an Xbox pad). `code` = the [`GamepadPref`](crate::config::GamepadPref)
-    // wire byte, `flags` = pad index in the low byte plus the pad's render capabilities in bits
-    // 8/9 ([`ARRIVAL_FLAG_PAD_AUDIO_HAPTICS`]/[`ARRIVAL_FLAG_PAD_AUDIO_SPEAKER`] — sent only
-    // toward a [`HOST_CAP_PAD_AUDIO`](crate::quic::HOST_CAP_PAD_AUDIO) host, so an older host
-    // keeps reading the whole word as the index; hosts decode via [`decode_gamepad_arrival`]).
-    // Sent when the client opens a pad slot — before that pad's
+    // wire byte, `flags` = pad index. Sent when the client opens a pad slot — before that pad's
     // first input — and re-sent a few times against datagram loss (like [`GamepadRemove`]). The
     // host resolves the kind to a buildable backend and routes that pad's virtual device to it; a
     // pad the client never declares (an older client, or a fully-lost declaration) falls back to
@@ -2515,50 +2404,6 @@ PunktfunkStatus punktfunk_connection_next_audio_pcm(PunktfunkConnection *c,
                                                     uint32_t timeout_ms);
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Pull the next pad-audio frame (0xD1) — one Opus frame of DualSense voice-coil haptics
-// (`kind` = [`PUNKTFUNK_PAD_AUDIO_KIND_HAPTICS`], 5 ms) or built-in-speaker audio
-// ([`PUNKTFUNK_PAD_AUDIO_KIND_SPEAKER`], 10 ms) for gamepad `*out_pad` — waiting up to
-// `timeout_ms`. The payload is COPIED into `buf` (no borrow-until-next-call slot); the return
-// value is its length in bytes, `0` = nothing this poll (timeout — or a DTX/oversized frame,
-// both of which an embedder treats the same way), `-1` = the session ended (or an invalid
-// handle/buffer). All pads/kinds share one queue — fan out by `*out_pad`/`*out_kind` to
-// per-actuator Opus decoders. A frame larger than `buf_len` is dropped like the timeout case
-// (the plane is lossy by design; any real Opus frame fits a 1500-byte buffer). Only a session
-// connected with [`PUNKTFUNK_CLIENT_CAP_PAD_AUDIO`] against a
-// [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`] host — with the pad declared via
-// [`punktfunk_connection_set_pad_audio_caps`] — ever receives any. Drain from a dedicated
-// thread (one puller, may run alongside the other planes' pullers).
-//
-// # Safety
-// `c` is a valid connection handle; the `out_*` pointers are writable (NULLs are skipped);
-// `buf` is writable for `buf_len` bytes.
-int32_t punktfunk_connection_next_pad_audio(PunktfunkConnection *c,
-                                            uint8_t *out_pad,
-                                            uint8_t *out_kind,
-                                            uint32_t *out_seq,
-                                            uint64_t *out_pts_ns,
-                                            uint8_t *buf,
-                                            uintptr_t buf_len,
-                                            uint32_t timeout_ms);
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Declare wire pad `pad`'s pad-audio render capabilities (`audio_caps`: OR of
-// [`PUNKTFUNK_PAD_AUDIO_CAP_HAPTICS`] / [`PUNKTFUNK_PAD_AUDIO_CAP_SPEAKER`]) — how a client
-// tells the host WHICH pads can actually play the 0xD1 streams. Call at controller attach,
-// BEFORE the pad's arrival event is sent (the [`punktfunk_connection_set_rumble_quirks`]
-// timing): the core folds the bits into the arrival's flags (bits 8/9), and only toward a
-// [`PUNKTFUNK_HOST_CAP_PAD_AUDIO`] host — never calling this leaves the wire bytes exactly as
-// before. Latest-wins per pad; unknown bits are masked off.
-//
-// # Safety
-// `c` is a valid connection handle. Callable from any thread.
-PunktfunkStatus punktfunk_connection_set_pad_audio_caps(PunktfunkConnection *c,
-                                                        uint8_t pad,
-                                                        uint8_t audio_caps);
-#endif
-
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // Pull the next rumble (force-feedback) update, waiting up to `timeout_ms`. Amplitudes
 // are 0..0xFFFF (`low` = low-frequency motor, `high` = high-frequency), `(0, 0)` = stop.

plugin-kit/bun.lock

@@ -21,15 +21,12 @@
       ],
     },
   },
-  "overrides": {
-    "undici": "^8.9.0",
-  },
   "packages": {
     "@effect/openapi-generator": ["@effect/openapi-generator@4.0.0-beta.98", "", { "dependencies": { "swagger2openapi": "^7.0.8" }, "peerDependencies": { "@effect/platform-node": "^4.0.0-beta.98", "effect": "^4.0.0-beta.98" }, "bin": { "openapigen": "dist/bin.js" } }, "sha512-7bqawr/HqJWqQ8H/bHyzBlLPA3LIIm3Y+cGYlIxnC/QVK795QpiEXb7uxTnP7V7w49V0sBtTerv4/9ZjsMffLQ=="],
 
     "@effect/platform-node": ["@effect/platform-node@4.0.0-beta.98", "", { "dependencies": { "@effect/platform-node-shared": "^4.0.0-beta.98", "mime": "^4.1.0", "undici": "^8.7.0" }, "peerDependencies": { "effect": "^4.0.0-beta.98", "ioredis": "^5.7.0" } }, "sha512-IQu1TiLXQEDSGkDBllyYjVadf+UqdjptryqX4mmktVTTbGDq7X4uVxe7cSgXuqZvyfG6kagTzwj2lfynxOaKQg=="],
 
-    "@effect/platform-node-shared": ["@effect/platform-node-shared@4.0.0-beta.103", "", { "dependencies": { "@types/ws": "^8.18.1", "ws": "^8.21.0" }, "peerDependencies": { "effect": "^4.0.0-beta.103" } }, "sha512-0aCZMBid5ifqmY55TkfCDLaGTIM8qu3bNFUW7qL9vh/7jFOkaIAMX2MA8muG4deqW17XWxawddWu4v0fK+UW3g=="],
+    "@effect/platform-node-shared": ["@effect/platform-node-shared@4.0.0-beta.99", "", { "dependencies": { "@types/ws": "^8.18.1", "ws": "^8.21.0" }, "peerDependencies": { "effect": "^4.0.0-beta.99" } }, "sha512-POBAowafsAAb3bH1x1rJlWnv32yMAazFgEuRW5LhkW/JJA5VGoEk9OnuoUkIH1OW6K/X6IrdNpqcO+5e9lPQJA=="],
 
     "@exodus/schemasafe": ["@exodus/schemasafe@1.3.0", "", {}, "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw=="],
 
@@ -47,15 +44,15 @@
 
     "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="],
 
-    "@punktfunk/host": ["@punktfunk/host@file:../sdk", { "devDependencies": { "@effect/openapi-generator": "4.0.0-beta.98", "@effect/platform-node": "4.0.0-beta.98", "@types/bun": "^1.3.0", "bun2nix": "2.1.2", "effect": "^4.0.0-beta.98", "typescript": "^5.9.3" }, "optionalDependencies": { "undici": "^7.0.0" }, "peerDependencies": { "effect": "^4.0.0-beta.98" }, "bin": { "punktfunk-scripting": "./dist/runner-cli.js" } }],
+    "@punktfunk/host": ["@punktfunk/host@file:../sdk", { "devDependencies": { "@effect/openapi-generator": "4.0.0-beta.98", "@effect/platform-node": "4.0.0-beta.98", "@types/bun": "^1.3.0", "effect": "^4.0.0-beta.98", "typescript": "^5.9.3" }, "optionalDependencies": { "undici": "^7.0.0" }, "peerDependencies": { "effect": "^4.0.0-beta.98" }, "bin": { "punktfunk-scripting": "./dist/runner-cli.js" } }],
 
     "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
 
-    "@types/node": ["@types/node@26.1.2", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg=="],
+    "@types/node": ["@types/node@26.1.1", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw=="],
 
-    "@types/react": ["@types/react@19.2.18", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w=="],
+    "@types/react": ["@types/react@19.2.17", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw=="],
 
     "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
 
@@ -65,8 +62,6 @@
 
     "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
 
-    "bun2nix": ["bun2nix@2.1.2", "", { "dependencies": { "sade": "^1.8.1" }, "bin": { "bun2nix": "index.ts" } }, "sha512-0wx6Ar5ccrz4aSD5prbShwymjDEXFh7Bucxs+YrpAMa67TnVB95Hv8FV3oaQEbtOx6QGgIAyOmap6Y3WCRqetg=="],
-
     "call-me-maybe": ["call-me-maybe@1.0.2", "", {}, "sha512-HpX65o1Hnr9HH25ojC1YGs7HCQLq0GCOibSaWER0eNpgJ/Z1MZv2mTc7+xh6WOPxbRVcmgbv4hGU+uSQ/2xFZQ=="],
 
     "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="],
@@ -113,11 +108,9 @@
 
     "mime": ["mime@4.1.0", "", { "bin": { "mime": "bin/cli.js" } }, "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw=="],
 
-    "mri": ["mri@1.2.0", "", {}, "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA=="],
-
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "msgpackr": ["msgpackr@2.0.5", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-cef05H/dSYpLpqp3sj/qyZh5vhUYCalnaLO7j1yOmpsR0y/XwLVtK7r5gn+U/F7CTEfMowcGhlUQJDLcLf7jcA=="],
+    "msgpackr": ["msgpackr@2.0.4", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-o1C5KRmuRt+apqMr1HuGSqWStZoRBUpEsCsl15uM9VdAF1qHLtvMOU2En747EnTyEl6c4pzPewRMFF31s1CNbA=="],
 
     "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="],
 
@@ -151,8 +144,6 @@
 
     "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
 
-    "sade": ["sade@1.8.1", "", { "dependencies": { "mri": "^1.1.0" } }, "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A=="],
-
     "should": ["should@13.2.3", "", { "dependencies": { "should-equal": "^2.0.0", "should-format": "^3.0.3", "should-type": "^1.4.0", "should-type-adaptors": "^1.0.1", "should-util": "^1.0.0" } }, "sha512-ggLesLtu2xp+ZxI+ysJTmNjh2U0TsC+rQ/pfED9bUZZ4DKefP27D+7YJVVTvKsmjLpIi9jAa7itwDGkDDmt1GQ=="],
 
     "should-equal": ["should-equal@2.0.0", "", { "dependencies": { "should-type": "^1.4.0" } }, "sha512-ZP36TMrK9euEuWQYBig9W55WPC7uo37qzAEmbjHz4gfyuXrEUgF8cUvQVO+w+d3OMfPvSRQJ22lSm8MQJ43LTA=="],
@@ -179,7 +170,7 @@
 
     "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
-    "undici": ["undici@8.10.0", "", {}, "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ=="],
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
 
     "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
 
@@ -191,7 +182,7 @@
 
     "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
 
-    "ws": ["ws@8.21.2", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-54dMVAo4WIe6SKy3vBgN+9bJZqqQ8IMRevAkOLQALhi49qkkQDQfWdAZ8KQlXiEabw88ARXXdUrlvtbKQX+aKw=="],
+    "ws": ["ws@8.21.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw=="],
 
     "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
 
@@ -201,6 +192,8 @@
 
     "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
 
+    "@effect/platform-node/undici": ["undici@8.8.0", "", {}, "sha512-ubshXMXwF3MQIMF1y/WxZdNBnjEKeSg2wF5mcGUtU55YTw34tnVVpKRlLf7ruDXZ5344KokPVX4RBx1wJm64Bw=="],
+
     "oas-linter/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],
 
     "oas-resolver/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],

plugin-kit/package.json

@@ -57,8 +57,5 @@
 		"@types/react": "^19.2.16",
 		"effect": "4.0.0-beta.99",
 		"typescript": "^5.9.3"
-	},
-	"overrides": {
-		"undici": "^8.9.0"
 	}
 }

sdk/bun.lock

@@ -20,9 +20,6 @@
       },
     },
   },
-  "overrides": {
-    "undici": "^8.9.0",
-  },
   "packages": {
     "@effect/openapi-generator": ["@effect/openapi-generator@4.0.0-beta.98", "", { "dependencies": { "swagger2openapi": "^7.0.8" }, "peerDependencies": { "@effect/platform-node": "^4.0.0-beta.98", "effect": "^4.0.0-beta.98" }, "bin": { "openapigen": "dist/bin.js" } }, "sha512-7bqawr/HqJWqQ8H/bHyzBlLPA3LIIm3Y+cGYlIxnC/QVK795QpiEXb7uxTnP7V7w49V0sBtTerv4/9ZjsMffLQ=="],
 
@@ -172,7 +169,7 @@
 
     "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
-    "undici": ["undici@8.10.0", "", {}, "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ=="],
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
 
     "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
 
@@ -194,6 +191,8 @@
 
     "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
 
+    "@effect/platform-node/undici": ["undici@8.7.0", "", {}, "sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ=="],
+
     "oas-linter/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],
 
     "oas-resolver/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],

sdk/bun.nix

@@ -313,9 +313,13 @@
     url = "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz";
     hash = "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==";
   };
-  "undici@8.10.0" = fetchurl {
-    url = "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz";
-    hash = "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==";
+  "undici@7.28.0" = fetchurl {
+    url = "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz";
+    hash = "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==";
+  };
+  "undici@8.7.0" = fetchurl {
+    url = "https://registry.npmjs.org/undici/-/undici-8.7.0.tgz";
+    hash = "sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ==";
   };
   "uuid@14.0.1" = fetchurl {
     url = "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz";

sdk/package.json

@@ -55,8 +55,5 @@
 	},
 	"optionalDependencies": {
 		"undici": "^7.0.0"
-	},
-	"overrides": {
-		"undici": "^8.9.0"
 	}
 }

tools/display-disturb/Cargo.toml

@@ -13,6 +13,7 @@ windows = { version = "0.62", features = [
     "Win32_Devices_Display",
     "Win32_Graphics_Gdi",
     "Win32_Foundation",
+    "Win32_System_LibraryLoader",
 ] }
 
 [lints]

tools/display-disturb/src/adl.rs

@@ -0,0 +1,545 @@
+//! `adl-emul` — the AMD ADL EDID-emulation probe (immunity design doc §3's "probe once, log rc",
+//! promoted to a field A/B after the third RX 9070 XT standby-sink case).
+//!
+//! Three field cases (ASUS VG32VQ1B/DP, Odyssey G60SD/DP, LG UltraGear 32GS95UE/HDMI — all
+//! RX 9070 XT hosts) share one mechanism: a connected-but-asleep sink whose standby HPD/DDC/link
+//! servicing the KMD performs below every OS lever (CCD deactivation, devnode disable and CRU
+//! EDID overrides are confirmed no-ops — design doc §2a/§3). The one software lever that could
+//! stop the servicing at its SOURCE is the driver's own connector emulation — the software
+//! equivalent of an HPD-holding dummy plug: pin the live EDID with
+//! `ADL2_Adapter_ConnectionData_Set`, then `ADL2_Adapter_EmulationMode_Set(ADL_EMUL_MODE_ALWAYS)`
+//! so the driver stops caring what the physical pins report. The design doc marked the API
+//! "likely Pro-gated" on hearsay; nobody — here or in the community record — ever probed consumer
+//! Adrenalin. This subcommand is that probe:
+//!
+//! * `adl-emul`                       — read-only: caps, board layout, per-connector state.
+//! * `adl-emul --lock [--connector N]` — pin the live EDID + `ADL_EMUL_MODE_ALWAYS` (occupied
+//!   connectors only unless `--connector` names one).
+//! * `adl-emul --unlock [--connector N]` — `ADL_EMUL_MODE_OFF` + remove the pinned EDID.
+//!
+//! Every call prints the bench's `epoch_ms op target took_ms ok` line plus `rc=` (decoded): the
+//! rc IS the deliverable — `ADL2_Adapter_EDIDManagement_Caps` answering `supported=1` with
+//! `--lock` returning `ADL_OK` on a consumer RX card kills the Pro-gating assumption, and a
+//! locked connector during a stream with the sink asleep is the direct A/B for the metronomic
+//! stall. `--unlock` (or a driver reinstall) restores; emulation state can persist across
+//! reboots, so a `--lock` run must always be paired with a later `--unlock`.
+
+// FFI mirrors of ADL's C structs — keep AMD's field names verbatim so the header diff is
+// mechanical.
+#![allow(non_snake_case)]
+
+use std::ffi::c_void;
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
+
+use windows::core::{s, PCSTR};
+use windows::Win32::Foundation::HMODULE;
+use windows::Win32::System::LibraryLoader::{GetProcAddress, LoadLibraryA};
+
+// ---- ADL constants (adl_defines.h, GPUOpen display-library) ----
+
+const ADL_OK: i32 = 0;
+const ADL_MAX_PATH: usize = 256;
+const ADL_MAX_DISPLAY_EDID_DATA_SIZE: usize = 1024;
+const ADL_MAX_RAD_LINK_COUNT: usize = 15;
+
+const ADL_EMUL_MODE_OFF: i32 = 0;
+const ADL_EMUL_MODE_ALWAYS: i32 = 3;
+
+const ADL_QUERY_REAL_DATA: i32 = 0;
+const ADL_QUERY_EMULATED_DATA: i32 = 1;
+
+const ADL_EMUL_STATUS_REAL_DEVICE_CONNECTED: i32 = 0x1;
+const ADL_EMUL_STATUS_EMULATED_DEVICE_PRESENT: i32 = 0x2;
+const ADL_EMUL_STATUS_EMULATED_DEVICE_USED: i32 = 0x4;
+
+const AMD_VENDOR_ID: i32 = 1002;
+
+/// Decode the rc values a field log will actually contain (adl_defines.h) — `-8` vs `-1` is the
+/// whole consumer-vs-Pro question, so spell them out.
+fn rc_str(rc: i32) -> &'static str {
+    match rc {
+        0 => "ADL_OK",
+        1..=4 => "ADL_OK_(warning-class)",
+        -1 => "ADL_ERR",
+        -2 => "ADL_ERR_NOT_INIT",
+        -3 => "ADL_ERR_INVALID_PARAM",
+        -5 => "ADL_ERR_INVALID_ADL_IDX",
+        -8 => "ADL_ERR_NOT_SUPPORTED",
+        -9 => "ADL_ERR_NULL_POINTER",
+        -10 => "ADL_ERR_DISABLED_ADAPTER",
+        -22 => "ADL_ERR_CALL_TO_INCOMPATIABLE_DRIVER",
+        -23 => "ADL_ERR_NO_ADMINISTRATOR_PRIVILEGES",
+        _ => "?",
+    }
+}
+
+fn connector_type_str(t: i32) -> &'static str {
+    match t {
+        1 => "VGA",
+        2 => "DVI-D",
+        3 => "DVI-I",
+        8 => "HDMI-A",
+        9 => "HDMI-B",
+        10 => "DP",
+        11 => "eDP",
+        12 => "miniDP",
+        13 => "VIRTUAL",
+        14 => "USB-C",
+        _ => "unknown",
+    }
+}
+
+// ---- ADL structs (adl_structures.h, verbatim layouts) ----
+
+#[repr(C)]
+struct AdapterInfo {
+    iSize: i32,
+    iAdapterIndex: i32,
+    strUDID: [u8; ADL_MAX_PATH],
+    iBusNumber: i32,
+    iDeviceNumber: i32,
+    iFunctionNumber: i32,
+    iVendorID: i32,
+    strAdapterName: [u8; ADL_MAX_PATH],
+    strDisplayName: [u8; ADL_MAX_PATH],
+    iPresent: i32,
+    // _WIN32 tail — this tool only builds for Windows.
+    iExist: i32,
+    strDriverPath: [u8; ADL_MAX_PATH],
+    strDriverPathExt: [u8; ADL_MAX_PATH],
+    strPNPString: [u8; ADL_MAX_PATH],
+    iOSDisplayIndex: i32,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct ADLMSTRad {
+    iLinkNumber: i32,
+    rad: [u8; ADL_MAX_RAD_LINK_COUNT],
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct ADLDevicePort {
+    iConnectorIndex: i32,
+    aMSTRad: ADLMSTRad,
+}
+
+impl ADLDevicePort {
+    /// A non-MST port at `connector` (MST RAD all-zero = "DP root / non-DP ignored" per header).
+    fn root(connector: i32) -> Self {
+        Self {
+            iConnectorIndex: connector,
+            aMSTRad: ADLMSTRad {
+                iLinkNumber: 0,
+                rad: [0; ADL_MAX_RAD_LINK_COUNT],
+            },
+        }
+    }
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct ADLConnectionProperties {
+    iValidProperties: i32,
+    iBitrate: i32,
+    iNumberOfLanes: i32,
+    iColorDepth: i32,
+    iStereo3DCaps: i32,
+    iOutputBandwidth: i32,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct ADLConnectionData {
+    iConnectionType: i32,
+    aConnectionProperties: ADLConnectionProperties,
+    iNumberofPorts: i32,
+    iActiveConnections: i32,
+    iDataSize: i32,
+    EdidData: [u8; ADL_MAX_DISPLAY_EDID_DATA_SIZE],
+}
+
+#[repr(C)]
+#[derive(Clone, Copy, Default)]
+struct ADLConnectionState {
+    iEmulationStatus: i32,
+    iEmulationMode: i32,
+    iDisplayIndex: i32,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct ADLConnectorInfo {
+    iConnectorIndex: i32,
+    iConnectorId: i32,
+    iSlotIndex: i32,
+    iType: i32,
+    iOffset: i32,
+    iLength: i32,
+}
+
+// ---- dynamic binding (atiadlxx.dll ships with every AMD driver; absent elsewhere) ----
+
+type AdlContext = *mut c_void;
+type MallocCb = unsafe extern "C" fn(i32) -> *mut c_void;
+
+type FnMainCreate = unsafe extern "C" fn(MallocCb, i32, *mut AdlContext) -> i32;
+type FnMainDestroy = unsafe extern "C" fn(AdlContext) -> i32;
+type FnNumAdapters = unsafe extern "C" fn(AdlContext, *mut i32) -> i32;
+type FnAdapterInfoGet = unsafe extern "C" fn(AdlContext, *mut AdapterInfo, i32) -> i32;
+type FnEdidMgmtCaps = unsafe extern "C" fn(AdlContext, i32, *mut i32) -> i32;
+type FnBoardLayoutGet = unsafe extern "C" fn(
+    AdlContext,
+    i32,
+    *mut i32,
+    *mut i32,
+    *mut *mut c_void,
+    *mut i32,
+    *mut *mut ADLConnectorInfo,
+) -> i32;
+type FnConnStateGet =
+    unsafe extern "C" fn(AdlContext, i32, ADLDevicePort, *mut ADLConnectionState) -> i32;
+type FnConnDataGet =
+    unsafe extern "C" fn(AdlContext, i32, ADLDevicePort, i32, *mut ADLConnectionData) -> i32;
+type FnConnDataSet = unsafe extern "C" fn(AdlContext, i32, ADLDevicePort, ADLConnectionData) -> i32;
+type FnConnDataRemove = unsafe extern "C" fn(AdlContext, i32, ADLDevicePort) -> i32;
+type FnEmulModeSet = unsafe extern "C" fn(AdlContext, i32, ADLDevicePort, i32) -> i32;
+
+struct Adl {
+    create: FnMainCreate,
+    destroy: FnMainDestroy,
+    num_adapters: FnNumAdapters,
+    adapter_info: FnAdapterInfoGet,
+    edid_caps: FnEdidMgmtCaps,
+    board_layout: FnBoardLayoutGet,
+    conn_state: FnConnStateGet,
+    conn_data_get: FnConnDataGet,
+    conn_data_set: FnConnDataSet,
+    conn_data_remove: FnConnDataRemove,
+    emul_mode_set: FnEmulModeSet,
+}
+
+/// ADL's application-provided allocator: it hands buffers (board-layout arrays) back through
+/// out-pointers and expects the app to own them.
+unsafe extern "C" fn adl_malloc(size: i32) -> *mut c_void {
+    let size = size.max(1) as usize;
+    // SAFETY: non-zero size with a fixed valid alignment; the resulting buffers are deliberately
+    // never freed — ADL's contract wants an ADL_Main_Memory_Free symmetry, and leaking the <1 KiB
+    // of board-layout arrays in a one-shot probe is simpler than proving allocator parity.
+    unsafe {
+        std::alloc::alloc(std::alloc::Layout::from_size_align(size, 16).expect("tiny ADL alloc"))
+            as *mut c_void
+    }
+}
+
+impl Adl {
+    fn load() -> Option<Self> {
+        // SAFETY: plain LoadLibrary of the AMD-driver-installed ADL runtime by its well-known
+        // name; a foreign-DLL search-path attack would require writing to System32.
+        let lib: HMODULE = unsafe { LoadLibraryA(s!("atiadlxx.dll")) }.ok()?;
+        // One unsafe helper: resolve `name` or bail. Every Fn* type above matches the ADL
+        // header's C signature (x64 has a single calling convention, so `extern "C"` is exact).
+        unsafe fn sym<T: Copy>(lib: HMODULE, name: PCSTR) -> Option<T> {
+            debug_assert_eq!(std::mem::size_of::<T>(), std::mem::size_of::<usize>());
+            // SAFETY: caller passes a fn-pointer type T of pointer size (asserted above);
+            // GetProcAddress yields the export's address or None.
+            let f = unsafe { GetProcAddress(lib, name) }?;
+            // SAFETY: reinterpreting one non-null fn pointer as the export's true C signature.
+            Some(unsafe { std::mem::transmute_copy::<_, T>(&f) })
+        }
+        // SAFETY: `lib` is the live module handle from the successful load above.
+        unsafe {
+            Some(Self {
+                create: sym(lib, s!("ADL2_Main_Control_Create"))?,
+                destroy: sym(lib, s!("ADL2_Main_Control_Destroy"))?,
+                num_adapters: sym(lib, s!("ADL2_Adapter_NumberOfAdapters_Get"))?,
+                adapter_info: sym(lib, s!("ADL2_Adapter_AdapterInfo_Get"))?,
+                edid_caps: sym(lib, s!("ADL2_Adapter_EDIDManagement_Caps"))?,
+                board_layout: sym(lib, s!("ADL2_Adapter_BoardLayout_Get"))?,
+                conn_state: sym(lib, s!("ADL2_Adapter_ConnectionState_Get"))?,
+                conn_data_get: sym(lib, s!("ADL2_Adapter_ConnectionData_Get"))?,
+                conn_data_set: sym(lib, s!("ADL2_Adapter_ConnectionData_Set"))?,
+                conn_data_remove: sym(lib, s!("ADL2_Adapter_ConnectionData_Remove"))?,
+                emul_mode_set: sym(lib, s!("ADL2_Adapter_EmulationMode_Set"))?,
+            })
+        }
+    }
+}
+
+// ---- the probe ----
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum EmulAction {
+    /// Read-only: caps + layout + per-connector state. Always safe.
+    Probe,
+    /// Pin live EDID + `ADL_EMUL_MODE_ALWAYS` on occupied (or named) connectors.
+    Lock,
+    /// `ADL_EMUL_MODE_OFF` + remove pinned EDID on all (or named) connectors.
+    Unlock,
+}
+
+fn epoch_ms() -> u128 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis())
+        .unwrap_or(0)
+}
+
+/// The bench's correlation-line convention (`epoch_ms op target took_ms ok`), plus the decoded
+/// rc and any op-specific fields — the rc is what a field report gets read for.
+fn line(op: &str, target: &str, took_ms: u128, rc: i32, extra: &str) {
+    let sep = if extra.is_empty() { "" } else { " " };
+    println!(
+        "{} {op} {target} took_ms={took_ms} ok={} rc={rc}({}){sep}{extra}",
+        epoch_ms(),
+        rc == ADL_OK,
+        rc_str(rc),
+    );
+}
+
+fn c_str(buf: &[u8]) -> String {
+    let len = buf.iter().position(|&c| c == 0).unwrap_or(buf.len());
+    String::from_utf8_lossy(&buf[..len]).into_owned()
+}
+
+pub fn run(action: EmulAction, connector_filter: Option<i32>) -> ! {
+    let Some(adl) = Adl::load() else {
+        eprintln!(
+            "atiadlxx.dll not loadable (or an export is missing) — not an AMD driver install; \
+             the ADL emulation lever does not exist on this box"
+        );
+        std::process::exit(2);
+    };
+
+    let mut ctx: AdlContext = std::ptr::null_mut();
+    let t = Instant::now();
+    // SAFETY: documented init call — our allocator callback, iEnumConnectedAdapters=0 (ALL
+    // adapters: an exclusively-isolated streaming host may report no "connected" display on the
+    // physical GPU), and a valid out-slot for the context.
+    let rc = unsafe { (adl.create)(adl_malloc, 0, &mut ctx) };
+    line("adl-init", "atiadlxx", t.elapsed().as_millis(), rc, "");
+    if rc != ADL_OK {
+        std::process::exit(1);
+    }
+
+    let mut count = 0i32;
+    // SAFETY: live context; valid out-param.
+    let rc = unsafe { (adl.num_adapters)(ctx, &mut count) };
+    if rc != ADL_OK || count <= 0 {
+        line("adl-num-adapters", "all", 0, rc, &format!("count={count}"));
+        std::process::exit(1);
+    }
+    let mut infos: Vec<AdapterInfo> = (0..count)
+        .map(|_| {
+            // SAFETY: AdapterInfo is plain ints + byte arrays — the all-zero pattern is valid,
+            // and ADL fills the array in place.
+            let mut a: AdapterInfo = unsafe { std::mem::zeroed() };
+            a.iSize = std::mem::size_of::<AdapterInfo>() as i32;
+            a
+        })
+        .collect();
+    let bytes = std::mem::size_of_val(infos.as_slice()) as i32;
+    // SAFETY: caller-allocated array of exactly `count` stamped entries, byte size passed as the
+    // API's iInputSize contract requires.
+    let rc = unsafe { (adl.adapter_info)(ctx, infos.as_mut_ptr(), bytes) };
+    line("adl-adapters", "all", 0, rc, &format!("count={count}"));
+    if rc != ADL_OK {
+        std::process::exit(1);
+    }
+
+    // One GPU surfaces as many logical adapters — probe each bus once, AMD-present only.
+    let mut seen_buses: Vec<i32> = Vec::new();
+    for info in &infos {
+        if info.iPresent == 0
+            || info.iVendorID != AMD_VENDOR_ID
+            || seen_buses.contains(&info.iBusNumber)
+        {
+            continue;
+        }
+        seen_buses.push(info.iBusNumber);
+        let idx = info.iAdapterIndex;
+        let name = c_str(&info.strAdapterName);
+        let target = format!("adapter{idx}[{}]", name.trim());
+
+        let mut supported = 0i32;
+        let t = Instant::now();
+        // SAFETY: live context, adapter index from this enumeration, valid out-param.
+        let rc = unsafe { (adl.edid_caps)(ctx, idx, &mut supported) };
+        line(
+            "adl-edid-caps",
+            &target,
+            t.elapsed().as_millis(),
+            rc,
+            &format!("supported={supported}"),
+        );
+
+        let (mut valid, mut n_slots, mut n_conn) = (0i32, 0i32, 0i32);
+        let mut slots: *mut c_void = std::ptr::null_mut();
+        let mut connectors: *mut ADLConnectorInfo = std::ptr::null_mut();
+        let t = Instant::now();
+        // SAFETY: live context + adapter index; out-pointers valid; ADL allocates the two arrays
+        // through `adl_malloc` (deliberately leaked, see there).
+        let rc = unsafe {
+            (adl.board_layout)(
+                ctx,
+                idx,
+                &mut valid,
+                &mut n_slots,
+                &mut slots,
+                &mut n_conn,
+                &mut connectors,
+            )
+        };
+        line(
+            "adl-board-layout",
+            &target,
+            t.elapsed().as_millis(),
+            rc,
+            &format!("connectors={n_conn} valid_flags={valid:#x}"),
+        );
+        let connector_list: &[ADLConnectorInfo] =
+            if rc == ADL_OK && !connectors.is_null() && n_conn > 0 {
+                // SAFETY: ADL just filled `connectors` with `n_conn` entries via our allocator; the
+                // (leaked) buffer outlives this borrow.
+                unsafe { std::slice::from_raw_parts(connectors, n_conn as usize) }
+            } else {
+                &[]
+            };
+
+        for c in connector_list {
+            if connector_filter.is_some_and(|want| want != c.iConnectorIndex) {
+                continue;
+            }
+            let port = ADLDevicePort::root(c.iConnectorIndex);
+            let ctarget = format!(
+                "adapter{idx}.connector{}[{}]",
+                c.iConnectorIndex,
+                connector_type_str(c.iType)
+            );
+
+            let mut state = ADLConnectionState::default();
+            let t = Instant::now();
+            // SAFETY: live context; port is a by-value POD naming a connector this adapter just
+            // enumerated; valid out-param.
+            let rc = unsafe { (adl.conn_state)(ctx, idx, port, &mut state) };
+            let real = state.iEmulationStatus & ADL_EMUL_STATUS_REAL_DEVICE_CONNECTED != 0;
+            line(
+                "adl-conn-state",
+                &ctarget,
+                t.elapsed().as_millis(),
+                rc,
+                &format!(
+                    "status={:#x} real_connected={} emulated_present={} emulated_used={} mode={} display={}",
+                    state.iEmulationStatus,
+                    real,
+                    state.iEmulationStatus & ADL_EMUL_STATUS_EMULATED_DEVICE_PRESENT != 0,
+                    state.iEmulationStatus & ADL_EMUL_STATUS_EMULATED_DEVICE_USED != 0,
+                    state.iEmulationMode,
+                    state.iDisplayIndex,
+                ),
+            );
+            if rc != ADL_OK {
+                continue;
+            }
+
+            match action {
+                EmulAction::Probe => {
+                    // SAFETY: ADLConnectionData is plain ints + a byte array; all-zero is valid
+                    // and ADL overwrites it.
+                    let mut data: ADLConnectionData = unsafe { std::mem::zeroed() };
+                    let t = Instant::now();
+                    // SAFETY: live context/port as above; REAL query fills `data` in place.
+                    let rc = unsafe {
+                        (adl.conn_data_get)(ctx, idx, port, ADL_QUERY_REAL_DATA, &mut data)
+                    };
+                    line(
+                        "adl-conn-data",
+                        &ctarget,
+                        t.elapsed().as_millis(),
+                        rc,
+                        &format!(
+                            "type={} edid_bytes={}",
+                            data.iConnectionType, data.iDataSize
+                        ),
+                    );
+                }
+                EmulAction::Lock => {
+                    if !real && connector_filter.is_none() {
+                        continue; // nothing to pin — and pinning an EMPTY connector is a different experiment
+                    }
+                    // SAFETY: as in Probe — zeroed then driver-filled.
+                    let mut data: ADLConnectionData = unsafe { std::mem::zeroed() };
+                    let t = Instant::now();
+                    // SAFETY: live context/port; REAL query first — we pin exactly what the
+                    // sink reports today, so the emulated display IS the user's monitor.
+                    let mut rc = unsafe {
+                        (adl.conn_data_get)(ctx, idx, port, ADL_QUERY_REAL_DATA, &mut data)
+                    };
+                    if rc != ADL_OK {
+                        // Asleep sinks can refuse a live EDID read — fall back to whatever the
+                        // driver already has as emulation data (Radeon-Pro-UI parity).
+                        // SAFETY: same contract, emulated-data query.
+                        rc = unsafe {
+                            (adl.conn_data_get)(ctx, idx, port, ADL_QUERY_EMULATED_DATA, &mut data)
+                        };
+                    }
+                    line(
+                        "adl-lock-read",
+                        &ctarget,
+                        t.elapsed().as_millis(),
+                        rc,
+                        &format!(
+                            "type={} edid_bytes={}",
+                            data.iConnectionType, data.iDataSize
+                        ),
+                    );
+                    if rc != ADL_OK || data.iDataSize <= 0 {
+                        continue;
+                    }
+                    let t = Instant::now();
+                    // SAFETY: live context/port; `data` passed by value per the ADL signature.
+                    let rc = unsafe { (adl.conn_data_set)(ctx, idx, port, data) };
+                    line("adl-lock-set", &ctarget, t.elapsed().as_millis(), rc, "");
+                    let t = Instant::now();
+                    // SAFETY: live context/port; mode constant from the header.
+                    let rc = unsafe { (adl.emul_mode_set)(ctx, idx, port, ADL_EMUL_MODE_ALWAYS) };
+                    line(
+                        "adl-lock-mode-always",
+                        &ctarget,
+                        t.elapsed().as_millis(),
+                        rc,
+                        "",
+                    );
+                }
+                EmulAction::Unlock => {
+                    let t = Instant::now();
+                    // SAFETY: live context/port; mode constant from the header.
+                    let rc = unsafe { (adl.emul_mode_set)(ctx, idx, port, ADL_EMUL_MODE_OFF) };
+                    line(
+                        "adl-unlock-mode-off",
+                        &ctarget,
+                        t.elapsed().as_millis(),
+                        rc,
+                        "",
+                    );
+                    let t = Instant::now();
+                    // SAFETY: live context/port; removes emulation data set earlier (harmless
+                    // where none exists — the rc says so).
+                    let rc = unsafe { (adl.conn_data_remove)(ctx, idx, port) };
+                    line(
+                        "adl-unlock-remove",
+                        &ctarget,
+                        t.elapsed().as_millis(),
+                        rc,
+                        "",
+                    );
+                }
+            }
+        }
+    }
+
+    // SAFETY: destroying the context created above; nothing ADL-owned is used past this point.
+    let _ = unsafe { (adl.destroy)(ctx) };
+    std::process::exit(0);
+}

tools/display-disturb/src/main.rs

@@ -11,6 +11,9 @@
 //! * `modeset` — Class 1: a same-mode `ChangeDisplaySettingsExW(CDS_RESET)` re-commit — a
 //!   Level-Two modeset-class DDI entry that idles the whole adapter ("the graphics hardware is
 //!   idle") without changing anything Win32-visible.
+//! * `adl-emul` — not a disturbance but the LEVER probe for the standby-sink class: AMD ADL
+//!   connector-emulation caps/state, and `--lock`/`--unlock` to pin the live EDID +
+//!   `ADL_EMUL_MODE_ALWAYS` (the software HPD-dummy experiment — see `adl.rs`).
 //!
 //! Every operation prints `epoch_ms op target duration_ms result` so stalls in a concurrent
 //! stream's host.log correlate line-for-line. The per-op duration is itself measurement: it is
@@ -18,6 +21,7 @@
 //!
 //! Usage: `display-disturb ddc [--interval-ms 2000] [--caps] [--vcp 0x10]`
 //!        `display-disturb modeset [--interval-ms 2000]`
+//!        `display-disturb adl-emul [--lock|--unlock] [--connector N]`
 
 // Unsafe-proof program: every `unsafe {}` in this tool carries a `// SAFETY:` proof.
 #![deny(clippy::undocumented_unsafe_blocks)]
@@ -33,6 +37,9 @@ fn main() {
     win::main()
 }
 
+#[cfg(target_os = "windows")]
+mod adl;
+
 #[cfg(target_os = "windows")]
 mod win {
     use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
@@ -77,14 +84,17 @@ mod win {
         interval: Duration,
         caps: bool,
         vcp: u8,
+        emul: crate::adl::EmulAction,
+        connector: Option<i32>,
     }
 
     fn parse_args() -> Args {
         let argv: Vec<String> = std::env::args().collect();
         let mode = argv.get(1).cloned().unwrap_or_default();
-        if !matches!(mode.as_str(), "ddc" | "modeset" | "extend") {
+        if !matches!(mode.as_str(), "ddc" | "modeset" | "extend" | "adl-emul") {
             eprintln!(
-                "usage: display-disturb <ddc|modeset|extend> [--interval-ms N] [--caps] [--vcp 0xNN]"
+                "usage: display-disturb <ddc|modeset|extend|adl-emul> [--interval-ms N] [--caps] \
+                 [--vcp 0xNN] [--lock|--unlock] [--connector N]"
             );
             std::process::exit(2);
         }
@@ -93,6 +103,8 @@ mod win {
             interval: Duration::from_millis(2000),
             caps: false,
             vcp: 0x10, // brightness — universally implemented, read-only harmless
+            emul: crate::adl::EmulAction::Probe,
+            connector: None,
         };
         let mut i = 2;
         while i < argv.len() {
@@ -109,6 +121,16 @@ mod win {
                     let s = argv.get(i).map(String::as_str).unwrap_or("0x10");
                     a.vcp = u8::from_str_radix(s.trim_start_matches("0x"), 16).unwrap_or(0x10);
                 }
+                "--lock" => a.emul = crate::adl::EmulAction::Lock,
+                "--unlock" => a.emul = crate::adl::EmulAction::Unlock,
+                "--connector" => {
+                    i += 1;
+                    a.connector = argv.get(i).and_then(|s| s.parse().ok());
+                    if a.connector.is_none() {
+                        eprintln!("--connector needs a numeric connector index");
+                        std::process::exit(2);
+                    }
+                }
                 other => {
                     eprintln!("unknown arg: {other}");
                     std::process::exit(2);
@@ -130,6 +152,7 @@ mod win {
         match args.mode.as_str() {
             "ddc" => ddc_loop(&args),
             "extend" => extend_once(),
+            "adl-emul" => crate::adl::run(args.emul, args.connector),
             _ => modeset_loop(&args),
         }
     }

web/bun.lock

@@ -46,16 +46,16 @@
     },
   },
   "overrides": {
-    "brace-expansion": "^5.0.9",
+    "brace-expansion": "^5.0.8",
     "dompurify": "^3.4.12",
-    "fast-uri": "^3.1.5",
+    "fast-uri": "^3.1.4",
     "immutable": "^4.3.9",
     "js-yaml": "^4.3.0",
     "linkify-it": "^5.0.2",
-    "postcss": "^8.5.25",
+    "postcss": "^8.5.10",
     "sharp": "^0.35.3",
     "tar": "^7.5.21",
-    "undici": "^7.29.0",
+    "undici": "^7.28.0",
   },
   "packages": {
     "@adobe/css-tools": ["@adobe/css-tools@4.5.0", "", {}, "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q=="],
@@ -1118,7 +1118,7 @@
 
     "body-scroll-lock": ["body-scroll-lock@4.0.0-beta.0", "", {}, "sha512-a7tP5+0Mw3YlUJcGAKUqIBkYYGlYxk2fnCasq/FUph1hadxlTRjF+gAcZksxANnaMnALjxEddmSi/H3OR8ugcQ=="],
 
-    "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "brace-expansion": ["brace-expansion@5.0.8", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
@@ -1388,7 +1388,7 @@
 
     "fast-safe-stringify": ["fast-safe-stringify@2.1.1", "", {}, "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA=="],
 
-    "fast-uri": ["fast-uri@3.1.5", "", {}, "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw=="],
+    "fast-uri": ["fast-uri@3.1.4", "", {}, "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw=="],
 
     "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
 
@@ -1876,7 +1876,7 @@
 
     "pluralize": ["pluralize@8.0.0", "", {}, "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="],
 
-    "postcss": ["postcss@8.5.25", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw=="],
+    "postcss": ["postcss@8.5.22", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ=="],
 
     "postcss-load-config": ["postcss-load-config@6.0.1", "", { "dependencies": { "lilconfig": "^3.1.1" }, "peerDependencies": { "jiti": ">=1.21.0", "postcss": ">=8.0.9", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["jiti", "postcss", "tsx", "yaml"] }, "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g=="],
 
@@ -2196,7 +2196,7 @@
 
     "unctx": ["unctx@2.5.0", "", { "dependencies": { "acorn": "^8.15.0", "estree-walker": "^3.0.3", "magic-string": "^0.30.21", "unplugin": "^2.3.11" } }, "sha512-p+Rz9x0R7X+CYDkT+Xg8/GhpcShTlU8n+cf9OtOEf7zEQsNcCZO1dPKNRDqvUTaq+P32PMMkxWHwfrxkqfqAYg=="],
 
-    "undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
 
     "undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
 

web/bun.nix

@@ -2151,6 +2151,10 @@
     url = "https://registry.npmjs.org/babel-plugin-macros/-/babel-plugin-macros-3.1.0.tgz";
     hash = "sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==";
   };
+  "balanced-match@1.0.2" = fetchurl {
+    url = "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz";
+    hash = "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==";
+  };
   "balanced-match@4.0.4" = fetchurl {
     url = "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz";
     hash = "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==";
@@ -2195,9 +2199,13 @@
     url = "https://registry.npmjs.org/body-scroll-lock/-/body-scroll-lock-4.0.0-beta.0.tgz";
     hash = "sha512-a7tP5+0Mw3YlUJcGAKUqIBkYYGlYxk2fnCasq/FUph1hadxlTRjF+gAcZksxANnaMnALjxEddmSi/H3OR8ugcQ==";
   };
-  "brace-expansion@5.0.9" = fetchurl {
-    url = "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz";
-    hash = "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==";
+  "brace-expansion@2.1.2" = fetchurl {
+    url = "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz";
+    hash = "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==";
+  };
+  "brace-expansion@5.0.7" = fetchurl {
+    url = "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz";
+    hash = "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==";
   };
   "braces@3.0.3" = fetchurl {
     url = "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz";
@@ -2807,9 +2815,9 @@
     url = "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz";
     hash = "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==";
   };
-  "fast-uri@3.1.5" = fetchurl {
-    url = "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz";
-    hash = "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==";
+  "fast-uri@3.1.4" = fetchurl {
+    url = "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz";
+    hash = "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==";
   };
   "fastq@1.20.1" = fetchurl {
     url = "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz";
@@ -3903,9 +3911,9 @@
     url = "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz";
     hash = "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==";
   };
-  "postcss@8.5.25" = fetchurl {
-    url = "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz";
-    hash = "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==";
+  "postcss@8.5.22" = fetchurl {
+    url = "https://registry.npmjs.org/postcss/-/postcss-8.5.22.tgz";
+    hash = "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==";
   };
   "powershell-utils@0.1.0" = fetchurl {
     url = "https://registry.npmjs.org/powershell-utils/-/powershell-utils-0.1.0.tgz";
@@ -4611,9 +4619,9 @@
     url = "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz";
     hash = "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==";
   };
-  "undici@7.29.0" = fetchurl {
-    url = "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz";
-    hash = "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==";
+  "undici@7.28.0" = fetchurl {
+    url = "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz";
+    hash = "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==";
   };
   "unenv@2.0.0-rc.24" = fetchurl {
     url = "https://registry.npmjs.org/unenv/-/unenv-2.0.0-rc.24.tgz";

web/package.json

@@ -64,11 +64,11 @@
     "dompurify": "^3.4.12",
     "linkify-it": "^5.0.2",
     "sharp": "^0.35.3",
-    "fast-uri": "^3.1.5",
+    "fast-uri": "^3.1.4",
     "immutable": "^4.3.9",
-    "undici": "^7.29.0",
-    "postcss": "^8.5.25",
+    "undici": "^7.28.0",
+    "postcss": "^8.5.10",
     "js-yaml": "^4.3.0",
-    "brace-expansion": "^5.0.9"
+    "brace-expansion": "^5.0.8"
   }
 }