feat(pad-audio): DualSense voice-coil haptics + speaker, host to client #23

Merged

enricobuehler merged 24 commits from feat/android-pad-audio into main 2026-08-04 21:56:39 +00:00

Conversation 1 Commits 24 Files Changed 55

+7206 -113

enricobuehler commented 2026-08-02 21:56:23 +00:00

Owner

Copy Link

Copy Source

Per-gamepad DualSense audio: what a game renders into the pad's own audio endpoint (voice coils and speaker) is captured on the host, carried on a new 0xD1 datagram plane, and rendered on the physical controller by the client.

Now merged up to main (86 commits, the whole M1–M12 haptics sweep) with all twelve of the sweep's open findings against this branch fixed.

The merge found three things git could not

The capability bits collided. Both branches allocated the same wire bits for different features:

bit	main	this branch
client_caps 0x04	AUDIO_RED	PAD_AUDIO
host_caps 0x20	AUDIO_RED	PAD_AUDIO

Merged as-is, a peer negotiates redundant desktop audio and gets pad audio. Pad audio moved to the next free bits — CLIENT_CAP_PAD_AUDIO = 0x08, HOST_CAP_PAD_AUDIO = 0x40. The abi.rs compile-time mirror assertions caught my first pass, which is exactly what they exist for.

Both branches claimed ABI v15. Main's shipped (the rumble-policy floor), so the pad-audio surface is v16.

native/input.rs would have reintroduced a fixed bug. This branch resets rumble_seq on pad removal — precisely what M1 established strands every later envelope, because the client's reorder gate is per-connection with no reset path. Took main's seq-preserving clear_pad_feedback, kept only pad_streams.stop(idx).

Also worth knowing: wasapi_cap.rs auto-merged into something that did not compile — main dropped judge_default's enumerator parameter while this branch added 3-arg call sites. Textually clean, semantically broken.

The four findings that mattered

B6 — nothing ever un-muted the coils. Every rumble report asserts HAPTICS_SELECT, SDL's "disable audio haptics" bit: the firmware mutes the very coils the 0xD1 stream drives. Nothing anywhere cleared it, so one rumble left tier-A haptics silent for the rest of that pad's life — no error, nothing logged, the host streaming into a muted actuator. ds5AudioHapticsReport is the documented undo, written EP0-direct on stream start and again after a rumble stop (the stop report re-mutes on its way past).

B10 — the desktop mix could reach a controller's coils. Pad endpoints were filtered inside plan() only; the watchdog, Follow mode and the parked default all go through judge_default, which classifies by name — and a pad endpoint is deliberately stamped "DualSense Wireless Controller" so games treat it as the pad's speaker. No name rule could catch one. Now refused by identity.

B27 — an out-of-range pad aliased onto a real slot. Wire pad 256 steered pad 0's speaker volumes. Fixed at the decoder, making every downstream as u8 lossless by construction. An existing test had pinned the bug in place, asserting wire pad 513 round-trips.

B7 — late caps were never announced. The renderer commits the trade once its sink opens, well past the arrival burst's two 100 ms ticks, and set_pad_audio_caps only stored an atomic — so the client believed it had pad audio while the host emitted nothing. The input task now compares the live registry against what the last arrival carried and re-arms the burst itself.

The other eight

R4	needs_aeb_kick is finally acted on — a stored-but-not-served endpoint is declined, because AUTOCONVERTPCM makes it open successfully and mis-route
R5	a failed provisioning no longer latches PROVISIONED for the process lifetime; host_cap retries, so a host that started while the audio stack was busy recovers at the next connect rather than the next reboot
R6	the loopback-init timeout reaps its thread instead of detaching one per ~2 s reopen
R3	kind-change restarts bounded — the trigger is a client-sent arrival, so the count was client-driven
B11	the devtest uses the endpoint's real 0x33 mask instead of letting wasapi derive 0x0F
R12	the render loop asks is_session_ended() instead of spinning at nice −16
R13	short writes are counted and reported instead of dropping the tail in silence
R14	a frame for another pad is dropped before it can seed the gap tracker from a foreign sequence space

Verification

punktfunk-host	clippy -D warnings 0 on a real Windows box
Linux/amd64	clippy 0, 589 tests — pf-client-core 114, pf-inject 101, punktfunk-client-android 20, punktfunk-core 345+1+8
Android	:kit: tests + :app: compile green
Rust	cargo fmt --all --check clean

Six punktfunk-host tests fail on that Windows box, and none of them are this change. Five fail identically on a tree containing no pad-audio code at all (QUIC Rejected(SetupFailed) — that box's network environment). The sixth passes 3/3 in isolation and only failed under the parallel run, on a locally-bound ephemeral port.

Not verified

On-glass. This is a hardware feature and none of it has been on a real DualSense since the merge — the coil un-mute (B6) and the channel-mask fix (B11) in particular are exactly the things a physical pad would confirm in a minute and no test can.

Per-gamepad DualSense audio: what a game renders into the pad's own audio endpoint (voice coils and speaker) is captured on the host, carried on a new `0xD1` datagram plane, and rendered on the physical controller by the client. Now merged up to main (86 commits, the whole M1–M12 haptics sweep) with **all twelve of the sweep's open findings against this branch fixed**. ## The merge found three things git could not **The capability bits collided.** Both branches allocated the *same* wire bits for *different* features: | bit | main | this branch | |---|---|---| | `client_caps 0x04` | `AUDIO_RED` | `PAD_AUDIO` | | `host_caps 0x20` | `AUDIO_RED` | `PAD_AUDIO` | Merged as-is, a peer negotiates redundant desktop audio and gets pad audio. Pad audio moved to the next free bits — `CLIENT_CAP_PAD_AUDIO = 0x08`, `HOST_CAP_PAD_AUDIO = 0x40`. The `abi.rs` compile-time mirror assertions caught my first pass, which is exactly what they exist for. **Both branches claimed ABI v15.** Main's shipped (the rumble-policy floor), so the pad-audio surface is **v16**. **`native/input.rs` would have reintroduced a fixed bug.** This branch resets `rumble_seq` on pad removal — precisely what M1 established strands every later envelope, because the client's reorder gate is per-connection with no reset path. Took main's seq-preserving `clear_pad_feedback`, kept only `pad_streams.stop(idx)`. Also worth knowing: `wasapi_cap.rs` **auto-merged into something that did not compile** — main dropped `judge_default`'s enumerator parameter while this branch added 3-arg call sites. Textually clean, semantically broken. ## The four findings that mattered **B6 — nothing ever un-muted the coils.** Every rumble report asserts `HAPTICS_SELECT`, SDL's "disable audio haptics" bit: the firmware mutes the very coils the `0xD1` stream drives. Nothing anywhere cleared it, so **one rumble left tier-A haptics silent for the rest of that pad's life** — no error, nothing logged, the host streaming into a muted actuator. `ds5AudioHapticsReport` is the documented undo, written EP0-direct on stream start and again after a rumble stop (the stop report re-mutes on its way past). **B10 — the desktop mix could reach a controller's coils.** Pad endpoints were filtered inside `plan()` only; the watchdog, Follow mode and the parked default all go through `judge_default`, which classifies by **name** — and a pad endpoint is deliberately stamped "DualSense Wireless Controller" so games treat it as the pad's speaker. No name rule could catch one. Now refused by identity. **B27 — an out-of-range pad aliased onto a real slot.** Wire pad 256 steered pad 0's speaker volumes. Fixed at the decoder, making every downstream `as u8` lossless by construction. An existing test had pinned the bug in place, asserting wire pad 513 round-trips. **B7 — late caps were never announced.** The renderer commits the trade once its sink opens, well past the arrival burst's two 100 ms ticks, and `set_pad_audio_caps` only stored an atomic — so the client believed it had pad audio while the host emitted nothing. The input task now compares the live registry against what the last arrival carried and re-arms the burst itself. ## The other eight | | | |---|---| | **R4** | `needs_aeb_kick` is finally *acted* on — a stored-but-not-served endpoint is declined, because `AUTOCONVERTPCM` makes it open successfully and mis-route | | **R5** | a failed provisioning no longer latches `PROVISIONED` for the process lifetime; `host_cap` retries, so a host that started while the audio stack was busy recovers at the next connect rather than the next reboot | | **R6** | the loopback-init timeout reaps its thread instead of detaching one per ~2 s reopen | | **R3** | kind-change restarts bounded — the trigger is a client-sent arrival, so the count was client-driven | | **B11** | the devtest uses the endpoint's real `0x33` mask instead of letting wasapi derive `0x0F` | | **R12** | the render loop asks `is_session_ended()` instead of spinning at nice −16 | | **R13** | short writes are counted and reported instead of dropping the tail in silence | | **R14** | a frame for another pad is dropped before it can seed the gap tracker from a foreign sequence space | ## Verification | | | |---|---| | `punktfunk-host` | clippy `-D warnings` **0 on a real Windows box** | | Linux/amd64 | clippy **0**, **589 tests** — `pf-client-core` 114, `pf-inject` 101, `punktfunk-client-android` 20, `punktfunk-core` 345+1+8 | | Android | `:kit:` tests + `:app:` compile green | | Rust | `cargo fmt --all --check` clean | **Six `punktfunk-host` tests fail on that Windows box, and none of them are this change.** Five fail *identically* on a tree containing no pad-audio code at all (QUIC `Rejected(SetupFailed)` — that box's network environment). The sixth passes **3/3** in isolation and only failed under the parallel run, on a locally-bound ephemeral port. ## Not verified **On-glass.** This is a hardware feature and none of it has been on a real DualSense since the merge — the coil un-mute (B6) and the channel-mask fix (B11) in particular are exactly the things a physical pad would confirm in a minute and no test can.

enricobuehler added 4 commits 2026-08-02 21:56:24 +00:00

feat(pad-audio): DualSense audio haptics + speaker, host->client end to end ... ed3d236ab8

The 0xD1 pad-audio plane streams a DualSense's voice-coil haptics (back
channel pair, 5 ms Opus frames) and speaker (front pair, 10 ms) per pad from
a Windows host to the SDL clients, which render them into a USB DualSense's
own 4-channel audio device.

Wire (punktfunk-core, ABI v15): PAD_AUDIO_MAGIC 0xD1 [pad][kind][seq][pts]
[opus]; CLIENT_CAP_PAD_AUDIO 0x04 / HOST_CAP_PAD_AUDIO 0x20; per-pad render
capability rides GamepadArrival flags bits 8/9, sent only toward a host that
advertised its cap so old hosts see byte-identical arrivals; silence is a
frozen seq (mic-mute discipline), loss is a seq gap concealed via
AudioGapTracker. HidOutput::AudioCtl (0xCD kind 0x06) forwards the 0x02
report's audio-control bytes 5..=10 change-only, value-deduped, with a
once-per-pad "title asserted haptics-select" diagnosis log.

Windows host endpoint provider (audio/windows/pad_endpoint.rs): per-pad
render endpoints are additional devnode instances of Valve's Steam Streaming
Speakers driver (SetupDiRegisterDeviceInfo, NOT the class installer - it
needs an interactive window station), stamped with DualSense identity: desc
"Wireless Controller", device name "DualSense Wireless Controller",
ContainerId = the virtual pad's PFDS GUID, 4ch/48k format triplet.
IPropertyStore route first, ACL-repaired registry fallback (the MMDevices
keys deny writes even to SYSTEM; the owner's implicit WRITE_DAC + an ACE for
S-1-5-18 resolved by SID is the way in). Provisioned at host startup
(PUNKTFUNK_PAD_AUDIO, PUNKTFUNK_PAD_AUDIO_SLOTS, default 1), idempotent via
a persisted PunktfunkPadIndex marker; pad endpoints are structurally
ineligible for the mic/loopback wiring plan and guarded against default-
device theft; capture is WASAPI loopback on the stamped endpoint. Devtest:
punktfunk-host pad-endpoint ensure|remove|status.

Host service (native/pad_audio.rs): per-(session,pad) thread, loopback 4ch
-> pair splitter -> per-kind stereo Opus (48k LowDelay CBR 64k) -> per-kind
silence gate (opens at peak>=1e-3, 250 ms hangover, gated = no send + frozen
seq) -> datagrams. Spawned from the native input pump when a DualSense/Edge
arrival carries audio bits and both caps negotiated; idempotent re-arrivals;
reaped on remove and teardown.

Client tier A (pf-client-core/pad_audio.rs): settings pad_haptics (default
on) and pad_speaker (default "pad"); tier A = wired USB DS5/Edge via SDL
connection state with an audio-sibling fallback; correlation maps the SDL
HID path to the pad's own render endpoint (Windows: ContainerId match +
4ch gate via registry; Linux: Sony sink signature); renderer decodes both
kinds into a quad interleave and plays it on the pad's endpoint (WASAPI
autoconvert / PipeWire target.object, 240-2400 frame ring floor,
dont-reconnect so an unplug never re-routes haptics to the desktop
speakers). SDL's DualSense driver sets "disable audio haptics" whenever it
drives rumble emulation, so tier-A pads suppress wire rumble and send one
cleared-enable-bits effects packet to keep the actuators live; AudioCtl
bytes fold back into the effects packet at report-minus-one offsets.

Verification: punktfunk-core 265 tests (macOS) + clippy -D warnings (mac +
Linux docker); pf-inject 85 tests (Linux docker); punktfunk-host cargo
check + clippy + 19 pad tests + 46 audio-module tests (Windows box);
pf-client-core 30 tests + clippy (Linux docker CI image) + cargo check
(Windows box); punktfunk-client-session clippy (Linux) + check (Windows);
cargo fmt --all --check clean on the final tree. NOT yet verified: any
on-glass run (host deploy + real title + physical pad), the stamp-route
split at runtime, exclusive-mode Initialize isolation, Linux-host emission
(the per-pad PipeWire sink is not in this change - Windows hosts only).
Scope excluded deliberately: tier B (Apple CoreHaptics) and tier C
(haptics->rumble derivation), pad_speaker="mix", Android leg, settings UI
surfaces (keys are serde-defaulted), GameStream-plane arrivals (audio_caps
always 0 there).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(android): tier-A pad audio — the 0xD1 plane on the pad's USB endpoint (WP9) ... b5f91d50bb

The Android twin of `pf-client-core`'s pad_audio: drain the host's per-pad
DualSense streams, Opus-decode haptics (kind 0) and speaker (kind 1), interleave
into the pad's own 4-channel layout, and render on the pad itself.

Every other client hands that stream to the platform's audio graph. Android
cannot: AOSP's UsbAlsaManager denylists the DualSense's output by VID/PID, so
the kernel enumerates the pad's playback node and the framework discards it —
`hasOutput: false`, nothing for setPreferredDevice to target, /dev/snd closed by
SELinux, and UsbRequest rejects non-bulk/interrupt endpoints. So this drives the
pad's isochronous endpoint directly via uac-host on the descriptor Java owns.

That is measured, not assumed. On a Nothing Phone (3): the claim succeeds
unprivileged, the gamepad and the pad's microphone both keep working, and the
underrun-free floor is 4 ms — holding under eight-core load with the SoC in
severe thermal throttling. The renderer runs at 6 ms, one step of headroom,
because the same measurement found transient events that are not depth-dependent.

Structured to the crate's own convention: the mixer and PLC are ungated so they
compile and unit-test in the host workspace (8 tests), while everything touching
an Android-only dependency is cfg'd to android. Two details worth review:

- The kinds arrive on different cadences (5 ms vs 10 ms), so each has its own
  write cursor and both shift together on overflow — a haptics-only session
  renders with a silent speaker pair instead of stalling on a kind that will
  never arrive, and the two can never skew.
- An unrecognised kind is dropped rather than folded into the coil pair. A
  `min(1)` clamp would have rendered a future kind straight into the actuators.

Lifecycle mirrors MicCapture: dropping the handle joins the thread, and
nativeStopPadAudio returns only once it has, so Kotlin may close the
UsbDeviceConnection as soon as it returns and not before.

usbfs-iso/uac-host enter as git dependencies pinned by revision — a transport
under a real-time deadline should move when we choose. They become version
dependencies once published to crates.io.

feat(android): declare pad-audio caps and take tier-A pads off wire rumble ... a10bde39bb

The two things that decide whether WP9 does anything at all on a device, both
failing silently rather than loudly if missed.

**Capability bits.** The host emits 0xD1 only toward pads that declared they can
render it (arrival flags 8/9). Without `set_pad_audio_caps` the renderer would
sit on a permanently empty plane and look like a decode bug. Declared when the
stream opens, withdrawn when it stops.

**Rumble arbitration.** `valid_flag0` bit 1 (HAPTICS_SELECT) *disables* audio
haptics and selects classic rumble, and `DsDevice` sets it on every rumble write
— as Linux's hid-playstation and SDL both do. One replayed rumble command would
mute the voice coils the 0xD1 stream is driving, for the rest of the session.
Tier A and tier C are mutually exclusive in the pad's firmware, so the
arbitration selects and never blends.

Suppression sits at `nativeNextRumble`, the pull point, rather than in Kotlin:
it keeps the rule next to the reason and covers every caller. The registry is an
atomic bitmask because the reader is the rumble poll thread and must not block
behind a start/stop on the JNI thread.

Order matters on teardown: the capability is withdrawn before the pad returns to
wire rumble, so the host has stopped sending 0xD1 before tier C resumes and the
two never overlap.

`nativeStartPadAudio`/`nativeStopPadAudio` now take the wire pad index, since
both the capability and the arbitration are per-pad. Out-of-range indices are
rejected rather than wrapped into another pad's slot.

12 host tests (2 new, including one pinning that an out-of-range index cannot
shift the mask into undefined territory), 0 clippy findings, check clean on all
three Android ABIs.

feat(android): wire tier-A pad audio through the capture lifecycle and settings ... e8499e6131

The Kotlin half. Turns out Android needs to claim nothing extra: `uac-host`
claims the pad's audio interface itself through usbfs on the fd, and usbfs
claims are per interface, so the HID claim `HidUsbLink` already holds is
untouched. The link therefore surrenders only its file descriptor.

Two orderings carry the whole design, and both are easy to get wrong:

- **Start on the first report, not at claim time.** The wire pad index does not
  exist until the router opens a slot, and the host addresses the 0xD1 stream by
  that index — starting earlier would declare capabilities for a pad that has no
  index yet.
- **Stop before the link closes.** `usb.stop()` closes the connection whose
  descriptor the render thread borrows, so `padAudio.stop()` runs first, at the
  top of `DsCapture.stop()`. `nativeStopPadAudio` does not return until the
  thread is joined, which is what makes the borrow sound rather than merely
  usually-fine.

`DsCapture` decides WHEN (it owns the wire index and the link lifetime);
`StreamScreen` decides WHETHER (it owns the session handle and the settings).
The capture stays ignorant of sessions.

Settings: `padHaptics` defaults on — it is the whole point, and this client's
rumble already drives the same actuators, so tier A is a strict improvement.
`padSpeaker` defaults OFF: it is a small loudspeaker in the user's hands playing
audio they can already hear, and surprising someone with that is worse than
making them opt in.

Verified: APK builds, and both JNI entry points are exported in the shipped
arm64 .so — a missing one would be an UnsatisfiedLinkError only at runtime.
12 Rust tests, 0 clippy findings, fmt clean.

enricobuehler added 1 commit 2026-08-02 22:04:20 +00:00

fix(android): advertise CLIENT_CAP_PAD_AUDIO, without which nothing is ever sent ... 8ee224e5db

A gap in the previous commits, and the same silent-failure shape as the two they
fixed. There are TWO negotiations, not one: the per-pad render capabilities that
ride a gamepad arrival (bits 8/9), which those commits set, and the SESSION-level
CLIENT_CAP_PAD_AUDIO in the Hello, which they did not. Without the latter the
host never sets HOST_CAP_PAD_AUDIO and emits no 0xD1 at all — so the per-pad bits
would have had nothing to gate, and the renderer would have sat on a permanently
empty plane with every other piece looking correct.

Threaded as an explicit `padAudioOk` on nativeConnect rather than advertised
unconditionally: the cap makes a Windows host provision pad endpoints at startup,
and a user who has pad audio switched off should not pay for that.

Found by tracing what an on-glass run against a real host would actually need,
not by a test — there is no test that could have caught it, since both halves are
individually well-formed.

enricobuehler added 1 commit 2026-08-02 22:34:53 +00:00

fix(android): commit the tier-A trade only once the USB stream actually opens ... 2f1ef44191

A real bug, and the worst shape one can take here: it costs the user ALL
haptics rather than degrading.

`pad_audio::start` returned success as soon as the render thread spawned, and
`nativeStartPadAudio` then declared the pad's render capability and took it off
wire rumble. But `sink::open` runs later, on that thread. On a kernel that
refuses the interface claim — the OEM case documented as needing a clean tier-C
fallback — the pad was already suppressed and the host already streaming 0xD1 at
a renderer that never opened. No pad audio, and no rumble either.

The declaration and the suppression now happen inside the renderer, immediately
after a successful open, and are both withdrawn when it stops. A failed open
declares nothing and suppresses nothing, so the session stays on ordinary rumble
— which is what "degrades to tier C" was always supposed to mean. `PadAudio`'s
Drop clears the tier-A bit too, so a thread that dies unexpectedly cannot leave a
pad permanently mute.

The general rule this violated: never give up a working fallback until the thing
replacing it is known to work. Spawning a thread is not evidence that it will.

enricobuehler added 1 commit 2026-08-02 22:39:04 +00:00

fix(android): give the renderer its own USB connection, and add a real-world self test ... e32bd30c85

**The bug.** The renderer was handed `HidUsbLink`'s file descriptor. That link's
own comment states the hazard exactly — "only one thread may drive a
connection's UsbRequests (requestWait() returns ANY completed request; a second
waiter would steal the reader's completions)" — and it is just as true of the
usbfs reap underneath: the isochronous ring and the HID reader were reaping each
other's URB completions. The standalone harness works because it owns its
descriptor by construction, which is precisely why it could never have caught
this. `DsCapture` now opens a dedicated connection via `openAuxConnection()` and
closes it only after the render thread is joined.

**The test.** Nothing exercised the CLIENT path without a host, so the two things
most likely to be wrong were invisible: whether the descriptor handed over is
exclusively ours, and whether the claim succeeds on this kernel. Neither is
unit-testable and a harness proves neither.

`nativePadAudioSelfTest` drives the voice coils with a tone through the real
path — the same aux connection, claim, sink and write loop the renderer uses —
and is triggered by `adb shell setprop debug.punktfunk.pad_audio_selftest 3`,
matching this repo's existing debug.punktfunk.* convention. It runs INSTEAD of
the renderer for that capture, never alongside it: two engines on one descriptor
is the fault being tested for, and I nearly shipped it into the test itself.

Underruns are deliberately not a failure condition — that is producer pacing.
The pass condition is data reaching the bus.

enricobuehler added 1 commit 2026-08-03 07:38:55 +00:00

test(android): make the pad-audio self test reachable without a host ... 4fd240deab

The self test shipped in the previous commit was gated behind a capture, which
needs a stream, which needs a host — so it depended on precisely the thing it
exists to rule out. It could not have been run in the situation that motivated
it.

It is now a "Test haptics" button on the DualSense passthrough card in
Settings → Controllers → Connected controllers, which is reachable with no
session at all. It opens its OWN connection to the pad — the same rule the
renderer follows, and the rule whose violation caused the fault this test looks
for — runs the tone on a worker thread, and reports a plain-language result:
which of open / write / no-data failed, or how many frames reached the pad.

The debug-property trigger stays for the in-session case; this is the one that
answers "can this phone drive this pad at all" before a host is even involved.

enricobuehler added 1 commit 2026-08-03 08:01:12 +00:00

test(android): report renderer stats even when the plane is silent ... 6fed1510ba

The renderer now reports once a second regardless of traffic — frames in,
samples decoded, peak level, frames written, underruns, short bytes.

The first version reported only after a frame arrived, which made the single
most diagnostic state unreportable: an idle plane and a dead renderer looked
identical (both silent). That cost a debugging round on real hardware, where the
absence of any line had to be triangulated against usbfs interface claims and
`dumpsys input` to work out which of the two it was.

The peak is of the decoded PCM, and it is the discriminator that matters: frames
arriving with peak=0 means the host's capture is hearing silence — a routing
problem upstream — whereas a non-zero peak means real signal is reaching the pad
and anything still wrong is downstream of the write.

enricobuehler added 1 commit 2026-08-03 08:05:58 +00:00

wip(host): pad-endpoint tone devtest 45cb525035

enricobuehler added 1 commit 2026-08-03 08:09:58 +00:00

fix(devtest): resolve the pad endpoint by system lookup, not the service's cache 212bdc3b08

enricobuehler added 7 commits 2026-08-03 16:57:28 +00:00

fix(host/pad-audio): provisioning stops corrupting the heap, and the endpoint stops being resolved by a freed string ... 9409d0a04c

Two defects sat between the pad-audio endpoint and any sound. Neither was
where the symptom pointed.

`windows 0.62` implements `Drop for PROPVARIANT` as `PropVariantClear(self)`.
Every variant `set_store_value` builds borrows memory Rust owns — a `Vec<u16>`,
a `&GUID`, a `&'static [u8]` — so each stamp handed that pointer to
`CoTaskMemFree`. The file said the opposite in a comment, which is why it
looked safe. The damage surfaced late: `pad-endpoint ensure` died with
STATUS_HEAP_CORRUPTION (0xC0000374) partway through stamping, leaving the
endpoint with whatever subset had landed and `needs_aeb_kick` stuck true
forever. With the variants held in `ManuallyDrop`, `ensure` exits 0 and all
seven stamps read back served for the first time.

`wasapi 0.23`'s `DeviceEnumerator::get_device` builds its argument as
`PCWSTR::from_raw(HSTRING::from(id).as_ptr())`; the `HSTRING` is a temporary,
so `GetDevice` reads freed memory. That is where the `IAudioClient: 0x80070002`
came from — not from the endpoint, which activates fine. Resolving through
`open_mmdevice`, which keeps its buffer alive, retires the error in both the
tone devtest and the loopback capture.

Also adds the instrument that separated these: the tone path now reports the
raw `IMMDevice::Activate` result alongside the crate's, and `pad-endpoint tone
--endpoint <id>` can drive any endpoint, so "this process cannot activate
anything" and "this endpoint is broken" stop looking identical.

Verified on .173: ensure exit=0, 7/7 stamps served, needs_aeb_kick=false,
0x80070002 gone. Host clippy clean; 360 tests pass (the one mgmt display
failure reproduces on a clean tree).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test(host/pad-audio): let a stamp subset be re-provisioned, and confirm the endpoint really is 4ch ... 143454590f

`PUNKTFUNK_PAD_AUDIO_STAMPS` narrows `ensure` to a named subset of the seven
stamps (unset keeps all of them, so the shipping path is unchanged). The
MMDevices Properties ACL denies even an elevated `reg delete`, so the only way
to ask "which stamp breaks this endpoint" was to re-provision with subsets.

Using it settled that nothing does. Once the heap corruption is out of the way
and stamping completes in ONE pass, the full set yields an endpoint that is
4ch/48k/mask 0x33 with both directions open — render and the loopback capture
that feeds the 0xD1 plane — and `pad-endpoint tone` renders without error.

The intermediate reading, that the Steam driver was stereo-only and the feature
needed a different carrier, was a confounded A/B: the "stamped" sample had
accumulated its stamps across heap-corrupted runs. Asked properly — in
EXCLUSIVE mode, which reaches the driver instead of the engine's mix format —
that driver reports 2ch, 4ch and 8ch, the same shape a real DualSense reports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

style(host/pad-audio): drop a redundant f32 cast in the tone devtest ... 0d0e7e6861

clippy's `unnecessary_cast` fires on it, which fails CI's -D warnings.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fix(host/pad-audio): retire the freed-string endpoint lookup everywhere, and make provisioning converge ... 35285afafc

Two loose ends from the pad-audio bring-up.

`wasapi 0.23`'s `DeviceEnumerator::get_device` passes `GetDevice` a pointer
into an `HSTRING` temporary that was already dropped, so it resolves whatever
the allocator left behind and misses ids that are perfectly valid. Only the
pad-audio path had been moved off it; the remaining four callers include
desktop loopback capture and the default-endpoint judgement, where a spurious
miss silently downgrades a capturable default to Unknown. The host now resolves
through `open_wasapi_device` (raw COM, buffer kept alive). `pf-client-core`
cannot share that helper — it pins a different `windows` revision than `wasapi`
does, so the two `IMMDevice` types are incompatible — and instead scans the
active collection by id, which touches only safe crate APIs.

Provisioning also stopped latching a transient. A stamp lands, a check run
immediately afterwards reports all seven keys served, and AudioEndpointBuilder
then reverts the three format keys behind us, leaving 4/7 for good. Since
`needs_aeb_kick` is what makes startup restart AudioEndpointBuilder + Audiosrv,
that transient meant bouncing the machine's whole audio stack on every host
start, forever, chasing stamps a re-pass lands. `ensure` now stamps, lets AEB
settle, and only then checks — repeating up to five times.

Before: fresh provisions landed 4/7 with kick=true on 3 of 4 runs. After: 4 of
4 runs settle 7/7 with kick=false in 2.8s, identity intact (Wireless
Controller / DualSense Wireless Controller / PFDS container), 4ch mask 0x33,
render and loopback capture both opening, and `pad-endpoint tone` clean.

Host clippy clean; 360 tests pass, the one mgmt display failure reproduces on a
clean tree. The client-side helper is type-checked against wasapi on Windows in
isolation — pf-client-core itself will not build on .173 (no ffmpeg/SDL3/Vulkan
toolchain there), so its module integration is unverified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test(host/pad-audio): prove the endpoint actually carries audio, channel-exact ... 64a392634e

`pad-endpoint tone` only ever proved a render client could open the endpoint.
Whether anything came back out of the loopback — and in the right channel pair —
was still taken on faith, which is exactly the gap that let a stamped-but-
unservable endpoint look healthy while a client sat on an empty plane.

`pad-endpoint capture [seconds]` opens the real PadLoopbackCapturer and reports
frames plus per-pair peaks, so the two halves together exercise render -> engine
-> loopback -> pair routing with no game and no client attached.

Run against each other on .173:

  pad-endpoint capture: 157920 frames over 7s, peak_front=0.0000 peak_back=0.5000
  VERDICT: PASS - back pair only, front pair silent (channel-exact).

0.5 is the tone's own amplitude and the front pair is dead silent, which is the
signal the 0xD1 framer routes to the voice coils. Same figure the program notes
recorded on 2026-08-01 and nothing has been able to reproduce since.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test(host/pad-audio): drive either channel pair, so the speaker leg can be proven too ... 3a48cc2470

`pad-endpoint tone` only ever drove the BACK pair, which meant the pad's speaker
— the FRONT pair, the other half of the 4-channel split — had never carried a
signal end to end. The capture probe's verdict was shaped the same way, and
called a perfectly good front-pair run "silent".

`--pair front|back|both` picks the pair, and the verdict now reports which pair
it SAW rather than judging against an assumed one.

Measured on .173, an exact mirror in both directions and no crosstalk either way:

  --pair back   peak_front=0.0000  peak_back=0.5000   back only, channel-exact
  --pair front  peak_front=0.5000  peak_back=0.0000   front only, channel-exact
  --pair both   peak_front=0.5000  peak_back=0.5000   both

So the host half of the speaker path is proven to the same standard the haptics
path was. What is still unproven is the client rendering the front pair into the
pad's own speaker; that needs the phone unlocked, which it no longer is.

Host clippy clean; 360 tests pass, the one mgmt display failure reproduces on a
clean tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fix(android/pad-audio): pin the uac-host that unmutes the pad ... 0d5e5b436b

The pad rendered nothing — not its speaker, not its voice coils — because
`uac-host` streamed into a device it never unmuted. It set the sample rate and
nothing else; the UAC Feature Unit, where Mute and Volume live, was parsed by
nobody. Every counter stayed green throughout: URBs completed, 0 short bytes,
0 URB errors, 0 short writes here, decoded peak 19345. None of them can observe
mute, so a muted device is indistinguishable from a working one.

Bumps the pin to unom-io/usbfs-iso f3de1fd, which sends SET_CUR Mute=0 and
Volume=0 dB to the Feature Unit before the stream starts.

With this in, Spider-Man Remastered's haptics reach the physical DualSense
through the virtual pad, confirmed by feel on real hardware.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

enricobuehler added 1 commit 2026-08-03 17:11:40 +00:00

merge: bring main into the pad-audio branch ... 5be494f490

Main had moved 34 commits past the merge-base and 13 files had diverged.
Resolving now rather than later, since the force-feedback sweep work is landing
in the same files.

Five conflicts needed hand resolution. Four were "each side added something
different" and keep both: the Forwarding and PadAudioPrefs control variants with
their handlers and setters (pf-client-core/gamepad.rs), both of the session's
pre-attach declarations (forwarding first, so slots still declare their
pad-audio caps at open time), main's WiredPlan/fingerprint alongside the
branch's pad_render_ids (audio_control.rs), and main's judge_default signature
(wasapi_cap.rs).

wiring_plan.rs was not mechanical. Main's 652abeb3 added a flagged last-resort
loopback tier; the branch had added a fifth `plan` parameter excluding pad
endpoints from every role. Taking either side alone loses the other, and
combining them carelessly is worse than both: the new last-resort tier would
happily select the pad's own speaker endpoint, which is stamped "DualSense
Wireless Controller" with no virtual marker precisely so games read it as the
pad's speaker — routing the entire desktop mix into the controller's voice
coils. The branch's exclusion shadows `renders` before any tier runs, so the
last resort inherits it; `a_pad_is_never_the_last_resort` pins that, including
that a pad-only candidate set stays honestly unsatisfiable rather than falling
back onto the coils.

Verified: clippy -p punktfunk-host -p pf-client-core --all-targets --locked
-D warnings = 0; pf-client-core 93/93; punktfunk-host 387 passed with only the
known-environmental gamestream sender_delivers_batches UDP-loopback flake;
wiring_plan 21/21; fmt clean.

NOT verified: audio_control.rs and wasapi_cap.rs are cfg(windows), so neither
the Linux container nor xcheck.sh compiles them. Those two resolutions have had
review only and need the Windows runner before this merges.

enricobuehler added 1 commit 2026-08-03 17:39:13 +00:00

Merge branch 'main' into feat/android-pad-audio 9a52c279f1

enricobuehler referenced this pull request 2026-08-03 17:39:48 +00:00

chore(release): bump workspace version to 0.24.0 #29

enricobuehler added 1 commit 2026-08-03 17:45:09 +00:00

fix(android/pad-audio): a game that only rumbles keeps rumbling ... 2032c48ffa

Three faults that between them silence a wired DualSense.

The trade was committed without asking whether the host can send pad audio at
all. Against every released host — no HOST_CAP_PAD_AUDIO — the renderer claimed
the interface, took the pad off wire rumble, and then rendered nothing, with
`pad_haptics` defaulting on and no UI to turn it off. The capability is now
checked before `sink::open`, so nothing is claimed and nothing is traded.

Arming was unconditional, so a speaker-only setup took the motors away too. The
speaker pair is channels 0/1 and no rumble write can disturb it; only the
haptics lane arms now.

And the suppression itself was wrong for the case that matters most: a title
driving classic rumble and no haptics audio. Suppressing on "a stream is open"
assumed the game's rumble rides the haptics mix, which for such a title is
false — it renders no haptics audio at all, so the host's -60 dBFS gate emits
nothing on 0xD1 and the pad was left with neither. Ownership is now decided by
evidence: the coils belong to haptics only while haptics frames are actually
arriving, and to wire rumble otherwise. Frames are stamped on arrival rather
than after decode, so a decoder hiccup cannot hand the coils back mid-effect,
and concealment does not count as evidence. Liveness is dropped at every
teardown, because wire indices are recycled and a stale stamp would let a fresh
pad inherit the previous occupant's ownership.

Arbitrating on evidence rather than on a prediction about the hardware is
deliberate, and the module doc now says why. It used to assert that the coils
and the rumble motors are the same physical actuators — "a firmware constraint,
not a preference". Nothing establishes that: it traces to one reverse-engineered
comment in SDL, whose own modern path sets HAPTICS_SELECT alone with amplitude
on ucEnableBits3, which reads more like an independent mute than a shared-
actuator interlock. The combination that would settle it — rumble with
HAPTICS_SELECT cleared — is emitted by no code anywhere, and nothing here writes
it either. The evidence rule is correct under either hypothesis.

The liveness clock is 1-based so that 0 stays an unambiguous "never stamped":
without it a frame arriving in the process's first millisecond read as
never-arrived and handed the coils back mid-effect. Its test caught that.

Verified: clippy -p punktfunk-client-android --all-targets --locked -D warnings
= 0; 15 tests pass.

Owed: the desktop twin of the arbiter, and the coil restore — the Android stop
write still asserts HAPTICS_SELECT with zero amplitude, where SDL's all-zero
stop restores the audio path.

From the 2026-08-03 force-feedback sweep (B4, B5; B6 partly).

enricobuehler commented 2026-08-03 17:53:08 +00:00

Author

Owner

Copy Link

Copy Source

Deferred to 0.25.0 — please do not merge into 0.24.0.

This branch is current with main and conflict-free, but the feature is not finished:

• The desktop arbiter is missing. Android now decides coil ownership by evidence (haptics owns the coils only while 0xD1 frames are actually arriving, so a rumble-only game keeps its motors), but pf-client-core still suppresses wire rumble the moment tier A is armed. Until that lands, a desktop DualSense on a host with pad audio loses rumble in exactly the titles that never send haptics audio.
• B6 — the coils are never un-muted. DsDevice.ds5RumbleReport asserts HAPTICS_SELECT even on a zero-amplitude stop, where SDL's all-zero stop restores the audio path. So the mute latches, and the arbitration hands rumble back correctly while leaving the coils dead afterwards.
• Two cfg(windows) merge resolutions are uncompiled. audio/windows/audio_control.rs and wasapi_cap.rs were resolved by hand in 5be494f4; neither the Linux container nor xcheck.sh builds them, so they have had review only and need the Windows runner.

What is verified on this branch: the wiring_plan.rs merge (21 tests, including a_pad_is_never_the_last_resort, which pins that the last-resort loopback tier main added can never select a pad's own speaker endpoint and route the desktop mix into the coils), and the Android P1 work (clippy -D warnings = 0, 15 tests).

Also unresolved and worth knowing before this ships: whether the DualSense's rumble motors and haptic voice coils are the same physical actuators is not established — the claim traces to one reverse-engineered SDL comment, and SDL's own modern path sets HAPTICS_SELECT alone, which reads more like an independent mute than a shared-actuator interlock. The arbitration is deliberately correct either way, but the bench test that would settle it is written up in the code comments and would let a follow-up do better.

**Deferred to 0.25.0 — please do not merge into 0.24.0.** This branch is current with `main` and conflict-free, but the feature is not finished: - **The desktop arbiter is missing.** Android now decides coil ownership by evidence (haptics owns the coils only while `0xD1` frames are actually arriving, so a rumble-only game keeps its motors), but `pf-client-core` still suppresses wire rumble the moment tier A is armed. Until that lands, a desktop DualSense on a host with pad audio loses rumble in exactly the titles that never send haptics audio. - **B6 — the coils are never un-muted.** `DsDevice.ds5RumbleReport` asserts `HAPTICS_SELECT` even on a zero-amplitude stop, where SDL's all-zero stop restores the audio path. So the mute latches, and the arbitration hands rumble back correctly while leaving the coils dead afterwards. - **Two `cfg(windows)` merge resolutions are uncompiled.** `audio/windows/audio_control.rs` and `wasapi_cap.rs` were resolved by hand in `5be494f4`; neither the Linux container nor `xcheck.sh` builds them, so they have had review only and need the Windows runner. What *is* verified on this branch: the `wiring_plan.rs` merge (21 tests, including `a_pad_is_never_the_last_resort`, which pins that the last-resort loopback tier main added can never select a pad's own speaker endpoint and route the desktop mix into the coils), and the Android P1 work (clippy `-D warnings` = 0, 15 tests). Also unresolved and worth knowing before this ships: whether the DualSense's rumble motors and haptic voice coils are the *same physical actuators* is **not established** — the claim traces to one reverse-engineered SDL comment, and SDL's own modern path sets `HAPTICS_SELECT` alone, which reads more like an independent mute than a shared-actuator interlock. The arbitration is deliberately correct either way, but the bench test that would settle it is written up in the code comments and would let a follow-up do better.

enricobuehler added 1 commit 2026-08-04 18:15:29 +00:00

fix(android/pad-audio): an unplugged pad comes back whole, and an idle one arrives at all ... 173be61213

Three faults on the default capture path, all of them silent.

Unplug tore nothing down. onLinkClosed() is the real unplug signal — silence
never is, an idle pad simply stops streaming — but it skipped the pad-audio
teardown that stop() performs, so the render thread went on writing to a
descriptor whose device was gone, the renderer's own UsbDeviceConnection leaked,
and because the started flag stayed set and the native tier-A registry stayed
armed for that wire index, the pad came back with neither pad audio nor wire
rumble: the next occupant of the index inherited a suppression nothing would
lift. The teardown is now one shared step and runs on both paths, before the
slot is released, since the renderer is addressed by the index the release
forgets.

The wire slot was claimed on the first parsed report. A captured pad that
reports nothing then gave the host no arrival, so no virtual pad, no pad-audio
capability, no 0xD1 — a renderer sitting at zero frames, which is exactly what a
broken pipeline looks like, and it took a physical replug to clear. A pad that
reports nothing is still a pad, so the slot is claimed when the capture engages;
the first report stays as the fallback for a claim that found no free index.
This also puts the common claim on the main thread, which is the contract
GamepadRouter.openExternal documents and the link thread was quietly breaking.

And the two settings had no UI. The model and its persistence existed but no
toggle did, so pad_speaker could only be set by hand-editing shared_prefs, and
pad_haptics — which decides whether the pad trades wire rumble at all — could
not be turned off by anyone who hit trouble with it. Both are now rows under the
DualSense passthrough toggle, gated on it, since neither does anything to an
uncaptured pad.

The padHaptics doc no longer describes the arbitration as a selection forced by
a firmware-level mutual exclusion. It is decided on evidence — the coils belong
to haptics only while haptics frames arrive — which is what 2032c48f changed it
to and why a rumble-only title keeps rumbling.

enricobuehler added 2 commits 2026-08-04 21:56:00 +00:00

Merge main into feat/android-pad-audio ... 0a72959ef7

86 commits of main, including the whole M1-M12 haptics sweep. Twelve conflicting files;
three of them were more than textual.

**The capability bits collided.** Both branches allocated the SAME wire bits for DIFFERENT
features: `client_caps 0x04` and `host_caps 0x20` are redundant desktop audio on main and
pad audio here. Merged naively, a peer would negotiate one and get the other. Pad audio
moves to the next free bits — `CLIENT_CAP_PAD_AUDIO = 0x08`, `HOST_CAP_PAD_AUDIO = 0x40` —
and the `abi.rs` mirrors move with them (their compile-time equality assertions caught the
mismatch, which is exactly what they are for).

**Both branches also claimed ABI v15.** Main's shipped (the rumble-policy floor), so the
pad-audio surface becomes **v16**.

**`native/input.rs` would have reintroduced a fixed bug.** This branch resets
`rumble_seq[idx]` on pad removal; M1 established that the client's reorder gate is
per-connection with no reset path, so restarting the host counter strands every later
envelope until it climbs back. Took main's seq-preserving `clear_pad_feedback` and kept only
the branch's `pad_streams.stop(idx)`.

The rest: `wiring_plan::plan` now delegates to main's `plan_with_formats`, so the pad-endpoint
filter moved into that body and the predicate behind it is factored out as `is_pad_render`
(also what B10 needs); `Ds5Feedback::AUDIO` derives from main's `REPORT_ID_LEN` like its
siblings; `AudioCtl` joins the explicitly-listed unhandled variants so the guard-false case is
covered rather than swept up by a `_`; `include/punktfunk_core.h` regenerated rather than
hand-merged.

fix(pad-audio): close the twelve findings the sweep left open on this branch ... d27e62f7c9

Everything the 2026-08-03 haptics sweep filed against the pad-audio branch (P2 + P3).
Four of them are the difference between a feature that works and one that fails silently.

**B6 — nothing ever un-muted the coils.** Every rumble report asserts `HAPTICS_SELECT`,
which is SDL's "disable audio haptics" bit: the firmware mutes the very voice coils the
0xD1 stream drives. No code anywhere cleared it again, so ONE rumble left tier-A haptics
silent for the rest of that pad's life — no error, nothing in a log, and the host happily
streaming into a muted actuator. `DsDevice.ds5AudioHapticsReport` is the documented undo
(flag0 with both bits clear); written EP0-direct when the stream starts and again after a
rumble stop while a stream is live, because the stop report re-mutes on its way past.

**B10 — the desktop mix could reach a controller's coils.** Pad endpoints were filtered out
inside `plan()` only. The watchdog, Follow mode and the parked default all go through
`judge_default`, which classifies by NAME — and a pad endpoint is deliberately stamped
"DualSense Wireless Controller" so games treat it as the pad's speaker. No name rule could
ever catch one. It now refuses them by identity.

**B27 — an out-of-range pad aliased onto a real slot.** The 0xCD plane's pad is the only u16
index and every consumer narrowed it with `as u8` on an assumption nothing enforced, so wire
pad 256 steered pad 0's speaker volumes. Rejected at the decoder, which makes the narrowings
lossless by construction. An existing test had pinned the bug in place, asserting that wire
pad 513 round-trips; corrected, plus a test for the 256→0 alias specifically.

**B7 — caps that arrived late were never announced.** The renderer commits the tier-A trade
only once its sink opens, which is well past the arrival burst's two 100 ms ticks, and
`set_pad_audio_caps` only stored an atomic. The client believed it had pad audio while the
host emitted nothing. The input task now compares the live registry against what the last
arrival actually carried and re-arms the burst itself — no new plumbing, and no extra traffic
when nothing changed.

The rest: `needs_aeb_kick` is finally ACTED on (R4) — a stored-but-not-served endpoint is
declined rather than opened, because `AUTOCONVERTPCM` makes it succeed and mis-route; a failed
provisioning no longer latches `PROVISIONED` for the process lifetime (R5), and `host_cap`
retries, so a host that started while the audio stack was busy recovers at the next connect
instead of the next reboot; the loopback init timeout reaps its thread instead of detaching one
per ~2 s reopen (R6); kind-change restarts are bounded (R3) since the trigger is a client-sent
arrival; the devtest uses the endpoint's real channel mask (B11) instead of letting wasapi
derive 0x0F against the endpoint's 0x33; the render loop asks `is_session_ended()` rather than
spinning at nice -16 (R12); short writes are counted and reported instead of dropping the tail
in silence (R13); and a frame addressed to another pad is dropped before it can seed the gap
tracker from a foreign sequence space (R14).

Verified: punktfunk-host clippy -D warnings **0 on a real Windows box**; Linux/amd64 clippy 0
with **589 tests** (pf-client-core 114, pf-inject 101, punktfunk-client-android 20,
punktfunk-core 345+1+8); Android :kit: tests + :app: compile green; fmt clean.

Six punktfunk-host tests fail on that Windows box. FIVE fail identically on a tree with no
pad-audio code at all (QUIC `Rejected(SetupFailed)` — the box's network environment); the
sixth passes 3/3 in isolation and only failed under the parallel run, on a locally-bound
ephemeral port. Neither is this change.

Still owed: on-glass. This is a hardware feature and none of it has been on a real DualSense
since the merge.

enricobuehler changed title from WIP: Android tier-A DualSense pad audio (WP9) to feat(pad-audio): DualSense voice-coil haptics + speaker, host to client 2026-08-04 21:56:29 +00:00

enricobuehler merged commit 8983ec04b9 into main 2026-08-04 21:56:39 +00:00

enricobuehler referenced this issue from a commit 2026-08-05 05:48:00 +00:00

chore(release): bump workspace version to 0.25.0

enricobuehler referenced this pull request 2026-08-05 05:48:55 +00:00

chore(release): bump workspace version to 0.25.0 #56

enricobuehler referenced this issue from a commit 2026-08-05 06:15:08 +00:00

fix(client-core): pad-audio references the WASAPI module by its mounted name

enricobuehler referenced this pull request 2026-08-05 06:15:21 +00:00

fix(client-core): pad-audio references the WASAPI module by its mounted name #57

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

FernandoMX enricobuehler (Enrico Bühler) kszlim nannku neoney sassycrown

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unom/punktfunk#23